WhatsApp Scammers Are Impersonating a Puerto Vallarta Hotel, And Walking Away With Thousands

A fraud ring is impersonating one of Puerto Vallarta's best-known beachfront hotels through WhatsApp, using fake business accounts, forged booking confirmations and high-pressure sales tactics to extract thousands of dollars from tourists before they ever set foot in the city.

Victims report being contacted through the number 322 373 8740, configured with a fraudulent business profile bearing the official logo of the Hotel Krystal Puerto Vallarta. The operation follows a precise playbook that begins on Meta's own platforms.

The scheme starts with misleading advertisements on Facebook and Instagram targeting travelers searching for Puerto Vallarta accommodations. Once contact is made via direct message, the supposed "reservation agents" request personal information from victims, then produce counterfeit PDF documents labeled "Reserva Confirmada."

In one confirmed case reviewed by local media, a victim received a fake booking for August with a charge of $8,990.50 pesos (roughly $480 USD). To close the deal, the fraudsters deploy classic urgency tactics: they claim it is the "last available room" and dangle phantom perks, complimentary gala dinners, free tours, contingent on immediate electronic transfer.

The red flag that unravels the scheme for some victims: the CLABE account at Banco Santander is registered to an individual, not the hotel company. When questioned, the scammers simply pose as the hotel's supposed legal representative.

How the playbook works

NoticiasPV, the local outlet that first published the alert based on screenshots and documentation from affected residents, reports that the fraudsters also target Spanish-speaking travelers already in Mexico, not just international tourists planning from abroad. The fake "agents" maintain the professionalism of a real booking desk, complete with responsive customer service and follow-up messages.

The playbook follows a pattern familiar to cybersecurity researchers who study Latin American digital fraud. Phase one: attract through social media advertising optimized for destination-search terms. Phase two: migrate the conversation to WhatsApp, where end-to-end encryption prevents platform monitoring and where the informal tone lowers victims' defenses. Phase three: manufacture urgency through artificial scarcity and time limits. Phase four: route funds through individual CLABE accounts that cannot be easily traced to a criminal organization. Phase five: disappear and rotate numbers before complaints consolidate.

Local authorities have issued a public alert urging travelers to avoid sharing personal data with the number in question and to never deposit funds into third-party accounts outside the hotel's institutional payment channels. The advisory stops short of confirming how many victims have come forward or the total amount stolen.

The scheme exposes a broader vulnerability in Mexico's tourism economy. Puerto Vallarta welcomed over 5.2 million visitors in 2025 according to municipal figures. Each of those arrivals represents a booking transaction, and an opportunity for impersonation. The Puerto Vallarta Tourism Board estimates the destination generates more than $2.8 billion USD in annual tourist spending, much of it processed through informal reservation channels, travel agencies and messaging-platform customer service. That volume creates an attractive target environment for digital fraud operations.

Unlike credit card fraud, which offers chargeback protections and fraud monitoring through issuing banks, wire transfers to individual accounts are nearly impossible to reverse once executed. Mexican financial regulators do not require the same level of identity verification for CLABE accounts that US banks mandate for business accounts, a regulatory gap that scammers exploit. Once a transfer clears, recovery requires a criminal complaint, a cooperative bank and weeks of bureaucratic process, assuming the recipient account has not already been emptied, which typically happens within hours of deposit.

A pattern across resort Mexico

Hotel chains across Mexico's resort corridors have faced similar impersonation scams before. In Cancún in 2024, a fraud ring impersonated two all-inclusive resorts through WhatsApp and Instagram, extracting an estimated $340,000 pesos before being dismantled by the Guardia Nacional's cybercrime unit. In Los Cabos in early 2025, a similar scheme targeting two properties in the San José del Cabo corridor operated for at least four months before victims began comparing notes on social media and discovered the discrepancies between their "confirmation" documents.

The Mexican Association of Hotels and Motels estimates that digital reservation fraud costs the national hospitality sector between $12 million and $18 million USD annually, though the figure is inherently imprecise because many properties avoid publicizing incidents for fear of reputational damage. The association has pushed for mandatory two-factor verification on all hotel booking platforms and greater coordination with Meta to remove fraudulent business profiles faster.

Why verification fails

The use of WhatsApp's verified business profile feature adds a layer of legitimacy that makes the fraud harder to detect on first contact. Unlike email phishing, which arrives in an inbox and can be filtered, WhatsApp messages appear on a user's primary messaging interface with what looks like a corporate verification badge. Meta has not commented on whether the fake accounts tied to the Krystal impersonation have been removed.

The deeper problem is structural: WhatsApp Business accounts can be created with any phone number and display name, and the verification process relies on the phone number being registered to a business entity. Criminals exploit virtual number services and registered shell companies to pass verification checks. A 2025 study by the CyberPeace Foundation found that 31 percent of verified WhatsApp Business accounts offering travel services in Mexico could not be linked to an actual registered business upon investigation.

What travelers can actually do

For travelers, the defensive rules are simple, if tedious: always confirm reservations directly through the hotel's official website or verified phone line before transferring money, no matter how aggressively a WhatsApp agent insists the deal expires in one hour. The two-minute verification call remains the single most effective defense against what has become one of Mexico's fastest-growing tourism-sector frauds.

The Hotel Krystal Puerto Vallarta has not publicly confirmed whether any of its actual reservation systems were compromised. The property is part of the Krystal Hotel Group, which operates multiple resorts across Mexico's Pacific coast and Riviera Maya.

The broader question is whether Mexico's tourism infrastructure can close the verification gap before the fraud wave reaches systemic scale. With international arrivals projected to hit a record 47 million in 2026 according to SECTUR, the attack surface grows every booking season.