The phishing messages include real confirmation numbers and booking details—here’s how to avoid falling for it.