Millions of people use Booking.com to reserve accommodation for their holidays. But for several years now, the platform has been confronting scammers who invent increasingly sophisticated ways to swindle money from tourists.
One of the most common schemes starts with a regular reservation. A person chooses a hotel, pays for a room, and receives confirmation. But after some time, they receive a message: there's a problem with the payment, you urgently need to confirm your bank card, otherwise the reservation will be canceled.
One of the most common schemes starts with a regular reservation. A person chooses a hotel, pays for a room, and receives confirmation. But after some time, they receive a message: there's a problem with the payment, you urgently need to confirm your bank card, otherwise the reservation will be canceled.
The message looks authentic. The sender knows the client's name, hotel name, dates of stay, and even the reservation number. Moreover, it can come directly through Booking.com's internal chat. In reality, scammers are behind the message. They offer to click on a link to a fake website and enter bank details. This way, criminals gain the ability to steal money.
This scheme is called reservation hijacking . It's far from new. As The Guardian reported back in June 2025, in cases documented by journalists, people lost several hundred pounds.
This scheme is called reservation hijacking . It's far from new. As The Guardian reported back in June 2025, in cases documented by journalists, people lost several hundred pounds.
To obtain customer information, criminals can hack into hotel accounts. Microsoft detailed exactly how this happens in March 2025. The company discovered a large-scale phishing attack targeting hotel employees in Europe and other regions of the world.
Scammers sent emails impersonating Booking.com. Some messages reported a complaint from a dissatisfied guest, while others mentioned a new reservation or the need to urgently confirm an account. The emails contained a link to a website that looked like Booking.com.
On the fake page, the employee was prompted to complete a seemingly ordinary CAPTCHA verification — to confirm that they were not a robot. But instead, they were asked to press a specific key combination and paste a command that the website automatically copied to the clipboard. Executing this command initiated the download of malicious software.
This way, criminals could steal passwords and other confidential data, gain access to the hotel's systems, and use them for financial fraud. Microsoft named this technique ClickFix .
According to the British center Action Fraud, from June 2023 to September 2024, there were 532 reports of fraud related to accommodation reservations. The total losses suffered by victims amounted to approximately 370 thousand pounds.
Instead of a hotel — a pub or the Parliament building
However, criminals are not limited to stealing bank data. They also offer accommodation on Booking.com that either doesn't exist or doesn't belong to them.
In September 2026, the British consumer organization Which? reported a case in London. Tourists reserved "luxury apartments" called The London Crown near Tower Bridge through Booking.com. But at the specified address, there was an ordinary pub called The Liberty Bounds. Its employees said they had to explain daily to tourists with suitcases that there were no apartments there. Sometimes up to 20 people arrived a day.
In September 2026, the British consumer organization Which? reported a case in London. Tourists reserved "luxury apartments" called The London Crown near Tower Bridge through Booking.com. But at the specified address, there was an ordinary pub called The Liberty Bounds. Its employees said they had to explain daily to tourists with suitcases that there were no apartments there. Sometimes up to 20 people arrived a day.
One of the victims paid 73 pounds for an overnight stay for his family. Two days after the reservation, he received an email seemingly from the apartment representatives, asking to enter bank details on a third-party website. The man suspected fraud, found out that a pub was at the address, and contacted Booking.com customer support. However, according to him, they suggested he first go to the address and try to check in. At that time, the listing already had hundreds of negative reviews from tourists who could not find their accommodation.
Another case concerned "apartments near Big Ben". Their address was listed as Portcullis House — a building of the British Parliament. Tourists who came to check in met armed guards instead of hosts.
Another case concerned "apartments near Big Ben". Their address was listed as Portcullis House — a building of the British Parliament. Tourists who came to check in met armed guards instead of hosts.
Later, Booking.com stated that in these two cases, criminals gained unauthorized access to the accounts of legitimate accommodations and altered information in the listings.
Booking.com has been aware of the problem for years
The scale of fraud on the platform has been growing for several years. Already in 2024, Booking.com's Head of Cybersecurity, Marnie Wilking, reported that over the 18 months, the number of fraud cases had increased by 500-900%. The company linked this, among other things, to the development of artificial intelligence, which allows criminals to create increasingly convincing fake emails and websites.
The scale of fraud on the platform has been growing for several years. Already in 2024, Booking.com's Head of Cybersecurity, Marnie Wilking, reported that over the 18 months, the number of fraud cases had increased by 500-900%. The company linked this, among other things, to the development of artificial intelligence, which allows criminals to create increasingly convincing fake emails and websites.
The increase in complaints, as The Guardian writes , was also recorded by consumer organizations. For example, in the Netherlands, Consumentenbond received 200 reports of Booking.com related fraud in 2025 — twice as many as the year before, when there were 89 such appeals. The losses of victims also increased: from 25 to 65 thousand euros. However, the organization believes that the actual scale of the problem is much larger, as many victims do not report the fraud.
Booking.com has repeatedly stated that it invests in cybersecurity, uses artificial intelligence to detect suspicious listings, and cooperates with law enforcement agencies.
However, numerous cases show that these measures do not always work. Moreover, complex hacking attacks are sometimes not even needed to post fake accommodation.
How journalists rented out the Prime Minister's residence
Journalists from the British consumer organization Which? decided to check how reliably Booking.com verifies accommodation listings. In June 2026, they conducted an experiment : they created a listing for a one-bedroom apartment in central London. As the address, they specified 10 Downing Street — the official residence of the British Prime Minister, and attached a photo of the famous black door to the listing.
Despite this, Booking.com published the listing. Journalists set it up so that interested parties first sent a reservation request, rather than being able to pay immediately. Then they briefly opened the reservation option and themselves booked a week's stay. Booking.com accepted payment for the non-existent apartment. Moreover, according to Which?, even after six weeks, the money for the test reservation was not returned to the researchers.
Despite this, Booking.com published the listing. Journalists set it up so that interested parties first sent a reservation request, rather than being able to pay immediately. Then they briefly opened the reservation option and themselves booked a week's stay. Booking.com accepted payment for the non-existent apartment. Moreover, according to Which?, even after six weeks, the money for the test reservation was not returned to the researchers.
Fancy a stay at 10 Downing Street? We listed the Prime Minister’s famous address as a holiday rental and managed to make a test payment, publish a fake 10/10 review and even send an external weblink through @bookingcom messaging system — Which? (@WhichUK) September 2, 2026
Fancy a stay at 10 Downing Street? We listed the Prime Minister’s famous address as a holiday rental and managed to make a test payment, publish a fake 10/10 review and even send an external weblink through @bookingcom messaging system — Which? (@WhichUK) September 2, 2026
Fancy a stay at 10 Downing Street? We listed the Prime Minister’s famous address as a holiday rental and managed to make a test payment, publish a fake 10/10 review and even send an external weblink through @bookingcom messaging system
After this, journalists checked the review system. They left a fake review with the maximum rating — 10 out of 10, in which they wrote that they enjoyed spending time with Larry — the cat who lives at the Prime Minister's residence. Despite Booking.com's message that the review was sent for moderation, it was published almost immediately.
But the experiment did not end there. Journalists were able to send a link to a third-party website through Booking.com's internal messaging system, where bank card details supposedly needed to be entered to confirm the reservation. Such messages are exactly what scammers use to swindle money from tourists.
The researchers informed Booking.com the results of the experiment. However, the fake listing was only removed on August 27 — more than two months after its creation and after repeated inquiries from journalists.
The researchers informed Booking.com the results of the experiment. However, the fake listing was only removed on August 27 — more than two months after its creation and after repeated inquiries from journalists.
Booking.com stated that the experiment does not reflect the situation with the vast majority of listings. The company assured that it uses various verification mechanisms and artificial intelligence, which allow it to detect and remove most fraudulent offers within 24 hours.
The European Commission takes action against Booking
Against the backdrop of numerous complaints and journalistic investigations, on October 21, 2026, the European Commission launched an official investigation into Booking.com. Regulators want to find out whether the platform is doing enough to protect users from scammers.
The check will cover both fake accommodation listings and "reservation hijacking," where criminals impersonate hotel representatives and extort money from tourists. Separately, the European Commission will examine whether the platform sufficiently clearly indicates paid promotional offers in results.
As The Guardian writes , a representative of the European Commission called Booking.com's efforts to combat fraud "absolutely unsatisfactory." The company itself assures that it cooperates with regulators and continues to improve its security systems.
If it turns out that Booking.com violates the European Digital Services Act (DSA), the company could face a fine of up to 6% of its annual turnover.
Around Putin's residence, another 16 air defense towers have been installed — in total there are already more than 50
Around Putin's residence, another 16 air defense towers have been installed — in total there are already more than 50
Putin stated that Europe cannot instill its culture in migrants because it has lost it itself
Putin stated that Europe cannot instill its culture in migrants because it has lost it itself
In Belgrade, Mother of Former Serbian President Vučić Attacked
In Belgrade, Mother of Former Serbian President Vučić Attacked
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
