Reservation security and protection against fraudulent messages
HOW TO SPOT A SCAM AND PROTECT YOUR PERSONAL INFORMATION
A fraudulent message can look convincing. It may even include your name, the hotel name or your stay dates. That does not mean it was sent by your resort.
We have put together practical guidance to help you recognise suspicious requests, verify your booking details safely and know what to do if you have already responded to a scam message. Below, you will also find information about security incidents affecting our guests.
An important rule
Do not click on booking-verification links in unsolicited messages or enter personal information, payment card details, passwords or verification codes.
If you are unsure, contact your resort using details you find yourself on the official website or in your original booking confirmation.
Stay one step ahead
How can you recognise a suspicious booking message?
Scammers may pretend to be a hotel, booking service or customer support team. They might contact you via WhatsApp, text message, email or telephone. Their aim is usually to make you act quickly.
01
Pressure to act quickly
“Confirm your booking within 12 hours or it will be cancelled.” Creating fear and a sense of urgency is a warning sign.
02
An unfamiliar link
The message directs you to a website you do not recognise or to a page asking you to re-enter information or make a payment.
03
A request for sensitive information
A scammer asks for your card number, security code, password, SMS verification code or a photo of your identity document.
04
A false sense of legitimacy
A correct name, stay dates, logo or verified-account badge does not, on its own, prove that a message is genuine.
How can you safely check whether a message really came from your resort?
Do not reply to the suspicious message or use contact details provided only in that message. Visit the official Amenity Hotels & Resorts website yourself, or use the contact details in your original booking confirmation. The reception team can confirm whether any information or payment is actually required. Make payments only through a process whose legitimacy you have independently verified.
Practical guidance
What should you do if you receive a suspicious message?
The right next step depends on whether you only received the message, clicked the link or already entered information.
I received a message but did not click anything
Do not reply or follow the instructions. Save a screenshot, the sender’s name or account details, and any link. Contact your resort through an official channel. You can report and block the fraudulent account in the app.
I clicked the link but did not enter any information
Close the page. Do not download or install anything, and do not allow notifications or remote access. If you downloaded a file, installed an app or notice unusual behaviour on your device, seek professional IT assistance.
I entered a password, personal information or verification code
If you disclosed a password, change it via the service’s official website and review signed-in devices. Enable multi-factor authentication. If you shared identity details or copies of documents, seek advice on preventing identity misuse and inform the resort.
I entered my payment card details or made a payment
Contact your bank immediately, ask them to secure your card or account, and discuss options for stopping or disputing the payment. Keep all relevant messages and report any fraudulent payments to the police. Inform your resort as well.
You can find further official guidance from the Czech Police – cybercrime assistance and the Czech National Bank – payment fraud advice.
Open information about security incidents
Overview of recorded security incidents
Here we publish information about confirmed incidents that may have affected our guests’ data. We update this overview as new findings are verified.
OCTOBER 2026 · CONFIRMED INCIDENT NO. 1
Unauthorised exposure of booking information in the D-EDGE system
On 23 October 2026, D-EDGE, the provider of our booking system, informed us of a security incident that had exposed certain reservation details without authorisation. According to its notice, the affected data included guests’ first and last names, the hotel booked and stay dates. For some bookings, email addresses and telephone numbers may also have been exposed.
D-EDGE has confirmed that payment card information was not part of this data exposure.
What risks did the incident create?
The information obtained can be used to make scam messages appear to come from a hotel. For example, we have recorded WhatsApp messages from accounts using the names StayVista and Swiggy, asking guests to verify their reservations on an unfamiliar website. The names of such accounts may change.
In connection with this single confirmed data breach, by 26 October 2026 we had recorded six reported cases of suspicious contact with guests across three resorts: Špindlerův Mlýn, Orlické hory and Horní Věstonice. These do not represent six separate data breaches.
What action have we taken?
We sent a preventive security email to guests with upcoming stays, added a security notice to the booking system and began investigating the matter with the provider. D-EDGE has told us that it has fixed the identified vulnerability. However, scammers may still use information obtained before the issue was resolved.
For guests: If you receive an unsolicited request to verify a booking or payment, do not follow its link. Check the request directly with your resort. If you entered card details on a fraudulent website, contact your bank immediately.
Last updated: 26 October 2026. This overview is based on the D-EDGE notice and documented reports from guests.
Information and answers
Frequently asked questions about booking security
If a message has my correct name and stay dates, can I trust it?
Not necessarily. Scammers may know genuine booking details. Always verify unusual requests independently with the resort.
Can a fraudulent message cancel my booking?
A fraudulent message cannot cancel your booking by itself. If it threatens cancellation, check the actual status of your booking directly with the resort.
Can a fraudulent message come from a verified account?
Yes. A verified badge or familiar account name does not guarantee that the message concerns your booking or that its instructions are safe.
Do I need to enter my payment card details again?
Never enter card details in response to an unsolicited message linking to a suspicious website. Verify any genuine payment request with your resort using contact details obtained independently.
Were payment card details exposed in the October 2026 incident?
According to the security notice from D-EDGE, no. However, if a guest enters card details on a fraudulent website, they may disclose that information directly to scammers.
Who can I contact if I receive a suspicious message?
Contact your resort using the details on the official Amenity website or in your original booking confirmation. If your payment details have been misused, contact your bank immediately rather than waiting for a reply from the hotel.
Not sure whether a message you received is genuine?
Do not make any payments or share information until you have verified the request.
Your resort’s reception team can check your booking status and advise how to send us the suspicious message safely. Find the contact details yourself on the official Amenity website.