A real booking can hide a fake payment. A convincing listing can hide no room at all.

Updated 26 September 2026 with the Which? fake-listing investigation and corrected advice on payments collected directly by properties. Scam illustration and captions revised 6 October 2026.

Already entered your card? Go to the payment-security steps. No room at the address? Go to what to do if stranded.

The September update: the address was a pub

In its 25 September 2026 investigation, Which? reported that a listing called The London Crown sent travellers to The Liberty Bounds pub in London. Another listing used the address of Portcullis House, part of the parliamentary estate. Which? also reported that Booking.com's Dot assistant reassured a researcher about The London Crown despite contradictory location information.

Booking.com's response matters: it told Which? that both properties were legitimate businesses whose accounts had been hijacked after phishing attacks on their own systems. It said bookings had been suspended and affected customers were being supported. This is therefore not evidence that every affected listing began as an invented property; an established account can also be altered into a trap.

The practical lesson is to verify what exists now. An old review, a platform badge or a confident automated answer does not independently establish that the advertised room is available at that address.

Read the message again. Almost every word is true.

Most phishing fails the moment you stop and look: a bank you don't hold an account with, a parcel you never sent, a fine for a road you've never driven. The Booking.com message does the opposite. Stop and look, and the details hold up — because they were lifted from a real reservation system.

In April 2026, Booking.com began telling customers that unauthorised third parties had accessed guest data through compromised hotel partners. The exposed information included names, email addresses, phone numbers and booking details — in the words of one analysis, "essentially everything you'd need to convincingly impersonate a hotel contacting a guest." So when the message names your property, your check-in date and your confirmation code, it isn't guessing. It's reading them back to you. Recognition feels like proof, and the scam runs entirely on that feeling.

Which means the usual advice — "check for spelling mistakes," "look for details that don't match" — quietly stops working here. The details match. The request needs independent verification even when the surrounding details are correct.

The one thing the breach didn't leak

Here is the detail that turns a data leak into a payment scam. By Booking.com's account, the stolen data was contact and reservation information — not card numbers. The criminals can sound exactly like your hotel, but they don't have the one thing they actually want.

So the message is engineered to make you supply it. A "failed authorisation," a card that "needs re-verifying," a small charge to "secure" the room before midnight — every version invents a reason for you to type the card in. The thing it asks you to confirm is precisely the thing the breach couldn't hand over. Once you see that, the whole category collapses into a single question: is this message trying to get a payment or a card out of me? If yes, it doesn't matter how much of it is accurate.

Booking.com's traveller safety guidance warns about urgent requests to resubmit financial information and demands outside the confirmed payment policy. Use official support to check doubts before acting.

Where the message actually comes from

It's tempting to picture the breach as something that happened to you. It didn't — at least not first. You're the last link in a chain that started inside a hotel.

In a separate campaign documented in March 2025, Microsoft described a criminal group it tracks as Storm-1865, targeting hospitality staff with Booking.com impersonation. This research describes a relevant attack method; it does not establish that the group caused every later incident. Hotel staff were lured with fake CAPTCHA or "verify you're human" pages and tricked into running a copy-paste "fix," a technique known as ClickFix, which quietly installed remote-access malware (reported as XWorm and VenomRAT). With a foothold in a property's booking account, the attackers could read genuine guest reservations — and message those guests from a position that looks, to you, indistinguishable from the hotel.

A genuine property can collect payment — verify the terms

Booking.com's payment terms allow Booking.com to organise payment or the property to collect it, including prepayment or payment during the stay. It is too broad to say that every legitimate charge happens inside the app. The relevant comparison is with the payment policy disclosed when you booked.

If the accommodation does not exist, get somewhere safe

Do not enter an unsafe building or remain outside late at night to satisfy a support script. Contact Booking.com through the app or official website and explain that the advertised accommodation appears nonexistent, hijacked or materially misrepresented.

Before cancelling in the app, ask support to record the reason and explain any fee or refund consequence. You are reporting a failed or fraudulent booking, not simply changing your travel plans.

If you already entered your card: the first hour

Act promptly to limit further exposure. None of these steps guarantees recovery:

Your refund route depends on what happened

A stolen-card charge, a card purchase for accommodation that was never supplied and a bank transfer you were tricked into sending are different claims. Give the payment provider the facts and ask it to identify the applicable protection and deadline. Chargeback or other card remedies may be relevant to a failed booking; they are not automatic guarantees.

The UK's mandatory APP scheme concerns eligible bank transfers, not every hotel payment. See the UK reimbursement rules and their limits. Elsewhere, consult the country-by-country refund guide and your provider.