ABC

Guests at tourist parks across Australia have encountered a new scam. Fraudsters are sending fake payment requests using genuine details of upcoming stays. Guests of major operators BIG4, Reflections Holidays and G'day Parks have been targeted with links asking them to enter bank card details, ABC News reports.

Fake Messages Sent in Hotels' Names

Scammers send emails, text messages and WhatsApp messages that appear to come from businesses familiar to travelers. Some claim that a payment has failed, while others ask guests to verify their bank cards. The links lead to third-party websites designed to collect payment details. Some messages threaten to cancel the reservation unless the guest complies.

Hotel guests in Tasmania have received similar messages, ABC News reports. One guest at Wrest Point Casino in Hobart received a message containing the correct booking number, room type and travel dates. The sender claimed that the bank had blocked the card and asked for updated details. Neither the hotel nor its booking service provider had sent the message.

Sherri Midson, who manages a tourist park in Victoria, said concerned guests began calling as soon as the messages appeared. The names and stay dates matched genuine reservations. To travelers, the requests looked like routine messages from the property. Park owners fear that scams carried out by outsiders could damage their businesses' reputations.

How Scammers Obtained Booking Details

On October 26, Australian company RMS Cloud discovered that its booking system, used by hotels and tourist parks around the world, had been breached. Attackers gained access to guests' names, contact details and travel information. These details can be used to send convincing payment requests in the names of accommodation providers.

RMS Cloud software is used by more than 6,000 hotels, tourist parks and apartment properties worldwide. That figure does not indicate the scale of the breach: the number of affected properties and guests is still unknown. The company says that bank card information and payment records were not exposed. Instead, scammers are trying to obtain card details by sending fraudulent requests after gaining access to booking information.

Accommodation operators have warned guests not to follow links in suspicious messages. Anyone with a question about a payment should contact the property directly through its official website or the phone number on the original booking confirmation. Guests who have already shared card details are advised to contact their bank immediately. RMS Cloud is investigating the incident with cybersecurity specialists, while its clients continue to notify travelers.

Australian Tourism: Statistics and Demand

In August 2026, short-term visits to Australia by international travelers reached 755,530. This was 0.3% higher than in the same month of 2025, but 4.3% below August 2019, according to the Australian Bureau of Statistics (ABS). The figures count border crossings rather than individual travelers.

New South Wales led by reported state of stay, with 289,970 visits. Victoria recorded 177,380, followed by Queensland with 174,860. The leading departure countries were New Zealand, China and Japan, accounting for 110,210, 106,990 and 62,600 trips, respectively.

Tourism businesses in Queensland are reporting weaker demand, ABC News reports. In the financial year ending in June 2026, the Bundaberg region received 750,000 overnight visitors, who spent A$430 million. At the local Splitters Farm attraction, however, visitor numbers fell by 30%.

Whalesong Cruises in Hervey Bay reported a similar trend, with bookings for its marine tours down 30% from the previous season. Businesses attribute the decline to high fuel prices and other rising costs. Travelers are planning their budgets more carefully and increasingly leaving booking decisions until the last minute. Both percentages refer to individual operators, not Australia's tourism industry as a whole.

Digital Risks in the Hotel Industry

International Investment analysts note that the RMS Cloud case has exposed a vulnerability in the digital sale of tourist accommodation. Even without a leak of bank card details, booking information can be used to deceive guests. This puts confidence in the payment process at risk, even when the hotel itself has not suffered a security breach.

The issue also has implications across the industry. Independent hotels and tourist parks may rely on the same technology platform, allowing an incident at a single supplier to affect several brands. The commercial consequences can vary considerably between properties, depending on their reliance on online sales, their customer base and their ability to contact guests quickly.

It is not yet known how many travelers suffered financial losses or whether fraudulent messages led to cancelled bookings. There is also no basis for linking this incident to changes in tourist arrivals. Nevertheless, it illustrates how occupancy and revenue figures alone cannot capture a hotel's reliance on external digital infrastructure when assessing the value of an accommodation asset.

Frequently Asked Questions

What happened to tourist accommodation bookings in Australia?

Guests at hotels and tourist parks began receiving fake payment requests. The messages included real travel dates and other reservation details.

Which operators were affected by the fraudulent messages?

Guests of BIG4, Reflections Holidays and G'day Parks reported suspicious requests. This does not mean that each operator's own systems were breached.

How did the scammers obtain guest information?

On October 26, RMS Cloud discovered unauthorized access to its booking system. Names, contact details and travel information became available to the attackers.

Were bank card details exposed?

RMS Cloud says payment card information was not leaked. Scammers are attempting to obtain it through links in fake messages.

How can guests verify a suspicious payment request?

They should contact the hotel or tourist park using official contact details. Anyone who has already shared their card information with scammers should contact their bank immediately.