Qantas investigates WhatsApp phishing aimed at Qantas Hotels customers that quotes real hotel names, bookings and dates (including Capella Sydney guests) and asks for card details; source of the booking data not yet explained
Qantas said in mid-September 2026 that it was investigating reports of phishing attempts targeting some Qantas Hotels customers, after guests received WhatsApp messages that appeared to come from their hotel, referred to an upcoming reservation and asked them to verify the booking and provide payment or credit card details. The Australian Financial Review reported on 17 September that Qantas was investigating a suspected breach of systems. Capella Sydney said some of its guests had received suspicious WhatsApp messages requesting payment and card details for their reservations and confirmed the messages did not come from the hotel. Qantas's scams page lists the September 2026 campaign, saying the messages often use urgency such as a countdown or a cancellation threat, and that neither Qantas nor its accommodation partners will ask customers to verify a booking or give personal details over WhatsApp. As of late September Qantas and Capella had given no further update; no threat actor has been named, and neither has said how the senders knew who had a booking or whether the data came from Qantas, a booking platform or a hotel. The campaign follows the 2025 breach of more than five million Qantas customers' records. Primary: Qantas cyber safety and scams page; wire: Australian Aviation (21 Sep 2026).
- Exploited in Australia?
- unknown
- Patch to
- Qantas Hotels customers: ignore WhatsApp or SMS messages asking you to verify a booking or pay; check bookings only by logging in to Qantas.com or the Qantas app. If you shared card details, call your bank on the number on your card, then contact Qantas Frequent Flyer on 13 11 31 and report it to Scamwatch.
Primary: Qantas — Cyber safety and latest scams: September 2026 WhatsApp scam messages impersonating Qantas Hotels & Holidays accommodation providers · Australian Aviation — Qantas investigates WhatsApp phishing reports targeting customers (21 Sep 2026)