Scammers have learned to rent out non-existent accommodation via Booking — here's how the schemes work
Tourists are losing hundreds of euros through fake messages from hotels, paying for non-existent apartments, and arriving at addresses where no one intended to accommodate them.
Millions of people use Booking.com to reserve accommodation for their holidays. But for several years now, the platform has been confronting scammers who are devising increasingly sophisticated ways to swindle money from tourists.
One of the most common schemes begins with a regular reservation. A person chooses a hotel, pays for a room, and receives confirmation. But after some time, they receive a message: there's a problem with the payment, you need to urgently confirm your bank card, otherwise the reservation will be canceled.
The message looks authentic. The sender knows the client's name, the hotel's name, stay dates, and even the reservation number. Moreover, it can come directly through Booking.com's internal chat. In reality, scammers are behind the message. They offer to click a link to a fake website and enter banking details. This way, criminals get the opportunity to steal money.
This scheme is called reservation hijacking. It's far from new. As reported by The Guardian back in June 2025, in cases documented by journalists, people lost several hundred pounds.
To obtain customer information, criminals can hack into hotel accounts. Microsoft detailed exactly how this happens in March 2025. The company discovered a large-scale phishing attack targeting hotel employees in Europe and other regions of the world.
Scammers sent emails impersonating Booking.com. Some reported a complaint from a dissatisfied guest, others about a new reservation or the need to urgently confirm an account. The emails contained a link to a website that looked like Booking.com.
On the fake page, the employee was prompted to complete a seemingly normal CAPTCHA verification — to confirm they were not a robot. But instead, they were asked to press a specific key combination and paste a command that the site automatically copied to the clipboard. Executing this command launched the download of malicious software.
This way, criminals could steal passwords and other confidential data, gain access to the hotel's systems, and use it for financial fraud. Microsoft named this technique ClickFix.
According to the British center Action Fraud, from June 2023 to September 2024, 532 reports of accommodation reservation-related fraud were received. The total losses of victims amounted to about 370 thousand pounds.
Instead of a hotel — a pub or the Parliament building
However, criminals are not limited to stealing banking data. They also offer accommodation on Booking.com that either doesn't exist or doesn't belong to them.
In September 2026, the British consumer organization Which? reported on a case in London. Tourists reserved "luxury apartments" called The London Crown near Tower Bridge through Booking.com. But the address indicated was a regular pub, The Liberty Bounds. Its employees said they had to explain daily to tourists with suitcases that there were no apartments there. Sometimes up to 20 people would arrive in a day.
One of the victims paid about 73 pounds for an overnight stay for his family. Two days after the reservation, he received an email supposedly from the apartment representatives asking him to enter his banking details on a third-party website. The man suspected fraud, found out that the address was a pub, and contacted Booking.com's support service. However, according to him, they suggested he first go to the address and try to check in. At that time, the listing already had hundreds of negative reviews from tourists who could not find their accommodation.
Another case concerned "apartments near Big Ben." Their address was listed as Portcullis House — a building of the British Parliament. Tourists arriving to check in were met by armed guards instead of hosts.
Booking.com later stated that in these two cases, criminals gained unauthorized access to the accounts of legitimate accommodations and altered the information in the listings.
Booking.com has known about the problem for years
The scale of fraud on the platform has been growing for several years. Back in 2024, Booking.com's head of cybersecurity, Marnie Wilking, stated that in the previous 18 months, the number of fraud cases had increased by 500-900%. The company attributed this, in part, to the development of artificial intelligence, which allows criminals to create increasingly convincing fake emails and websites.
The increase in complaints, as writes The Guardian, has also been recorded by consumer organizations. For example, in the Netherlands, Consumentenbond received about 200 reports of Booking.com-related fraud in 2025 — double the number from a year earlier, when there were 89 such appeals. The losses of victims also increased: from 25 to 65 thousand euros. However, the organization believes that the real scale of the problem is much larger, as many victims do not report fraud.
Booking.com has repeatedly stated that it invests in cybersecurity, uses artificial intelligence to detect suspicious listings, and cooperates with law enforcement agencies.
However, numerous cases show that these measures do not always work. Moreover, sometimes even sophisticated hacking attacks are not needed to place fake accommodation listings.
How journalists rented out the Prime Minister's residence
Journalists from the British consumer organization Which? decided to check how reliably Booking.com verifies accommodation listings. in June 2026, they conducted an experiment: they created an advertisement for a one-bedroom apartment in central London. They indicated Downing Street, 10 — the official residence of the British Prime Minister — as the address, and attached a photograph of the famous black doors to the advertisement.
Despite this, Booking.com published the advertisement. Journalists set it up so that interested parties first sent a reservation request, rather than being able to pay immediately. Then they briefly opened the reservation option and themselves booked a week's stay. Booking.com accepted payment for the non-existent apartment. Moreover, according to Which?, even after six weeks, the money for the test reservation was not returned to the researchers.
Fancy a stay at 10 Downing Street?
We listed the Prime Minister’s famous address as a holiday rental and managed to make a test payment, publish a fake 10/10 review and even send an external weblink through @bookingcom messaging system https://t.co/B9AYoOeUVL
After that, journalists checked the review system. They left a fake review with the maximum rating — 10 out of 10, in which they wrote that they enjoyed spending time with Larry — the cat living at the Prime Minister's residence. Despite Booking.com's message that the review was sent for moderation, it was published almost immediately.
But the experiment did not end there. Journalists were able to send a link through Booking.com's internal messaging system to a third-party website, where, supposedly to confirm the reservation, one had to enter bank card details. These are exactly the types of messages scammers use to swindle money from tourists.
Researchers informed Booking.com of the experiment's results. However, the fake advertisement was only removed on August 27 — more than two months after its creation and after repeated requests from journalists.
Booking.com stated that the experiment does not reflect the situation with the vast majority of listings. The company assured that it uses various verification mechanisms and artificial intelligence to detect and remove most fraudulent offers within 24 hours.
The European Commission takes on Booking
Amid numerous complaints and journalistic investigations, on October 21, 2026, the European Commission launched an official investigation into Booking.com. Regulators want to determine whether the platform is doing enough to protect users from scammers.
The review will cover both fake accommodation listings and "reservation hijackings," where criminals impersonate hotel representatives and swindle money from tourists. Separately, the European Commission will examine whether the platform sufficiently clearly labels paid advertising offers in search results.
As writes The Guardian, a European Commission representative called Booking.com's efforts in combating fraud "absolutely unsatisfactory." The company itself assures that it cooperates with regulators and continues to improve its security systems.
If Booking.com is found to be violating the European Digital Services Act (DSA), the company could face a fine of up to 6% of its annual turnover.
Nastassia Kostiugova on Statkevich's and Tsikhanouskaya's position: The proposal to «squeeze out» sounds like a proposal to wait for something unclear, and for an unclear duration 3636
Nastassia Kostiugova on Statkevich's and Tsikhanouskaya's position: The proposal to «squeeze out» sounds like a proposal to wait for something unclear, and for an unclear duration 36
«Why won't a Belarusian learn the Belarusian language? It's just laziness.» Publisher Yaroslav Ivanyuk — on being wanted, the KGB, and language wars 4242
«Why won't a Belarusian learn the Belarusian language? It's just laziness.» Publisher Yaroslav Ivanyuk — on being wanted, the KGB, and language wars 42
It's incredible, but a truckload of cucumbers was brought from Moscow to Olshany — the cucumber capital of Belarus. It was not allowed into the country 1010
It's incredible, but a truckload of cucumbers was brought from Moscow to Olshany — the cucumber capital of Belarus. It was not allowed into the country 10
"Dima, my half-million-euro microscope is in your clinic. You stole the equipment." The founder of "Novy Zrok" spoke about his relationship with the Abelsky family 2121
Comments