Visitor's Tax and Service Charge: Alleged Double Booking Leads to Phishing Trap

Summary

Why is this warning issued?

This warning was included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.

How the scam works

• The phishing email lands in the inbox – the subject line references an alleged double charge of visitor's tax and service fee for an actual booking.
• The message contains real booking details such as the hotel name and length of stay, which makes it appear legitimate at first glance.
• Clicking the button or scanning the QR code in the attachment directs the victim to a fake portal that accurately reflects the hotel stay.
• On a fake page, the victim is asked to select their own bank from a long list of Austrian banks.
• Through a fake online banking login, the victim's username and password are captured.
• The victim is prompted to enter a code to release the alleged refund.
• In reality, this code authorizes a transfer/debit that goes directly to the criminals.

How to recognise it

• Unexpected email about an allegedly double-charged visitor's tax/local tax and service fee, despite there being no reason for it
• The subject line contains a specific booking number (e.g., "5575485669 – with our apologies"), but the email is unsolicited
• Email contains a button ("Confirm refund") and/or a PDF attachment titled "Refund confirmation" with a QR code
• Sender name appears to be the hotel, but the actual sender address does not match the business
• Link leads to a page where the legal notice, terms and conditions, and other links are missing or do not work
• Request to log into online banking via the email/link, even though the domain does not belong to the real bank (e.g., subdomain of yukangcc.com)
• Entry of a code that supposedly releases a refund – in fact, it authorizes a debit
• Impersonal greeting and time pressure

How to protect yourself

• Call the real hotel at the phone number you know and ask directly whether the refund is genuine.
• Do not click the button in the email and do not scan the QR code in the attachment.
• Never log into online banking via a link from an email – only enter login details directly via the bank address you know or the app.
• If you have already entered data: change your online banking password immediately, inform your bank, and monitor your account closely.
• File a police report, for example via the online report system of your federal state or in person at a police station.
• Stay alert: since the criminals may have your contact and bank details, a further contact attempt using a different approach is possible.

What you should never do

• Do not enter any login details, usernames, or passwords on the linked page.
• Do not enter any TAN, SMS, or authorization code for the alleged refund.
• Do not reply to the email, click the button, open the attachment, or scan the QR code.
• Do not, out of uncertainty, simply transfer an amount back "just to be safe" or accept a demand.
• Do not let the matter rest if you have already entered data – the bank and police must be informed.

Frequently asked questions

Affected data

Comments

Related warnings

• Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing
• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing
• #10TageGegenPhishing: Niemals klicken! Immer selbst einloggen!
• #10TageGegenPhishing: KI-gestützte Betrugsversuche erkennen
• #10TageGegenPhishing: Quishing – Wenn QR-Codes zur Betrugsfalle werden
• #10TageGegenPhishing: Wie geht man mit verdächtigen E-Mail-Anhängen um?

Original source

Update history

• 02/10/2026Description updated
• 29/09/2026Warning added from an official source