Overview

Amenitiz has created a tool that warns your guests about phishing and fraudulent messages for you. A notice on your dashboard sends a ready-made email to every guest with an upcoming stay, in their own language and under your property name. You read it first, and sending takes about a minute.

We created it because criminals are targeting hotel guests across the travel industry right now, and a warning that comes from the property a guest actually booked is the most effective protection there is.

This article covers how the notice works, why we launched it, and what to do if you would rather write to your guests yourself. If phishing is new to you, the FAQs at the end explain how it works.

How it works

Everything is prepared for you. You check it and send.

Amenitiz wrote the email and translated it, so each guest reads it in their own language.
The recipient list is built for you: every guest with a stay from today onwards who has an email address on their booking, once each.
The email goes out under your property name, and replies arrive in your property inbox.
You can read the exact email before anything is sent, and download the guest list to see who is included.
The notice is available until 30 September. It disappears once you send, and you can dismiss it at any point.

Why we created this

Criminals are contacting hotel guests across the travel industry, pretending to be the property they booked and asking them to confirm their card details. The messages arrive by WhatsApp, SMS or email, and they often contain the guest's real name, your hotel's name and their arrival date, which makes them look genuine.

Guests with upcoming stays are being targeted right now, and hoteliers across the sector have reported it, so this is not limited to Amenitiz customers. Because guests trust the property they booked, a warning from you carries far more weight than a general notice they might come across elsewhere. We wanted that to take one minute rather than an afternoon, which is why the notice writes and addresses the email for you.

⚠️ Important

The guest details being used in these messages did not come from Amenitiz. Our security review found no evidence of unauthorised access to Amenitiz systems. Separately from this, and as a habit rather than a response to it, we always recommend refreshing the passwords you use for Amenitiz, your email and your OTA accounts, and keeping a different password for each one.

Step by step

When the notice appears on your dashboard, you can send the warning email to every guest with an upcoming stay.

Log in to Amenitiz. The notice Scammers are targeting travellers on WhatsApp appears on your dashboard.
Click Download guest list if you want to see which guests are included before you send. This step is optional.
Click Preview and send to read the email exactly as your guests will receive it.
Click Continue.
Check the number of guests and the date range on the confirmation screen, then click Send now.

The emails go out immediately, in each guest's own language.

⚠️ Warning

A send cannot be undone. Once you click Send now, the emails leave straight away and cannot be recalled.

If you would rather not send it, click No, thank you. A reminder bar stays on your dashboard until 30 September so you can come back to it with Show. After that date, and after you send the email once, the notice no longer appears.

What you can and cannot change

This email is a one-off notice prepared by Amenitiz, so parts of it are fixed:

The wording is fixed. The subject and body were written and translated by Amenitiz and cannot be edited.
The recipients are chosen automatically. Every guest with a stay from today onwards receives the email once. You cannot add or remove individual guests.
Guests who book later are not included. The list is built at the moment you send.
Guests without an email address cannot be included. Some OTA bookings do not come with one, so those guests are worth a phone call instead.
It is sent in your name. The sender name is your property. The email address is an Amenitiz address, and replies go to your property inbox.
Each guest receives it once. Sending again is not possible.

The guest list you download is there so you can check who is included — and if you would rather write to your guests yourself, it gives you everything you need to do that.

Prefer to send it yourself

If you would rather warn your guests in your own words, you can. Click Download guest list on the notice to get everyone who has a booking with you from today onwards, then write to them from your own email account or mailing tool. You keep full control of the wording and of exactly who hears from you, which helps if you want to write differently to a group booking, a returning guest or a travel agent.

If you do write your own message, these are the points worth keeping:

You will never ask for card details through a link in a WhatsApp message, an SMS or an email.
A fraudulent message may quote their real name, booking reference or arrival date, so correct details are not proof it came from you.
Pressure to pay within hours is a warning sign.
The phone number and email address they should use to reach you whenever they are unsure.

📌 Note

Send your message to each guest separately, or put the addresses in BCC. Guest emails in the To or CC field are visible to everyone who receives the message. Treat the downloaded file as you would any guest data: keep it somewhere secure and delete it once you have sent your message.

Sending your own guest emails in the future

Once this notice is gone, you can still write to your guests whenever you need to. Amenitiz lets you create your own email templates and choose when they are sent — at booking, before arrival, after departure, or at any moment you pick. You control the subject, the body and which bookings receive it.

See how to create automated emails for your guests to set one up.

💡 Tip

A short security note in your pre-arrival email is worth keeping permanently: tell guests you will never ask for card details by WhatsApp or SMS, and give them the phone number they should call to check.

FAQs

What is phishing?

Phishing is a message that pretends to come from someone you trust so that you hand over money or private information. It usually arrives by email, SMS or a messaging app, and it almost always asks you to click a link.

Three things make it work. It looks real, because the sender name, logo and wording copy a business the reader already deals with. It knows things about you, because criminals who have obtained booking details can quote a real reservation number, arrival date or hotel name. And it creates urgency — "confirm your card within 24 hours or your booking will be cancelled" pushes people to act before they think.

The link then leads to a copied payment page. Anything typed there goes straight to the criminals.

How can my team recognise one of these messages?

A few habits catch almost all of them. Treat any unexpected request for card details or payment as suspicious, even when it quotes a correct booking, because criminals often hold real details. Check the sender's actual email address rather than the display name, hover over a link before clicking to see where it really goes, and confirm by phone using a number from an official source whenever there is any doubt. The clearest rule to share with your team: a genuine payment request from your property never arrives as a link in a WhatsApp message.

Was my Amenitiz account hacked?

No, and you can put your mind at rest on this one. Our security team reviewed our systems and found no evidence of unauthorised access, and the details appearing in these messages did not come from Amenitiz. We are keeping a close watch and will contact you directly if that ever changes.

Should I change my password?

Nothing about this situation forces you to, because there was no evidence of unauthorised access to Amenitiz. That said, we do recommend it as good practice, and now is as good a moment as any. Refresh the passwords for Amenitiz, for the email account linked to it and for your OTA extranets, use a different password for each one, and turn on two-factor authentication wherever it is offered. Anyone at your property who has left should also have their access removed.

Do I have to send the email?

It is entirely your choice, and there is no wrong answer. If this is not a good moment, click No, thank you and the reminder bar will wait for you until 30 September. You can also warn your guests yourself instead, using the downloaded guest list. We do recommend sending it, though: your guests already know and trust your name, so a warning from you carries far more weight than a general notice they might come across elsewhere.

Can I change the wording of the email?

Not for this particular email. We wrote and translated it centrally so it could reach guests quickly and read naturally in each of their languages, which meant fixing the wording. If you would like to say something in your own voice as well, you are very welcome to — create your own template and send it alongside this notice or instead of it. See how to create automated emails for your guests.

Can I send the warning myself instead?

Yes, and it is a good option if you want more control. Click Download guest list to get everyone with a booking from today onwards, then write to them from your own email account. You choose both the wording and the recipients, so you can adapt the message for a group booking or a travel agent. See Prefer to send it yourself above for the points worth including.

Which guests receive it?

Everyone with a stay from today onwards, once each — so your whole upcoming book is covered without you having to build a list. Amenitiz puts the list together for you at the moment you send. If you would like to see exactly who is included first, click Download guest list. Guests who book after you send will not be on it, so a short security line in your pre-arrival email is a good way to keep covering them.

What happens if a guest replies?

It comes straight to you. The email goes out under your property name, and any reply arrives in your property inbox at the address on your account, so you can answer exactly as you normally would. Expect a few thank-yous, and perhaps a guest checking that this message itself is genuine — a good sign the warning has landed.

A guest already gave their card details. What should they do?

There is a real chance of putting this right, and acting quickly makes the difference. Ask them to call their bank or card issuer straight away, block the card and report the payment as fraudulent — banks can often stop or reverse a recent payment. Reporting it to their local police helps too, as banks usually ask for a report number. It is worth reassuring them that they are far from the first, and that these messages are built to fool careful people.

How to send a phishing warning email to your upcoming guests