Scams on Booking.com have increased sharply in 2026, with criminals hacking hotel accounts and using AI-powered phishing messages to trick guests into handing over personal and payment details. Fraudsters often contact travellers through WhatsApp, pretending to be the hotel or booking provider, in an attempt to steal financial information.
How the Booking.com WhatsApp scam works
This well-known "reservation hijacking" attack uses your real booking details, such as your exact hotel, dates, and name, to convince you to send money or share payment card information. Criminals typically hack into a hotel's property management or Booking.com account to view guest reservation lists, then contact guests via messaging apps while posing as the hotel.
Victims are sent a link to a cloned website that looks identical to the official platform, designed to steal financial details. Red flags include threats of rapid cancellation if payment is not made immediately and links to a payment verification form that appears unprofessional.
EU regulators investigating Booking.com
The Guardian reports that EU regulators are investigating Booking.com, claiming the site has not done enough to protect users from fake listings and scams. The European Commission, which oversees major tech companies in the EU, said Booking.com may have broken the EU's Digital Services Act (DSA) because of its "absolutely substandard" efforts to stop fake listings and phishing scams.
How to spot a scam and stay safe
Warning signs include being asked to verify your card urgently, a WhatsApp business name or number that does not match your hotel's, receiving an external link to a payment page, or being asked to move to WhatsApp to arrange a payment. Scammers can use your real booking details and AI-generated professional language, so perfect spelling does not mean a message is legitimate.
To stay safe, never make payments through WhatsApp, SMS, or email. Make payments only through the official Booking.com app or website, check your original booking confirmation before paying anything, and do not click links or share your card details or CVV. Contact the hotel directly using the phone number from its official listing, and report suspicious messages to Booking.com.
