Stay informed

Relax! Check first, then pay.
Advice about fake hotel messages

Many hotel guests around the world are currently getting fake messages. These can be sent via WhatsApp or email. The messages ask guests to enter their personal details or credit card information via a link. Sometimes, they also ask guests to make advance or additional payments. To make sure you can always tell if a message really comes from us, here is a summary of what matters.

Don’t let anyone pressure you. Watch out for fake messages. They might say that your booking will be cancelled unless you pay right away, or that you need to confirm your card details again. Do not transfer money straight away if you get a suspicious request like this.

Your name, booking details or email address do not necessarily prove that the contact is real.

If you think someone is trying to trick you, don’t click on links or give them your information. Please call us on the number that is on our official website or on your original booking confirmation. Do not use the number in the suspicious message. We will be happy to help you check the message.

How to recognise genuine messages from us

Sender:

We write to you exclusively from e-mail addresses ending in @therme-laa.at and call you from our telephone number +43 2522 84 700. We do not communicate with you via WhatsApp.

Payment:

Payments and deposits are made exclusively via the channels stated in your booking confirmation. We do not send payment links or requests for credit card details via WhatsApp.

Pre-check-in:

Before your arrival, you might receive an e-mail from [sender address] with a link to our pre-check-in. It only asks for the details required for the guest registration form (name, address, date of birth, ID number) – never for payment or card details. You are of course welcome to check in at reception in person.

What to do if you receive a suspicious message

  • Do not click on the link and do not enter any data.
  • Delete the message; block and report the number in WhatsApp.
  • If you have already entered card details, please contact your bank or card issuer immediately.
  • If in doubt, call us using our official contact details – we will gladly check it for you. Your booking with us remains valid in any case.

For practical advice on recognising and reporting online scams, visit the European Commission’s website at https://digital-strategy.ec.europa.eu/en/policies/dsa-notice-and-action-mechanism

Information on the security incident at a service provider in October 2026

A guest management portal used by us – through which the entire hospitality industry handles, amongst other things, pre-registrations, guest information and check-outs – also fell victim to a cyberattack in Octo-ber 2026. According to the service provider, data relat-ing to individual guests at our resort who arrived or departed between 17 and 21 October 2026 was also affected: hotel, name, mobile number, arrival and departure dates, and booking costs. According to the service provider, credit card details and special categories of personal data as defined in Article 9 of the GDPR are expressly not affected.

Together with IT security, data protection and external security specialists, we immediately took the necessary protective measures and temporarily suspended our cooperation with the service provider. We report fraudulent activity to the relevant internet services and authorities. Our own systems have been checked and show no irregularities.

Contact

If you have any questions, please call us on +43 2522 84 700 or e-mail us info@therme-laa.at.