Guests who booked directly with Hyatt are getting WhatsApp messages that know too much: their real names, their actual stay dates, even check-in and check-out details. The message warns that their room will be given away unless they “confirm” within 24 hours — and it insists no payment will be taken. That last part is the tell.
The reports, shared on Reddit and FlyerTalk, mostly involve the Rio Las Vegas. One guest said they’d booked with a free night award through the Hyatt app, so this wasn’t a third-party leak on their end. The messages arrive under the sender name Pinnacle Teleservices — which happens to be a real WhatsApp business messaging provider that hotels legitimately use, adding a layer of credibility. The link in the message goes to a lookalike domain, and the property is vaguely listed as just “Hotel.” One recipient noticed the booking reference didn’t even match their real confirmation number.
Here’s the trap: while the message says you won’t be charged, it mentions you may need to approve a push notification or text on your phone. That’s the scam. You’re not verifying a hotel reservation — you’re authorising a real financial transaction while believing you’re just keeping your room. Singapore police described exactly this pattern on October 9: WhatsApp messages with genuine booking details directing travellers to “verify” their cards, with assurances that no money will be deducted.
So where did the data come from? Booking direct with a hotel chain doesn’t mean your details stay sealed in that chain’s system. The property itself needs your booking, and its staff accounts, reservation software and third-party vendors may all touch it. A stolen employee login, a compromised front-desk computer or an exposed guest list would be enough. There’s precedent: fake guest complaint emails have tricked hotel staff into installing malware, and similar scam reports have surfaced around Booking.com and Agoda bookings, plus a Paris hotel that reportedly notified guests of a compromise.
For travellers, the rule is simple: never confirm a reservation through a link that arrives out of the blue, even when the details are accurate. If a message claims your room is at risk, check using the number in your original confirmation email or the hotel chain’s own app. And never approve a bank notification because a stranger says it’s “just a verification.” The fact that scammers hold your real name and dates is unsettling, but it doesn’t make the message legitimate — it means someone upstream leaked the guest list.
This matters to anyone with an upcoming hotel stay, especially booked via points or direct channels where you’d assume you’re safe. Assume any unsolicited “confirm or lose your room” message is a scam until the hotel confirms otherwise through an official channel. Source: View from the Wing.
