Travel Scams

Why Smart Travelers Still Get Scammed

Travel scams don’t work by being clever. They work by exploiting reflexes most people never examine: the urge to be polite, the impulse to help, the embarrassment of a public confrontation, the rush to fix a problem before it gets worse. Anyone who has lived through a Barcelona metro distraction or a Roman taxi shakedown will admit, often privately, that they saw it happening and still got taken. That’s the design.

The scale is bigger than most travelers realize. The FBI’s Internet Crime Complaint Center logged $16.6 billion in reported losses in 2024, a 33 percent jump from 2023, with phishing and spoofing as the most-reported cyber crime category (FBI IC3 Annual Report 2024). On-the-ground theft against tourists is harder to track, but the U.K.’s Crime Survey for England and Wales recorded an estimated 78,000 phone or bag snatches in the year ending March 2024 — a 153 percent increase over the previous year (House of Commons Library briefing on mobile phone thefts).

This report covers the twelve scams hitting travelers most often in 2026, organized into three groups: classic street scams that have run unchanged for decades, digital scams that arrived with the smartphone era, and the new AI-driven scams that emerged in 2024. Each entry includes the script, the cities where it happens, and the single move that breaks it.

The Six Classic Street Scams

1. Distraction Theft (the Bump, the Spill, the Petition)

The script: A team of two or three. One creates the distraction. Another lifts. A third disappears with the goods. The bump is the most common version. The fake spilled drink is a close second, especially in Rome and Barcelona. In Paris, the deaf-mute petition variant has been running on the steps of Sacré-Cœur for at least fifteen years and still works.

Where it hits hardest: Paris took the top spot in a 2025 analysis of theft-related tourist reviews, accounting for 16.5 percent of all such reports globally (Radical Storage Pickpocket Capitals analysis). The Paris Metro lines 1, 4 and 9, La Rambla in Barcelona, the 64 bus in Rome, Charles Bridge in Prague, and the area around the base of the Eiffel Tower are the highest-risk spots.

The defense: When anyone touches a traveler unexpectedly in a crowd, the trained reflex should be a hand on the bag, not eyes on the disturbance. That single habit defeats most distraction scripts.

2. The Fake Police Shakedown

The script: A well-dressed person approaches with a badge, claims to be checking for counterfeit currency or drugs, and asks to inspect a wallet or passport. The badge is convincing. The cash, once handed over, is gone.

Where it hits hardest: Bucharest, Sofia, parts of Buenos Aires, Bogotá city center, and increasingly in tourist zones around the Bangkok Grand Palace.

The defense: Real police don’t run pop-up cash inspections of tourists. Asking to walk to the police station together to verify the badge ends the encounter immediately. Genuine officers agree without flinching. Scammers vanish. Check the U.S. State Department’s official country information pages before any trip for known police impersonation patterns at the destination.

3. The “Free” Bracelet, Rosemary Sprig, or Scarf

The script: A friendly stranger ties a bracelet on the wrist, drapes a scarf over the shoulder, or pushes rosemary into the hand. The “gift” then becomes an aggressive demand for payment, often with the bracelet refusing to come off. The trap is social pressure: most people pay just to end the awkwardness.

Where it hits hardest: Outside Sacré-Cœur in Paris, around the Trevi Fountain in Rome (which sees roughly 1,000 visitors per hour), on Las Ramblas in Barcelona, and most aggressively in Marrakech’s Jemaa el-Fnaa square.

The defense: Hands stay at the sides or pockets. A flat “no thank you” with one step backward, no smile, no apology. The friendliness is the hook. Refusing the friendliness ends it.

4. The Unlicensed Taxi or Tuk-Tuk Tour

The script: A driver outside the airport or major attraction offers a “city tour” for what sounds like a bargain. The tour ends at a gem shop in Bangkok, a tailor in Hoi An, or a brother-in-law’s restaurant. The driver gets commission. The traveler gets pressured to spend. Variant two: the driver quotes a fair fare and demands ten times that amount on arrival, holding luggage hostage.

Where it hits hardest: Bangkok (Suvarnabhumi arrivals, Khao San Road), Cairo (Pyramids of Giza), Mumbai, Marrakech, Bali (Denpasar arrivals, Ubud).

The defense: Use Grab in Southeast Asia, Bolt in Eastern Europe and Africa, Uber where it operates legally, or the official metered taxi rank. Never enter any vehicle where the route includes shopping stops. The 200 baht saved is never worth the three-hour gem store ambush.

5. The Rental Damage Claim

The script: A scooter or car rental shop produces a list of “new” damage at return time and demands hundreds or thousands of dollars on the spot. The damage was either pre-existing or invented. The passport, held as deposit, becomes the leverage.

Where it hits hardest: Bali scooter rentals (especially Canggu and Kuta), the Greek islands, certain shops on the Thai islands, Cambodia. The Bali scooter scam is so well-documented that most travel insurance policies now have specific clauses about it.

The defense: Two minutes of video walking around the entire vehicle before leaving the shop, narrating any visible mark. Never leave a passport as deposit. Offer cash or a card hold instead. Use shops with hundreds of recent positive reviews on Google Maps, not the cheapest one on the corner.

6. “It’s Closed Today”

The script: Approaching a major attraction, a friendly local mentions it’s closed for a religious holiday, royal visit, or renovation. They suggest an alternative. The alternative ends at a shop that pays them commission. Nothing is closed.

Where it hits hardest: The Bangkok Grand Palace runs this scam at near-industrial scale. Variants appear at the Taj Mahal in Agra, the Red Fort in Delhi, and the Blue Mosque in Istanbul.

The defense: Walk to the entrance. Major attractions don’t close on no notice. The official ticket office is the only authority worth listening to.

The Four Digital Scams

7. Copycat Booking Sites

The script: A near-perfect clone of Booking.com, Airbnb, or a hotel chain’s site. Often paid into Google search above the real listing. The booking goes through. The hotel never receives it. The “host” stops responding two days before arrival. Phishing and spoofing was the single most-reported cyber crime category in the FBI IC3’s 2024 report, with 193,407 complaints.

The defense: Check the URL letter by letter. “Booking-deals.com” and “Booking.co” are scams. Pay with a credit card so the chargeback window stays open. Never wire money to a host before checking in.

8. QR Code Phishing

The script: A scammer prints a QR sticker and slaps it over a real one on a parking meter, restaurant table, or tourist information board. Scanning sends the phone to a phishing site that captures card details. The U.S. Federal Trade Commission flagged QR code phishing as a rising threat in 2024 and 2025 (FTC consumer alert).

Where it hits hardest: European parking meters (especially Italy and Spain), high-volume tourist restaurants in Lisbon and Barcelona, train stations across Europe.

The defense: A QR code that looks like a sticker on top of something else gets ignored. The URL goes in the browser manually instead.

9. Hotel Phone Fraud

The script: The room phone rings late at night. “Front desk” reports a problem with the card on file and asks the guest to read out the number to fix it. The call is routed from outside the hotel.

The defense: Hotels never ask for card details over the room phone overnight. Hang up. Walk to the front desk in the morning to verify.

10. Currency Short-Change

The script: A money changer counts the right amount, then “fast hands” the swap, palming a few notes back or substituting smaller denominations. By the time the traveler counts the cash on the street, the booth has changed shifts.

Where it hits hardest: Independent exchange booths near major train stations, especially in Bangkok, Istanbul, and the Egyptian tourist circuit.

The defense: ATM withdrawal at an international bank branch is almost always the better first move. If exchanging cash, count it at the counter, in front of the teller, before stepping away.

The Two AI-Era Scams (New Since 2024)

11. The AI Voice-Clone Family Emergency Call

The script: A scammer harvests audio from a traveler’s TikTok, Instagram stories, or YouTube. AI tools then generate a convincing voice clone. A panicked phone call goes to family back home: the traveler has been arrested, hospitalized, or is in a holding cell and needs money wired immediately. The voice is unmistakable. The story is plausible. The pressure is intense.

This is the fastest-growing travel-adjacent scam in North America and the U.K. The U.S. Federal Trade Commission has issued specific consumer warnings about AI voice-clone family emergency scams, urging recipients to call the family member back on a known number before sending money (FTC consumer alert on AI family emergency scams).

The defense: A family safe word, agreed in person before the trip, that has never been posted anywhere online. Any emergency call without the safe word is treated as fraud no matter how convincing the voice. The safe word should be obscure: a childhood pet’s name combined with a fruit, not “rainbow” or a sports team.

12. The Crypto Wallet Drainer at Internet Cafés

The script: Public computers at internet cafés in some destinations carry keylogger malware. A logged-in crypto wallet, exchange, or banking session captures the credentials. The account empties within minutes. The IC3 report flagged cryptocurrency-related complaints as accounting for $9.3 billion in 2024 losses, a 66 percent increase year over year.

The defense: Public computers never see financial accounts. Personal device, personal connection (eSIM or phone hotspot, not café Wi-Fi), trusted VPN active before login.

What to Do After Getting Scammed

1. Freeze the cards inside 60 seconds. Wise and Revolut freeze instantly from the app. Most major bank apps now freeze in two taps. The international collect-call number on the back of a credit card works from any phone abroad.
2. Get the police report in writing. Required for any insurance claim. In Barcelona, the Mossos d’Esquadra at the Nou de la Rambla station handle tourist reports in English. Rome’s tourist police are at Via di San Vitale 15. Bangkok’s tourist police work out of dedicated offices in Sukhumvit.
3. Call the travel insurance emergency line. Most policies require notification within 24 hours for theft claims. The number is on the policy, not the receipt.
4. Replace a stolen passport at the embassy. Most Western embassies issue emergency travel documents within 24 hours when the traveler has a digital copy of the original. EpicLayover’s directory of 50 government travel advisory websites has the contact information for every major nation.
5. Dispute fraudulent charges within 60 days. U.S., U.K., and Australian credit card chargeback windows are generous. Beyond that window, recovery becomes much harder.
6. Report the scam to the right authority. Reporting helps tracking; tracking helps the next traveler.

Six Habits That Stop Scams Before They Start

• A travel money card replaces the home bank card. Wise and Revolut freeze instantly, charge real exchange rates, and isolate damage if compromised.
• Two cards, two physical locations. Daily card in the wallet. Backup card in the hotel safe or money belt. Never both in the same bag.
• VPN active on every public network. Hotel Wi-Fi, airport lounges, café connections all default to compromised until proven otherwise.
• Two minutes of rental video before driving away. Closes the Bali scooter scam entirely.
• Family safe word agreed before flying. Five seconds of conversation that defeats the AI voice clone.
• Travel insurance bought the day the trip is booked. Most scam losses are recoverable through insurance — but only if the policy predates the incident.

Bottom Line

Every scam in this report has a script and a counter. Travelers who get hit aren’t unintelligent or careless. They simply hadn’t read the script. Read it once. Set up a travel money card. Agree a family safe word. Then go enjoy the trip.