Tourist scams: the most common ones and how to stay safe abroad

Fake Booking.com messages with real data, the tea house scam, wallet drops and card machines: what is fake, what is true and how to stay safe abroad.

2026-10-31

Travel puts people out of routine, in a hurry, card in hand and juggling bookings by message. In 2026, official tourist scam warnings came from Switzerland, Hong Kong, the US and Rio de Janeiro. Here is what is fake and what is fact.

“A hotel message with my real details must be genuine.” Fake or fact?

Fake. On June 2, 2026, Switzerland's NCSC warned of WhatsApp phishing citing real bookings, which it linked to an April 2026 Booking.com data leak; one variant offered a fake refund, another used hijacked hotel accounts to threaten cancellation unless a card was “verified”. Hong Kong's HKCERT issued a similar alert on June 15, also spotting fake Booking.com and Klook pages. Always log in via the official app or a typed address, or call the hotel on a number you found yourself.

“Tourist scams are just pickpockets.” Fake or fact?

Fake. The US State Department lists talk-based scams: the tea house or bar scam with a huge bill, the wallet drop, the art or rug shop, the airport bag-watching trick with a fake police officer, and rigged shell games. Decline invitations to venues a stranger picks, watch your drink and never carry or watch others' bags.

“Card machine scams don't hit foreigners in Brazil.” Fake or fact?

Fake. A foreign tourist was charged R$8,500 for a R$40 caipirinha on Copacabana on July 27, 2026 (Correio). Check the amount on screen before entering your PIN or tapping. See our card machine scam guide.

“ATMs in tourist areas need extra care.” Fake or fact?

Fact. The US Secret Service flags tourist areas as frequent skimming targets. Read how to spot skimmers.

What to do if you were scammed abroad

Block cards and dispute charges through your bank's official channel.
Change passwords for the booking account and any reused ones.
Report to local police (in Rio, the DEAT tourist police) and keep screenshots.
Contact your country's embassy or consulate if you need help.

“A real refund may ask me to scan a QR code or log in.” Fake or fact?

Fake. Switzerland's NCSC states that legitimate refunds never require login details or QR code scans. In the Swiss campaign, the refund link led to a fake payment page and then to a fake bank page asking for card details. HKCERT adds that victims who already entered data should stop all contact, change the affected password and any reused ones, call their bank or card issuer immediately, and keep emails, screenshots, links and transaction records as evidence.

Quick checklist before and during a trip

Turn on purchase alerts and carry a low-limit card for daily spending.
Confirm bookings only in the official app or website; distrust payment requests outside the platform.
Enable two-factor authentication on email and travel apps.
Keep your bank's and carrier's numbers somewhere other than your phone.
Never carry items for strangers, even as a favor.