> They post bank account details for the customer to send a payment to.

This is even less credible to me than a phishing site set-up to take card details. As soon as you try to make a payment to a scammer's bank account, confirmation of payee will fail because the bank details won't match the hotel's. It should also raise alarm bells because it's a completely out-of-character thing to be asked to do prior to a stay with a hotel.