On a recent trip, I booked an airport hotel for a layover in Jakarta. I used Booking.com, selecting the option for an automatic card payment to be taken a few days before the stay.
A week before the trip, I received a WhatsApp message purporting to be from the Jakarta airport hotel. There was a profile image of what looked like a staff member, and the message included my full name, my booking reference and the dates of my stay.
