Most Booking.com stays go through without a second thought. The ones that do not are often not a fake listing. They are a real booking, followed by a message that uses the guest’s real name, dates and room, and asks them to “verify” a card before the stay is cancelled. The message can arrive in WhatsApp, email, or inside Booking.com’s own chat. That last route is why people click.
This is a reading of the official warnings and the consumer reporting, not a claim that every guest is at risk. The useful part for a holiday-let owner is the mechanism: the criminal is usually sitting in the property’s own partner account, not in Booking.com’s back office.
How the message gets written
Action Fraud’s line is consistent. Criminals phish the hotel or host that manages the listing. Once they have that login they can see the live reservations: guest names, dates, room types, prices. They then write to the guest as if they were the property. The pitch is almost always the same. There is a problem with the payment. Confirm the card within 24 hours or the booking will be cancelled. The link goes to a page built to look like Booking.com.
The booking is real. The names are real. The only lie is the link, and sometimes the sender.
Booking.com’s own trust and safety page is blunt about the tell. The company says it will never ask a customer to share credit-card details by email, phone, text or WhatsApp, and it will never ask for a bank transfer that is different from the payment policy on the original confirmation. A message that does either of those things is not a genuine Booking.com request, however accurate the rest of it looks.
The UK numbers
Between June 2023 and September 2024 Action Fraud recorded 532 reports of this exact pattern, with £370,000 lost between them. Deputy head Adam Mercer told people to treat an unexpected request for bank or card details from a hotel account as a possible takeover, and to contact Booking.com or the property by a number they already had.
That window closed before the next public scare. In April 2026 Booking.com began telling some customers that unauthorised third parties had accessed reservation data through compromised partner accounts: names, emails, phone numbers, addresses and booking details. Reporting at the time said card data held in Booking.com’s own payment systems was not part of that notice. The notice still matters. It is extra fuel for the same pitch: a stranger who already knows the stay.
Which? put a consumer figure on the messages in August 2025. Of 237 Which? members who used Booking.com, 9 per cent said they had seen scam messages through the platform’s own system in the previous two years. That is a small member sample, not a census of every Booking.com customer. Which? still treated it as serious enough to ask Ofcom to look at what protections the site has in place under the Online Safety Act. Parish councils reprinted the Action Fraud alert for residents, including Brindle in Lancashire in January 2025. Once a parish noticeboard is carrying a booking-platform warning, it has left the specialist press.
What to tell a guest who gets one
The practical advice is the same whether you sent them through Booking.com or they found you there on their own:
- Do not enter a card through a link in a message, however official it looks
- Open the Booking.com app yourself, or ring the property on a number from the original confirmation or from the listing page, not from the suspicious message
- Read the web address before typing anything. A genuine Booking.com page ends in booking.com, not a lookalike
- If money has already gone, report it to Action Fraud on 0300 123 2040 (or 101 in Scotland), forward texts to 7726 and emails to report@phishing.gov.uk, and call the card issuer the same day
Owners can cut the chance of their own account being the way in. Use a unique password on the Booking.com extranet, turn on the extra login check, and treat an unexpected “verify your property login” email the same way you would tell a guest to treat a card link.
Why a direct booking does not have this particular hole
This scam needs a middleman login that holds a list of other people’s stays. When someone books on a site you own, there is no Booking.com partner account sitting between you and them for a stranger to steal, and no reason for a “payment verification” message to arrive from a third party. You already have the name. You already have the dates. Payment sits on a page or a link you sent.
That is not a reason to panic about the platforms. Most bookings still complete without anyone touching a fake form. It is a concrete risk that exists because the shop window holds the guest list. It does not exist in the same form when the guest is paying you.
The same close we used on the lookalike booking sites applies here. You cannot police every inbox. You can make the real route obvious: your own page on the confirmation, a phone number that is actually yours, and a note that you will never ask for a card over WhatsApp. Booking.com remains a discovery channel for a lot of owners. The partner-terms piece is still the document that governs that channel. This is just the guest-facing risk that sits next to it.
Key sources
- Action Fraud / wired-gov reprint of the official alert: 532 reports between June 2023 and September 2024, £370,000 lost. Criminals taking over hotel or host Booking.com accounts after phishing the property, then messaging guests. Adam Mercer quoted.
- Booking.com, Trust and Safety for travellers: will never ask for credit-card details by email, phone, text or WhatsApp; will never ask for a bank transfer that differs from the confirmation payment policy.
- Which?, 28 August 2025, “The scam crisis on Booking.com”: 9 per cent of 237 Which? members who used Booking.com said they had seen scam messages through the platform system. Call for Ofcom to investigate under the Online Safety Act.
- Brindle Parish Council, 17 January 2025, reprint of the Action Fraud Booking.com warning. Markyate Parish Council carried the same alert.
- Malwarebytes, 16 April 2026, Booking.com customer notice that unauthorised third parties had accessed reservation data via compromised hotel-partner accounts. Names, emails, addresses, phones and booking details. Card data in core payment systems not reported as part of that notice.
- Cybernews and later consumer write-ups of the same “I Paid Twice” / reservation-hijack pattern, including messages that quote real booking details.