Travelers using Booking.com are being targeted by a sophisticated phishing campaign spanning more than ten countries.
Scammers are intercepting reservation details to demand fraudulent payments, reaching out to victims through the platform’s own internal messaging system and via WhatsApp shortly after a hotel booking is finalized.
On April 12, 2026, Booking.com notified users by email that unauthorized parties had accessed reservation information, including phone numbers and email addresses. At that time, the company said that payment details and passwords remained secure, reisen EXCLUSIV reported.
Criminals use the stolen data to craft messages that mimic official hotel correspondence. By including accurate details—such as the guest’s name, specific travel dates, and booking numbers—the attackers establish a facade of legitimacy. They then use the threat of a cancelled reservation to pressure victims into clicking malicious links.
“That was not us, but a fraud attempt,” the hotel told the traveler Patrick after he reached out to verify a suspicious WhatsApp message, reisen EXCLUSIV reported. In some cases, the attackers gain direct access to a hotel’s extranet, allowing them to send messages directly through the official Booking.com app.
A primary warning sign is the URL structure; while a link may begin with “booking.com,” it often ends in a domain extension such as “.live.”
The German consumer protection agency, Verbraucherzentrale, warns that these look-alike domains are used specifically to confuse users. Once a guest enters credit card information into these portals, the data is transmitted directly to the criminals.
Experts advise victims to contact their issuing bank to cancel the card or use banking apps to trigger a temporary block.
“I will be more vigilant next time,” said Lena, a traveler who lost several hundred euros after interacting with a fraudulent link, reisen EXCLUSIV reported. While her bank could not recover the funds, Booking.com issued her a voucher for the amount lost, valid until 2029.
Booking.com maintains that it does not request credit card details via email, chat, SMS, or WhatsApp. Travelers are advised to handle all payments exclusively through the official platform or directly at the accommodation upon arrival. Authorities suggest that users report suspicious messages through the app and block unknown numbers immediately.
Related reading