![\"Original](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/hotelplan-refund-scam-fake-travel-booking-original-email.webp\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nThe trip confirmation is the beginning of a refund trap<\/h3>\n
The Hotelplan refund scam uses a false travel confirmation to send recipients to a website impersonating the travel company.<\/p>\n
There, an apparent paid hotel reservation creates a reason to request reimbursement. The process collects card details and moves toward a banking approval.<\/p>\n
Zurich cantonal police’s September 23 advisory<\/a> documents this sequence. The original email above includes a \u201cBuchungsdetails ansehen\u201d button for viewing booking details.<\/p>\n The message doesn’t establish that a real reservation exists or that Hotelplan took your money. The company is being impersonated.<\/p>\n After asking for card information, the fake site says the refund is being processed. It then requests confirmation in a banking app or an OTP.<\/p>\n Police explain that this confirmation authorizes a payment, not receipt of a refund. The site’s description and the bank’s actual action don’t match.<\/p>\n Check your own booking records and actual card transactions. Contact Hotelplan through an independently reached route if you need to confirm a reservation.<\/p>\n Don’t enter payment information simply to undo something shown only on the suspicious page. First establish whether anything genuine needs undoing.<\/p>\n If you already approved a request, call the issuer promptly. Waiting for the claimed reimbursement gives the fake process more time, not more credibility.<\/p>\n You don’t have to want a holiday to engage with this email. Concern that someone booked in your name can be enough.<\/p>\n The page seems to offer useful evidence: a hotel, an apparent reservation, and a payment status. It also presents its own solution.<\/p>\n That makes the site both the source of the alarm and the place asking you to resolve it. Nothing outside the site has confirmed the booking.<\/p>\n Before starting a cancellation, check whether a real agency or actual card statement shows the same transaction.<\/p>\n An unfamiliar reservation can also encourage rushed decisions. You may want it stopped before a deadline, a departure date, or a family member notices.<\/p>\n Those understandable concerns shouldn’t put the sender in charge of your payment method. Pause long enough to use the genuine travel and banking channels.<\/p>\n If you do have a real Hotelplan booking, compare the exact reference and details independently. A coincidental match doesn’t authenticate an unexpected refund instruction.<\/p>\n Don’t cancel a genuine trip just because a fraudulent email created uncertainty. Ask the actual agency about your real reservation first.<\/p>\n The message announces that a trip has been confirmed. A button offers access to the booking details.<\/p>\n The original example is brief and uses Hotelplan-style branding. It doesn’t need a long story because an unexpected confirmation already supplies the reason to click.<\/p>\n Don’t reply with your passport, full card number, or genuine travel documents to ask what happened. Verify the sender through the actual agency instead.<\/p>\n Keep the confirmation separate from proof of payment. An email saying something was booked doesn’t establish a debit on your account.<\/p>\n The fraudulent site borrows Hotelplan’s name and logo. It first displays an apparent security check before presenting the alleged reservation.<\/p>\n A check can make a site feel controlled, but it doesn’t identify the operator. The documented page is still part of the impersonation.<\/p>\n The police warning doesn’t establish that this check installs malware. Don’t confuse a visual hurdle with proof of either safety or device infection.<\/p>\n At this point, you can leave without completing anything. Opening the page doesn’t create a genuine travel obligation.<\/p>\n The site shows a hotel reservation as already paid. It then allows the recipient to apparently start a reimbursement request.<\/p>\n This reverses the usual expectation of a payment scam. You think you’re recovering funds, not making a purchase.<\/p>\n Check the real statement before accepting that money left. If no corresponding debit exists, the page’s payment label isn’t evidence that one does.<\/p>\n If a transaction does appear, reach the issuer and agency independently. Don’t let the website that supplied the claim also choose the remedy.<\/p>\n The site requests credit-card details for the supposed refund. Submitting them gives the criminals information they can use for payments.<\/p>\n Expecting money back doesn’t protect the card number you type. On this fake page, that information goes to the people running the scam.<\/p>\n After submission, the site displays a refund-processing message. That is a statement from the fraudulent page, not confirmation from your bank.<\/p>\n If you stop here, contact the card issuer anyway. An unapproved payment isn’t the only concern once the card information has been exposed.<\/p>\n The recipient is asked to confirm a banking-app request or supply an OTP. According to police, that action authorizes a card charge.<\/p>\n Read what the bank itself says: the amount, merchant, and operation being approved. Don’t let the refund page translate a payment into a credit.<\/p>\n If the request doesn’t match an action you intended, decline it. Don’t approve first and ask questions afterward because the page appears to be waiting.<\/p>\n Never share a code with someone claiming they need it to cancel this charge. End the interaction and reach the actual issuer.<\/p>\n Look at your own travel documents and contact the agency through a known route. Hotelplan’s genuine help page<\/a> provides travel and payment support information.<\/p>\n Ask about the exact reservation reference, not merely whether the agency recognizes a hotel name. Real hotel names can be used in invented bookings.<\/p>\n If you booked through an agent, start with that established contact. A support address printed only in the suspicious email isn’t an independent verification route.<\/p>\n Use your authentic card or bank account, not a balance or payment history displayed by the supposed refund page.<\/p>\n Distinguish a completed charge from a pending entry and ask the issuer about anything unclear. Don’t guess based on the website’s \u201cpaid\u201d label.<\/p>\n Write down the genuine transaction reference if there is one. It helps support investigate without requiring another form submission.<\/p>\n A request in your banking app has its own meaning. The important information is the action your bank is asking you to authorize.<\/p>\n A genuine bank screen can be part of a fraudulent sequence if you’ve been misled about why you’re approving it.<\/p>\n Don’t rely on the refund page’s progress bar or success message. Those graphics don’t control whether the actual transaction is a debit or credit.<\/p>\n For example, a page can say a reimbursement is ready while the bank asks you to authorize a purchase. Those are different actions, not two descriptions to reconcile.<\/p>\n Don’t approve the purchase on the assumption that it is a technical step toward the refund. Ask your issuer about the actual request first.<\/p>\n If a code arrived by text, keep its accompanying transaction explanation with your private records. Report what the bank asked you to confirm, not just the digits.<\/p>\n Never publish the code or forward it to a stranger analyzing the scam. The institution can tell you which information it needs through its real support process.<\/p>\n A travel-related scam can feel especially convincing when a genuine trip is already on your mind. That doesn’t establish how the sender obtained your address.<\/p>\n The documented warning doesn’t prove a Hotelplan database breach. Avoid drawing that conclusion from the appearance of a branded confirmation.<\/p>\n Instead, compare the exact booking and payment through your existing agency relationship. Genuine itinerary changes should be handled in that established conversation.<\/p>\n Tell other travelers on the booking that the email may be false. They might otherwise follow the same link while trying to help.<\/p>\n If somebody already canceled or changed a real reservation because of the message, contact the agency promptly to understand the actual position.<\/p>\n Keep legitimate booking documents separate from the scam evidence. This makes it easier to explain which instruction came from which source.<\/p>\n If another traveler received the email too, check whether either person actually followed it. One person’s safe decision doesn’t establish the other person’s card is protected.<\/p>\n Each cardholder should contact their own issuer about an exposed payment method. The travel agency’s booking inquiry won’t automatically block a card at a different bank.<\/p>\n Stop the refund request and reject new approvals.<\/strong> Don’t provide another code to finish, cancel, or correct the fake process.<\/p>\n Close the page. Retain the email and any evidence already available without logging back into the imitation site.<\/p>\n<\/li>\n Call your card issuer immediately.<\/strong> Say you entered details on a false Hotelplan reimbursement page and explain whether you confirmed a banking prompt.<\/p>\n Ask about blocking the card, reviewing attempted transactions, and disputing any completed charge. The issuer needs your actual exposure, not just the word refund.<\/p>\n<\/li>\n Identify each approval or transaction.<\/strong> Note the time, amount, merchant, and reference displayed in genuine banking records.<\/p>\n If the page showed a different amount or explanation, preserve that discrepancy too. It helps explain the deception without changing what the bank actually processed.<\/p>\n<\/li>\n Verify travel separately with the real agency.<\/strong> Confirm whether any genuine reservation or payment needs attention.<\/p>\n Don’t use the scam’s phone number or reply address. A legitimate booking question shouldn’t return you to the same people collecting the card.<\/p>\n<\/li>\n Record other information disclosed.<\/strong> List contact details, documents, and passwords actually supplied. Change any exposed credentials through their genuine services.<\/p>\n The published mechanism concerns payment deception; don’t assume all travel accounts are compromised. Give support the facts needed to check the relevant exposure.<\/p>\n<\/li>\n Deal with risky downloads if they occurred.<\/strong> If a separate step persuaded you to install or open something unexpected, seek trusted technical assistance.<\/p>\n Malwarebytes can help inspect relevant device threats. AdGuard may block known malicious pages, but neither reverses a card payment or guarantees a reimbursement.<\/p>\n<\/li>\nThe final approval sends money instead of receiving it<\/h3>\n
\n
Verify the booking before trying to cancel or refund it<\/h3>\n
Why an Unwanted Booking Can Feel Like Your Problem to Fix<\/h2>\n
How the Hotelplan Refund Scam Works<\/h2>\n
Step 1: A false travel email invites you to inspect a booking<\/h3>\n
Step 2: The link opens a copied page with a security check<\/h3>\n
Step 3: An apparently paid hotel booking makes a refund seem necessary<\/h3>\n
Step 4: The reimbursement form asks for card information<\/h3>\n
Step 5: The banking prompt is explained as receiving the refund<\/h3>\n
Three Checks Before You Touch a Refund Form<\/h2>\n
Confirm whether a booking exists<\/h3>\n
Confirm whether your money actually left<\/h3>\n
Confirm what an approval would do<\/h3>\n
If You Have a Real Holiday Coming Up<\/h2>\n
What to Do if You Have Fallen Victim to This Scam<\/h2>\n
\n