Travellers using the popular hotel website Booking.com are being warned not to fall for scam emails asking them to confirm their hotel payment, after a hack of the company’s email system. In recent weeks, the Observer has been contacted by several customers who claim to have received fraudulent emails from within the Booking.com system.
The emails, sent from noreply@booking.com, claim that the recipient’s stay may be cancelled unless they provide bank card details via an embedded link. The messages threaten cancellation within four to 12 hours and have also appeared as notifications in the company’s mobile app. One customer, Julia Berridge, was forced to cancel her bank card after following the instructions while staying at a hotel in Marseille.
Another victim, Kate Wright, had a second payment taken after responding to the email. She reported the issue to Booking.com, but the call centre initially dismissed her claim as “simply impossible”. She eventually received a refund from her bank after hours on the phone. A third customer, who wished to remain anonymous, avoided losing money by contacting her hotel directly after becoming suspicious.
Booking.com has denied that its system was hacked, instead blaming the messages on breaches in the email systems of its partner hotels. However, affected hotels dispute this, pointing to security measures such as two-factor authentication. Hotel de Colegio stated that it was unlikely that their login credentials were compromised without receiving an SMS or email alert.
This is the latest issue to hit Booking.com, which last month was accused of leaving many hotel operators unpaid for months due to a “technical issue”. In a statement, Booking.com said it was committed to ensuring its platform is safe and trustworthy.
