Booking safely with BIG4

Phishing emails, WhatsApp messages and fake booking requests: what to look for and what to do

Scammers are increasingly targeting holiday park guests across Australia, including BIG4 guests, with fake messages that look like they come from a park you may be familiar with. They use phishing emails, WhatsApp and SMS messages, fake listings and fake social media pages to try to get your card details and/or a payment.

This page explains how to spot a booking scam, how to check a message is really from your park, and what to do if you've already clicked a link or paid.

RMS security incident

RMS, a booking system used by a third of BIG4 holiday parks, has recently experienced a security incident involving unauthorised access to guest contact and booking information. The incident is not specific to BIG4 and has also affected holiday park and hotel accommodation providers outside the BIG4 network. Some guests have received fraudulent emails, text messages and WhatsApp messages containing genuine booking details and requesting payment or card information.

Credit card and payment details were not accessed through this incident. However, genuine booking information can make a fraudulent message appear convincing. If you receive an unexpected message about your BIG4 booking, don’t click links, provide card details or make a payment. Instead, contact your park directly using the details on BIG4.com.au or in your original booking confirmation.

Got an unexpected message about your BIG4 booking?

• Don't click links, reply, or send payment or card details.
• Do check with your park directly, using the phone number on the park's page at big4.com.au or in your original booking confirmation.
• If you've shared card or bank details, or made a payment, call your bank or card provider now using the number on the back of your card.

Why scammers target holiday park bookings

Travel is one of the most targeted industries for scams. Bookings involve upcoming payments, real dates and a guest who wants to avoid losing their holiday, which makes urgent payment requests more convincing.

Scammers can get booking details in several ways, including data breaches at travel providers or their technology suppliers, compromised email accounts, and fake websites. This affects accommodation providers of every size across Australia and overseas.

The most important thing to know: a message can contain your real name, park, dates and booking reference and still be a scam. Having your details doesn't necessarily make the sender genuine.

How to spot a scam or phishing message

The details in a scam message may be real. That doesn't make the message genuine. Be cautious if a message:

• Arrives on WhatsApp, Facebook Messenger, Instagram or another chat app. Especially when you weren’t expecting them to use these platforms. Scammers often use a park's name and logo as their profile picture.
• Creates urgency. For example, ‘pay within 24 hours or your booking will be cancelled’.
• Says a payment has failed and asks you to pay again or re-enter card details.
• Contains a link to a payment page, login page or ‘booking confirmation’ you weren't expecting.
• Asks you to pay a different way from what your booking confirmation says, such as a bank transfer to a new account, gift cards or cryptocurrency.
• Comes from an unfamiliar email address or phone number, even if the display name looks right. Check the sender's full address, not just the name.
• Offers a refund or upgrade in exchange for your card details.

Scams can also arrive as a phone call. If someone calls about your booking and asks for payment, hang up and call your park back on its published number.

Examples of booking scam messages

Fake listings, giveaways and social media pages

• Fake BIG4 pages and giveaways. Be wary of social media pages offering free stays or huge discounts in exchange for your details or a small ‘processing fee’.
• Cabins advertised on Marketplace or classifieds. Someone ‘selling’ a BIG4 booking or cabin stay they can't use is a common scam. Only book through BIG4.com.au.
• Lookalike websites. Check the address bar shows BIG4.com.au before entering any details. Be careful with sponsored search results that look like BIG4 but lead elsewhere.

How to check a message is really from a holiday park

1. Don't use any contact details in the message. Not the link, phone number or reply button.
2. Find your park's number yourself. Use the park's page on BIG4.com.au or the confirmation email you received when you first booked.
3. Call or email the park and quote your booking reference. They can see your booking and any amount genuinely owing.
4. Pay only through a method your park confirms directly. If you're unsure, ask the park how they'd like you to pay while you have them on the line.

It's always fine to check. Our park teams would much rather take a quick call than see you lose money.

Keeping your details safe online

A few simple cybersecurity habits make it much harder for scammers to use your details:

• Use a strong, unique password for your email and any travel accounts. If a password is reused, one breach can unlock several accounts
• Turn on two-factor authentication for your email, bank and social media accounts.
• Book only through BIG4.com.au or directly with your park. Type the address yourself or use a saved bookmark rather than a link in a message or ad.
• Keep your phone and computer up to date, including your browser and apps and make sure to install security updates.
• Check your card statements before and after your holiday and report any payment you don't recognise to your bank.

What to do if you've clicked a link, shared details or paid

Act quickly. The sooner you do these things, the more can be done.

1. If you paid or shared a card or bank details: call your bank or card provider straight away, using the number on the back of your card or their official website. Ask them to stop the transaction and cancel or replace your card.
2. If you entered a password: change it on the genuine website, and anywhere else you use the same password.
3. Tell the park. They can check your booking is still in place and note the scam so other guests can be warned.
4. Report the scam to ScamWatch at scamwatch.gov.au. If you lost money, also report it at cyber.gov.au/report.
5. Get free support if you're worried about your identity. IDCARE, Australia's national identity and cyber support service, can help you make a plan. Call 1800 595 160 or visit idcare.org.

Watch for follow-up scams. People who have been targeted once are often contacted again, sometimes by someone offering to help recover lost money. Treat these messages with the same caution.