S'pore cafe owner, 31, receives WhatsApp verification message from 'hotel staff' about overseas booking, gets scammed of nearly S$2,000 - Mothership

The scammers used details from a hotel booking he had made.

A cafe owner in Singapore was scammed of his earnings in a mere half an hour after he received what looked like a card verification message on WhatsApp.

Speaking to Mothership, Shaqil shared that he received a WhatsApp message on Sep. 10 regarding a hotel booking for his upcoming work-related trip to Germany, and the message included details of the booking he had made.

Following the incident, Muhammad Shaqil, 31, made an Instagram post on Sep. 10 to explain how he was scammed and to warn others about such incidents.

In screenshots Shaqil shared with Mothership, the sender, named "Assine SKY", apparently posed as hotel staff and told him that he needed to verify his card details to confirm the booking.

The message included accurate information about his hotel booking, such as the name of the hotel and the date of his stay.

Attached was a "verification" link, and a line urging Shaqil to complete the verification within 12 hours "to ensure [his] reservation remains active".

As the message lined up with an actual hotel booking he had made, Shaqil believed that it was legitimate.

He clicked on the link and entered his card details.

Shaqil told Mothership that he had made the hotel booking on Booking.com, one of the largest online travel agencies in the world.

Shortly after entering his card details, he received push notifications from his bank for transactions pending approval.

He authorised the transactions as they looked like notifications that were typical of any card check.

"The first and second push notifications I received were both US$162 (S$205), which matched the hotel booking amount, so I didn’t think anything was wrong," Shaqil said.

However, the transactions were not temporary holding amounts, like the sender had claimed, but actual transfers.

Subsequently, the third, fourth, and fifth transactions became progressively larger sums.

By the time that Shaqil realised that something was wrong, the transactions had already been approved and processed.

"Everything was happening so quickly that I didn’t realise what was happening until it was already too late."

Within 30 minutes, the transactions were charged and the money was transferred out of his account.

The scammer sent more transaction requests, which Shaqil successfully denied.

In total, the scammer stole nearly S$2,000 from his account.

Shaqil subsequently contacted his bank and made a police report.

Despite this, he received yet another message later that night from a second WhatsApp user named "Yas Tanzania".

This person sent the exact same message that "Assine SKY" sent him.

According to Shaqil, his bank is looking into the transactions and he is uncertain as to whether he is able to get the money back.

He has also reached out to the actual hotel via Booking.com, which has yet to reply.

Shaqil is the owner of Qyl's Coffee, a cafe at Everton Park.

He is bound for Germany for a work-related coffee event in Frankfurt, where he was engaged to serve his coffee.

Shaqil shared with Mothership that while the amount he lost "might seem small to some people", it was still "hard-earned money" and significant for him.

The money he lost was part of the earnings he had accumulated from the cafe. He had intended to move his cafe out of his current location and the money was to go towards securing a new unit.

However, because of the incident, he stated that he would have to "put those plans on hold".

"Honestly, I’ve been quite stressed since it happened. The amount is significant for me, especially with everything else I’m currently dealing with in my business."

He also questioned how the scammers were able to retrieve his personal details and data, such as the name of the hotel as well as the exact duration of the stay.

Nevertheless, he told Mothership that it was important for him to share what had happened in order to spread awareness.

In an online advisory, Booking.com informs users about the main signs of phishing scams.

Users will never be asked to share credit card details by email, over the phone, through text or WhatsApp.

Additionally, the platform will not ask users to make bank transfers that are "different from the payment policy details in [their] booking confirmation."

In the event that a user has clicked on a link or shared information with a scammer, they are advised to contact Booking.com's customer service team immediately.

Mothership has reached out to Booking.com for comment.