Fraud on Booking.com

Scammers have not just “become more active” — they have evolved. And they are evolving faster than most users can adapt to new schemes. Today, it is no longer enough to simply “avoid suspicious links.” Attacks have become targeted, subtle, and, most importantly, highly believable.

This time, users of the world’s largest accommodation booking platform — Booking.com — have been targeted. According to media reports, some users received warnings about potential unauthorized access to their personal data. This is not a classic direct hack, but a more sophisticated story — phishing that exploits trust in the platform.

The scheme operates not “somewhere nearby,” but directly within the привычный user journey. A person books a hotel, receives confirmation — everything looks normal. And that is exactly when the interesting part begins.

The user receives a message. Sometimes it is SMS, sometimes WhatsApp, sometimes even the internal chat of Booking itself. The sender presents themselves as a hotel representative. The tone is polite, the wording is clean, with no obvious mistakes. The reason sounds logical: a payment issue, a need to confirm details, or to fill out a form before check-in.

And here comes the key psychological trigger — the scammer already has some of your data. Your name, sometimes your booking number, trip details. This is not “you won a million dollars,” but a very specific conversation about your real trip. Naturally, the level of skepticism drops: “If they know the details, they must be legitimate.”

From there, it follows a familiar script — just in a more convincing package. You are asked to click a link and fill out a form. It looks like a standard questionnaire: passport details, contact information, sometimes even bank card details “for verification.” In reality, it is a fake page designed for one purpose — to extract as much sensitive information as possible.

And here is the critical point many underestimate: in such schemes, the user provides the data themselves. No virus, no hack — you voluntarily enter everything the attackers need. After that, funds can disappear in a way that appears “legitimate” from the bank’s perspective, because the data was entered willingly.

What makes this scheme particularly dangerous is its universality. Today it is Booking, tomorrow it can be any other service. Social networks, messengers, email — Telegram, WhatsApp, and other platforms are simply delivery channels. Scammers do not care where you are — they care that you believe them.

And the uncomfortable truth is that they are getting better at it. Messages are clean, logical, and free of obvious red flags. This is no longer the era when phishing could be spotted by broken language or suspicious URLs.

It is also important to understand that the platform itself is not “stealing data.” The problem is that attackers insert themselves into the interaction between the user and the service. They use data leaks, social engineering, or compromised accounts (for example, hotel accounts) to appear максимально credible.

The result is a rather harsh reality: there is no longer a “safe place” on the internet. There is only your level of awareness. And if earlier one could rely on luck, now that strategy is closer to “leaving the door open and being surprised someone walked in.”

The takeaway is simple, though not always obvious. Security is not a setting in your phone or a feature in an app. It is a habit of doubt. Even when everything looks correct. Because in 2026, scammers are not exploiting system flaws — they are exploiting human trust.