A message with your real booking number
If you book a Yugawara ryokan online, there's a message worth knowing about before it arrives. It shows your real booking number and your real dates. It says your card couldn't be verified and the reservation will be cancelled unless you enter it again through a link. It looks as if it comes from the inn. It doesn't.
Since around Golden Week this year, guests who booked hotels in Japan through Booking.com have been getting exactly that message, often through WhatsApp or another messaging app. The Japan Hotel Association issued its fourth warning on 12 June 2026. It said the hotels involved had found no sign of a breach in their own systems, and that nobody yet knew how the booking details got out. Hotels as large as the Imperial Hotel in Tokyo have posted warnings that cover bookings made through both Booking.com and Agoda.
Two separate things are going on, and it helps to keep them apart. In April, Booking.com told some guests that outsiders had reached their booking information: names, email addresses, postal addresses, phone numbers, and anything they had shared with the property. The company said no financial information was accessed. Separately, criminals have spent years tricking hotel staff into handing over their Booking.com logins, then messaging guests from inside the real system. Nobody has shown that the April incident explains this year's wave in Japan. For you as a guest, the cause changes nothing about what to do.
If the message reaches you
The rule is short. Booking.com says no genuine payment or booking change will ever ask you for card details by phone, text message, or email. An inn that already holds your booking has no reason to send you a link to type your card in again. If a message tells you to re-enter a card to keep a room, it's a scam, however real the booking number looks.
Don't tap the link. Open the app or site you booked on and look at the reservation there. If you still want to be sure, call the inn on the number from its own website. Our stay pages link to each inn's own site where it has one.
If you've already entered card details, call your card company on the number printed on the back of the card and ask them to stop it. Then look at the real reservation in the booking app. Anywhere in Japan, the consumer hotline, 188, puts you through to a local consumer centre for advice.
If you run an inn in Yugawara
A lot of Yugawara's places to stay are small: family-run ryokan, guesthouses, a few rooms above a restaurant. Many sell rooms through Booking.com, Rakuten Travel, Jalan, and their own websites at once. At a small inn those accounts tend to live on one computer behind the front desk, and it's easy for the whole team to end up sharing one login. That login is what the attackers want.
Microsoft has documented how one long-running campaign starts. Staff get an email that seems to come from Booking.com or a guest: a bad review to answer, a question about a stay, an account to verify. The link opens a fake “I'm not a robot” check that tells the reader to paste a command into the computer. That installs malware that steals passwords. Once the attacker has the extranet login, every guest can be messaged from inside the real system, under the inn's name.
Booking.com's advice to properties is a short list. Turn on two-factor authentication. Give each person their own login instead of sharing one. Don't reuse passwords, and put two-factor on the inn's email too. Watch for the warning signs it lists: guests receiving payment requests you didn't send, rates or contact details you didn't change, sign-in emails from places you don't recognise, or an unfamiliar phone number added for two-factor. Its partner staff will only ever ask for your property ID, never your password.
Then tell your guests before the scammers reach them. One line in the booking confirmation and on the website is enough: we will never ask you to re-enter card details or pay through a link sent by message. A guest who has read that line knows what to do when the fake one arrives.
Handed to a service, still under your name
This is where my work outside Yugawara Club comes in. I run MKUltraman, an IT consultancy in Tokyo, and I see the same pattern in every kind of business. Bookings, email, and the website get handed to outside services, and everyone assumes the service carries the risk. It doesn't. When something goes wrong, guests still see your name. I wrote about that in a longer piece, “You outsourced the work, not the responsibility”, linked below.
If you'd like a second pair of eyes, my outside-only exposure check reads what anyone on the internet can already see about up to three of your domains: email authentication, DNS, the website platform, public login pages, and certificates. It costs ¥100,000 plus tax and involves no testing of your systems. It can't see inside your Booking.com account. It does show whether your domain's settings let someone send email that looks as if it came from your inn, which is the next message your guests might receive.
None of this needs an IT department. Two-factor on the booking sites, one login per person, and one honest line to guests close the easiest routes. Guests who know the rule can enjoy the trip down without a cancellation threat hanging over it.