Booking.com scams
Last updated September 18, 2026
The short answer
The Booking.com scam uses compromised hotel accounts to message real guests through the platform's own system, asking you to re-confirm card details or lose the reservation. The message is genuinely from Booking.com; the payment page it links to is not.
This is one of the most convincing scams of recent years, because almost nothing about it is fake. Attackers phish hotel staff, take over the property's Booking.com partner account, and message guests through the platform's real messaging system. The guest gets a message inside their genuine booking, about their genuine reservation, with correct dates and a correct total. Only the payment link is the attacker's.
How Booking.com scams work
- 1
Hotel staff are phished first
A property's partner account is compromised through a phishing email aimed at the hotel, not the guest.
- 2
Messages through the real system
Guests receive a message in the Booking.com app or by email from the platform itself, referencing their actual reservation, saying a payment verification failed and the booking will be cancelled.
- 3
A convincing payment page
The link leads to a page styled as Booking.com that captures the full card. Some versions charge the real amount to make it look successful.
- 4
Urgency with a real deadline
Messages are timed close to check-in, when losing a reservation is a real problem and a guest is least inclined to argue.
Warning signs
- A message asks you to re-enter card details to keep a reservation
- The payment link is not on booking.com — check the domain exactly
- The deadline is a few hours away
- The property asks for payment by bank transfer or a payment app
- You are asked for the card's security code, which Booking.com does not need again
- The message arrives shortly before check-in
- The tone is urgent in a way previous messages from the property were not
Examples
The correct reservation, the wrong page
A guest receives a Booking.com message two days before check-in: the card verification failed and the room will be released in four hours. The message is inside the real app and quotes the correct dates, room type and total. The linked page captures the full card, which is used for $4,100 of purchases the same day. The hotel's partner account had been compromised a week earlier.
Pay the hotel directly
A property messages a guest asking them to pay by bank transfer for a discount. The account was compromised; the transfer goes to the attacker; the reservation remains unpaid and is cancelled on arrival.
What to do
- Never pay through a link in a message. Open the Booking.com app and check the reservation there.
- Call the hotel directly on a number from its own website to confirm.
- Never pay a property by bank transfer or payment app.
- Check the domain of any payment page character by character.
- If you entered a card, cancel it immediately and dispute the charges.
Report it to Booking.com
Report through Booking.com customer service immediately — they can confirm whether the property's account was compromised and protect your reservation.
Getting your money back
Cancel the card at once and dispute the charges as fraudulent; they are covered. Contact Booking.com, which handles these cases specifically and can confirm whether the property's account was compromised and protect your booking. Contact the hotel directly to confirm the reservation still stands, because the attacker may have altered or cancelled it. Keep screenshots of the message: it came through the real system, which matters for the dispute.
Frequently asked questions
How can a scam message come through the real Booking.com app?
Because the hotel's partner account was compromised. The attacker uses the property's genuine access to message its guests through Booking.com's own system, which is why the message passes every authenticity check. Only the payment link is theirs.
Does Booking.com ever ask you to re-enter card details?
Card details are managed inside your Booking.com account, not through a link in a message. If there were genuinely a payment problem, it would be visible when you open the app yourself — which is the check that defeats this entirely.
Should I ever pay a hotel by bank transfer?
No. Bank transfers and payment apps carry no protection and cannot be reversed, which is why a compromised property account asks for them. Pay through the platform or with a card at the property.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Booking.com, these are the guides worth reading next.