When a fake website copies your hotel: detect, report and warn guests

A fake hotel website copies your hotel's name, photos and logo, usually has no booking engine, takes a deposit by phone or transfer and disappears. Find it with a monthly search and image check, save dated evidence, then report it to the Cyber Security Presidency, the domain registrar and host, search and social platforms, and a lawyer.

The first person to notice is rarely the hotel. It is a family at the desk, holding a printed voucher for a room you never sold, asking why the transfer they sent is not in your system. By then the money is gone and your hotel's name is attached to the loss. This guide gives you the hotel's side of the problem: how to spot a copy early, what evidence to save, where to report it in Türkiye, what to say to the guest, and how to make your own channels harder to imitate.

How does a fake hotel website work?#

It copies what a guest can see and skips what a guest can check: the name, the photos, the logo and the star rating, but not a booking engine or a contract with the hotel. The material is taken from your own site, your listings on booking platforms and your social profiles: room photos, room descriptions, the logo, the address, sometimes the names of your restaurant and spa. Nothing is original except the payment route.

There are two common shapes. One is a near-exact copy on a similar address, with a letter doubled, a hyphen added or a different ending. The other is a lookalike that carries your hotel's name in the page title and in paid search ads but is a different business underneath.

The payment path is the clearest tell. The page has no booking engine, offers a phone number or a messaging handle as the only way to book, and asks for a deposit by transfer or for card details sent in a message. The Ministry of Trade described exactly this pattern in a warning published on 10 August 2020 (opens in a new tab): ill-intentioned people copy the photos and names of popular hotels and tourism facilities, especially in the summer season, and send attractive offers by e-mail and text message. The Ministry noted that such sites often have no booking engine and send consumers straight to a phone number.

The hotel usually hears late. The victim complains to the number on the fake page, then to the platform, then to the bank; you learn from a guest at the desk or from a friend who searched your name. And the loss is not only the guest's money. Your hotel's name is attached to it, and the guest's first memory of your property becomes the argument at the desk.

How do you find a copy of your hotel before a guest does?#

Search your hotel's exact name the way a stranger would, once a month, and look at what comes back rather than at what you expect. The check takes twenty minutes and it only works if you search as a guest, not as the owner who already knows the right answer.

Start with the exact hotel name, then the name with the words a scammer would use: rezervasyon, booking, iletişim, telefon, indirim, and your destination. Search the name with each room type and with the words "otel" and "hotel" added, because a copy often pads the name to look official. Then run a reverse image search on two or three of your best photographs: a copied photo usually leads back to the copy as well as to you.

Look at the paid results above the organic ones for your own name. A hotel should not be paying for its own brand through someone else's ad. Check lookalike addresses by hand: the name with a different ending, with a hyphen, with a doubled letter, with "rezervasyon" or "booking" appended. Check the social platforms for accounts using your name and logo, especially accounts with few posts whose only contact route is a phone number.

Finally, ask reservations and the front desk to log every guest who says they booked through the website and cannot be found in the system. That log is your earliest warning. Give the whole routine a named owner and a recurring date in the calendar, because a check without an owner does not happen in August.

What evidence should you save first?#

Save the page exactly as it looks now, with the date visible, because a fake site can change or disappear within hours of the first report. Everything you send later, to the registrar, the host, the platforms and the authorities, is judged on what you captured before anything moved.

Take a full-page screenshot that includes the browser address bar and the system clock, and print the page to a dated file. Two formats cost nothing and settle arguments later. Record the exact web address, the domain's creation date and its registrar from a public lookup; a domain registered a few weeks ago is itself part of the evidence.

Write down every payment route the page offers: phone numbers, e-mail addresses, account names and IBANs. This is what the authorities and the banks need. Copy the wording of the offer and the price, because the Ministry's warning turns on "attractive offers", so the exact text matters more than your summary of it. If the visitor arrived from an ad or a social post, capture that too, with the date and the platform visible.

Keep one running log: date, time, who found it, what was found, what was done, which reference number came back. Store it somewhere the hotel controls, not in a personal inbox. And do not contact the fake site from a hotel e-mail address or phone to test it. That tells the operator who is watching and which channel reaches you.

Where do you report a fake hotel booking site?#

In Türkiye the official route is the Cyber Security Presidency's incident report form, and it works best in parallel with the registrar, the host, the platforms and a lawyer. No single channel is enough; each one removes a different piece of the copy.

The reporting landscape changed recently. usom.gov.tr now carries a notice that the Cyber Security Presidency was established under Presidential Decree No. 177, and that it works within the framework of cybersecurity legislation including Law No. 7545 of 12 March 2025. The same notice says that cyber reports, malicious link lists and security notices previously offered there continue at siberguvenlik.gov.tr (opens in a new tab). The Presidency's incident report page lists phishing among the things that can be reported, described as fake bank, institution or company websites that try to deceive you. The form asks for name and surname, phone number, e-mail address, a message title, the message, a verification code and confirmation that the KVKK privacy notice has been read. Reports go through that form on the Presidency's site.

The Presidency warns users not to trust e-mails that pretend to come from it. Treat any message asking you to confirm a report through a link with suspicion and go to the site directly.

The domain registrar and the hosting provider can suspend a site on their own terms when they receive a clear abuse report with evidence; send the same package to both. Search engines and social platforms have impersonation and trademark routes for removing ads, results and accounts. These move at their own speed and usually ask for proof of your rights in the name.

The judicial route matters most. The Ministry of Trade's warning of 10 August 2020 states that setting up a fake site by copying a tourism facility's logo and name, or by making hard-to-spot changes to its name or web address, is also the crime of fraud, and that reporting such sites to the judicial authorities is important to prevent harm. A lawyer handles this step and tells you what your own case needs.

A guest is at the desk with a fake voucher. What do you say?#

Say plainly that the booking is not in your system and that the hotel did not receive the money, then say what you can do today and write the whole thing down. The ten minutes that follow decide whether the guest leaves angry at the scammer or angry at you.

Check first, before you say anything. Search the system by name, dates and any reference on the paper. Some vouchers are genuine agency bookings with a wrong date or a misspelled name, and a false accusation is worse than a short wait. Read the voucher as a document: who issued it, which logo and address it carries, which phone number, which payment method, which reference format. If you handle agency vouchers often, reading what the agency sent becomes a routine skill, and a voucher that does not match the format your real partners use is a signal.

Do not accuse the guest. They are the second victim in the room, and the way the desk handles the next ten minutes becomes the hotel's reputation. Offer a clear choice rather than a debate: a room at the published rate if one is free, or help contacting the issuer and the bank. Whether to discount is a commercial decision for the hotel, not a legal one.

Record a short incident note: a copy of the voucher, the guest's statement, the amount paid, the channel used, the phone number on the paper and what the hotel offered. This is the file a lawyer, the police or the bank will ask for. Tell the guest where they can report it themselves: the Presidency's incident form, their bank, and the card issuer if they paid by card. Their report carries weight because they are the injured party.

Do not announce a legal duty to rehouse or refund at the desk. The hotel's position on a booking it never received should be confirmed with a lawyer before it becomes a habit. And brief the front desk in advance with a one-page script, so the answer does not depend on who is on shift that night.

What should your own site and confirmations say?#

Put one short, findable warning on your site and in every confirmation, and give guests a way to check a booking before they pay anyone. The goal is not to frighten anyone; it is to make the real thing easy to verify, so that a copy stands out.

Write the warning as a fact, not as a scare: the hotel takes bookings through this website, this phone number and these named agencies, and never asks for a transfer to a personal account. Repeat the same line in the confirmation e-mail, with the official domain and the official phone number, because the confirmation is the document the guest will compare against a fake one. Give guests a check path: a booking reference and a number they can call, and a short page that says where the real booking engine is. If you are rebuilding the site anyway, a hotel website checklist for content, legal information and the booking path is the right place to slot this in.

You can also borrow the Ministry's consumer checklist as guest-facing text. Its warning of 10 August 2020 advises consumers to question whether facility photos, logos and marks are genuine, to verify the phone number and contact details, to check whether the facility is certified by the Ministry of Culture and Tourism and how many stars it has, to check travel agencies through TÜRSAB, and in distance sales to check that the site shows an address, trade name and contact details and is registered in ETBİS.

Keep the warning short and current; a page that looks abandoned is its own signal to a nervous guest. And make sure the wording does not read as an admission that the hotel has been copied. It is a service to the guest, not a confession.

How do you protect your name before it happens?#

Own the obvious addresses, register the mark, and keep the profiles guests actually check under the hotel's control. Prevention here is cheap compared with a season of desk arguments.

Register the address variants you can afford and the main social handles for your name. A hotel that owns the endings and handles a copy would use removes the cheapest version of the attack. A registered trademark gives you a documented right, which makes impersonation reports to platforms and search engines easier to argue; confirm the classes and the scope with a trademark attorney.

Verify the profiles guests check before they pay: the map listing and the business profile with the correct booking link, so a search for the hotel name lands on something the hotel controls. The details are worth a separate pass, as in this guide to Google Business Profile for hotels: facts, photos and the booking link. Keep the domain, the certificate and the logins documented and held in the hotel's name, not in the account of a former employee or an agency that has moved on; hotel website security and ownership covers the practical side.

Watch the agency side as well, since a fake site often presents itself as a travel agency. Guests can check an agency through TÜRSAB, and your own site can say which agencies are authorized to sell you. Run the whole review once a season, before the high season, not after the first complaint at the desk.

What to do next#

The pieces fit in one order: know the pattern, look for it on a schedule, capture evidence before anything changes, report in parallel to the Presidency, the registrar, the host and the platforms, and have a front-desk script ready for the guest who arrives with a fake voucher. The single next step is to put a named owner and a monthly date in the calendar this week, and to write that one-page desk script before the season starts.