Fake booking scams: Booking.com phishing and vacation rental fraud
Messages quoting your real reservation ask for card details or extra payment. How booking phishing works, what leaked at Booking.com and how to rent safely.
The message quotes your full name, the right dates and the hotel. It says payment failed and the booking will be cancelled unless you confirm your card within hours. It looks real because the data is real.
What happened at Booking.com?
In April 2026 Booking.com told customers that unauthorized third parties may have accessed reservation information, including names, contact details, dates and messages with hotels, The Register reported. The company reset booking PINs and said financial data was not accessed. On June 15, 2026, HKCERT warned of phishing emails and WhatsApp messages exploiting that data.
How does the scam work?
Switzerland's federal cybersecurity office (BACS), quoted by Netzwoche, described two variants: fake “refund” messages leading to phishing payment pages, and hijacked hotel booking accounts used to demand card “verification” or prepayment, sometimes through the platform's own messaging. BACS stresses you never need to give login details or scan a QR code to get a refund.
And vacation rental fraud?
The FTC warns of real listings copied with the scammer's contact details, properties that don't exist, unusually low prices and pressure to decide on the spot. Don't wire money or pay with gift cards.
How to protect yourself
- Open bookings only in the official app or by typing the site address.
- Pay only inside the platform; keep chats there.
- Call the hotel on a number you looked up yourself.
- Get a contract and confirm the address exists before any deposit.
- Prefer credit cards, which are easier to dispute.
- Turn on two-step verification.
If you fell for it
- Stop replying and call your card issuer to block and dispute.
- Change your platform password.
- Report to the platform, and in the US to ftc.gov/complaint.
See also tourist scams, how to check a website and the Quiz.
What are the red flags?
- A short deadline and a threat of cancellation.
- A “payment declined” or “incomplete details” notice.
- Requests for your card number, password or a one-time code.
- A link to “confirm” or “get a refund,” or a request to move the chat to WhatsApp.
- Correct reservation details. As HKCERT notes, that does not prove a message is genuine.
Victims sometimes end up paying twice, once to the real property and once to the scammer, believing they are “finalizing” the booking, Brazilian newspaper O Povo reported. In Brazil, Paraná's civil police also warn about fake summer rental listings on social media and classified sites: check that the Pix recipient's name matches the advertiser before paying (PCPR).
Where to report
The FTC asks people to report suspected rental scams at ftc.gov/complaint even if they did not lose money, because reports help track the schemes. In Brazil, file a police report online in your state with screenshots, links and receipts, and contact Procon and the platform for consumer issues such as improper charges or cancellations.
来源
- The Register — Booking.com breach (Apr 2026)
- HKCERT — Beware of Booking.com phishing messages exploiting suspected leaked booking data (Jun 2026)
- Netzwoche — BACS: wie Betrüger Hotelbuchungen für Phishing missbrauchen (Jun 2026)
- O Povo — Golpe no Booking e Airbnb causa cobrança dupla
- Polícia Civil do Paraná — alerta para golpe do aluguel na temporada de verão
- FTC — Getting a vacation rental? Watch out for scams