A Booking.com scam often exploits a real reservation to request a new payment through an external link. Do not pay through that link: verify the request on the official website or app, keep the exchanges in Booking.com messaging, and report the incident to customer service. For professionals, the top priority is protecting partner accounts with two-factor authentication.
What is a Booking.com scam, and how does it work?
A Booking.com scam is fraud that hijacks a listing, message, or reservation data to obtain a payment or sensitive information. Phishing, or a deceptive message, impersonates Booking.com or an accommodation provider. An authentic reservation can therefore serve as context for a highly credible fraudulent request.
The most deceptive scenario begins after the reservation. The traveler receives a message mentioning their hotel, stay dates, or an alleged payment deadline, followed by a link asking them to confirm their credit card. This level of detail does not prove that the request is legitimate: it may indicate that a partner account or another link in the process has been compromised.
Another form of fraud relies on a deceptive listing: nonexistent lodging, unavailable accommodation, or unconfirmed information. In 2026, the Netherlands Authority for Consumers and Markets reports receiving more complaints about fraud on travel platforms, including unavailable accommodations and nonexistent vacation homes, without publishing a total.
The trap many travelers overlook lies in the context. A message received in a thread associated with a real reservation may seem safe, even though its content asks the traveler to leave the usual payment process. The apparent consistency of the message therefore never replaces verification through the app or the website entered manually in the browser.
How can you recognize a fake Booking.com payment request?
A fake Booking.com payment request can often be recognized by an external link, artificial urgency, or an unusual payment method. In 2026, Booking.com recommends treating bank transfers, prepaid cards, and cryptocurrencies as warning signs, then checking any unexpected request through its official website or app.
Do not rely solely on the logo, the sender’s name, or the quality of the English. A fraudulent page may replicate Booking.com’s appearance, while an almost identical web address may contain a different letter, a deceptive subdomain, or an unusual ending.
Here are the checks to perform before submitting information or making a payment:
- open Booking.com through the installed app or by entering the website address yourself;
- compare the amount, deadline, and terms with the original confirmation;
- check whether the request appears in the messaging system and reservation area;
- refuse to provide a password, login code, or financial information by message;
- contact official customer service if a request remains unclear.
Booking.com states in 2026 that its support representatives do not ask for the account password or sensitive financial information. Anyone requesting these details under the pretext of verifying a reservation is therefore clearly crossing a line.
Honestly, a few minutes of verification are better than making a payment under pressure. The right response is not to click to inspect the page, but to return to the official channel through an independent route. The same discipline applies to professional tools and digital secrets, as our analysis explains regarding how to secure API keys after a hack.
What should you do after receiving or paying a fraudulent request?
After a Booking.com scam attempt, keep the message, link address, screenshots, and reservation references without continuing the external conversation. In 2026, Booking.com advises keeping communications in its messaging system and reporting suspected fraud to customer service, which can forward the case to its security team.
If no payment was made, do not click the link again or reply to the sender. Change the account password through the official service if you entered it on a suspicious page, then check the account settings and associated reservations.
If money was sent or card details were shared, contact your bank immediately through its official channel. Provide the available factual details: amount, date, recipient, payment method, and screenshots. Booking.com should also receive the report along with the relevant reservation reference.
Avoid deleting the messages, even if they contain personal data. The exchanges, email headers, and exact page address can help security teams understand the fraud process. A screenshot alone is useful, but it does not always preserve all the technical information.
How do you secure a booking website or app?
Securing a booking application relies on four controls: properly authenticating partners, keeping payments within a verified process, monitoring abnormal behavior, and making reporting easy. A traceable internal messaging system also limits external exchanges. Finally, every sponsored result must be clearly identified as an advertisement.
| Risk | Observable signal | Priority control | Expected profit |
|---|---|---|---|
| Compromised partner account | Unusual login or change | Two-factor authentication and login alert | Reduced account takeover |
| Phishing after booking | External link sent to the traveler | Détection des liens et avertissement dans la messagerie | Keeping payment within the official process |
| Fraudulent listing | Inconsistent information or disputed accommodation | Partner verification and reporting procedure | Faster removal of suspicious content |
| Diverted payment | Sudden change in recipient or payment method | Independent confirmation and logging of changes | Blocking before the money transfer |
| Opaque commercial placement | Sponsored result without clear disclosure | Visible advertising label and documented ranking rules | Better understanding of displayed results |
Two-factor authentication adds a second piece of login verification, such as a temporary code, after the password. Booking.com recommends it in 2026 for partner accounts. It does not replace monitoring: an already-open session or a verification obtained through deception can still be hijacked.
In the projects we work on, we often see teams focus security efforts on the payment page, while partner messaging is also a sensitive area. An interface should detect external addresses, warn the recipient, and allow reporting in just a few gestures, without making normal exchanges cumbersome.
Logging (technical history) should retain connections, data changes, listing modifications, and attempts to send suspicious links. Access to these logs must remain restricted. Otherwise, an uncorrected application vulnerability can undermine visible protections; our overview of risks related to PHP vulnerabilities shows why maintaining the underlying platform matters just as much as the interface.
With a limited budget, it is better to deploy two-factor authentication, login alerts, verification of sensitive changes, and simple reporting than a complex predictive system. Sophisticated detection without a human handling procedure mainly produces alerts that accumulate.
Why is the European Commission investigating Booking.com?
On October 21, 2026, the European Commission opened formal proceedings against Booking.com under the Digital Services Act. The investigation concerns fraudulent or unconfirmed listings, phishing exploiting booking data, and the identification of paid placements. This opening is an investigative step, not a finding of infringement.
Booking.com est supervisée comme une très grande plateforme en ligne. La Commission européenne l’a désignée sous ce statut le 25 avril 2023, la plateforme ayant déclaré plus de 45 millions d’utilisateurs actifs mensuels moyens dans l’Union européenne. En 2026, la Commission coopère avec l’Autorité néerlandaise des consommateurs et des marchés, car l’établissement européen de Booking.com se situe aux Pays-Bas.
The aspect relating to paid results is not new. Following a European consumer-protection action, Booking.com committed in 2020 to explaining when payments made by accommodations influence their ranking in search results.
Pour un dirigeant qui exploite une plateforme, le sujet dépasse donc la seule cybersécurité. Il concerne aussi la modération des annonces, la conception du parcours utilisateur et la transparence commerciale. Les mécanismes publicitaires doivent rester compréhensibles, comme le rappelle également notre analyse des consequences of ad blocking between platforms.
From an agency perspective, the first step is to map the complete journey before choosing tools: partner-account creation, publishing, messaging, payment, data changes, and reporting. The risk often lies between two screens managed by different teams.
Addressing booking security upstream helps avoid treating payment, accounts, and messaging separately. An outside perspective can help prioritize controls according to the most exposed journeys, without unnecessarily complicating the experience for travelers or partners.
FAQ about Booking.com booking fraud
Does Booking.com require payment in cryptocurrency?
In 2026, Booking.com identifies requests for payment by cryptocurrency, prepaid card, or bank transfer as warning signs. Verify any unexpected request through the official website or app before paying.
Can a hotel send an external payment link after the booking?
An external link received after a reservation should be treated with caution, even if the message correctly cites the stay. Booking.com recommends in 2026 keeping payment on the platform and verifying the request through its official channels.
Does Booking.com messaging guarantee that a message is safe?
The presence of a message in a booking context is not enough to guarantee its legitimacy. Never share a password or login code, and report any suspicious request to official customer support.
Does the European investigation mean that Booking.com violated the law?
The opening of the formal procedure on October 21, 2026, does not constitute a finding of an infringement. The European Commission is examining possible shortcomings concerning advertisements, phishing, and the presentation of paid placements.