Fake 'Booking.com' messages that steal your hotel account and scam your guests: how to spot them and what to do (2026)

Updated: 9 November 2026

Emails that look like they come from Booking.com or a guest, and aim to get into your property's account, have been circulating for some time. With that access, scammers message your guests with real booking details and ask them to pay by card through a link. This is what Microsoft, Booking.com, Airbnb and the authorities say (sources at the end). This is not legal advice: for a specific case, talk to the platform, your bank or the police.

How the scam works

Microsoft described a campaign against hospitality organisations, including in Europe, which began in December 2024 and was still active in February 2025.

An email arrives that looks like Booking.com: a negative review, a prospective guest's request, an 'online promotion opportunity' or an 'account verification'.
The link (or a PDF with the link) leads to a fake page with a 'captcha'. It tells you to press some keys to open the Windows Run box and paste something the page has already copied: that installs a program that steals passwords and financial data.
With your credentials, they get into your extranet and message your guests through the platform chat, with their real name and dates, asking them to 'pay again' or 'confirm their card' through a link, often under pressure ('within 24 hours or it is cancelled').

Warning signs

Urgency or threats: 'verify today or your account will be suspended', 'reply to this review now'.
You are asked to sign in, download a file or open a link you were not expecting, by email, SMS or WhatsApp.
A 'captcha' that asks you to press keys or paste something: no real captcha does that.
Addresses or domains that look similar but are not the same, and spelling mistakes.
Booking.com says its agents only ask for your property ID, never your password or a card number.

What to do before it happens

Turn on two-factor authentication on Booking.com, Airbnb and your email: even if the password is stolen, the code on your phone is still needed.
Always sign in by typing the platform's address yourself or from its app, never from a link in an email.
Never run anything a 'captcha' asks for and never paste commands into your computer.
Use different passwords for the extranet and your email, and give each team member their own login.
Tell guests in the confirmation how you really take payment (for example, 'pay at the property') and that you will never ask for their card through a link.

If it has already happened

Change the extranet and email passwords from a clean device and turn on two-factor authentication.
Tell the platform through its official channels: on Booking.com, via 'Contact Booking.com', which leads to the security issue form for partners.
Warn guests with upcoming bookings to ignore any request to pay through a link; Booking.com reminds travellers it never asks for card details by email, phone, SMS or WhatsApp.
If someone paid, they should call their bank to block the card.
Keep screenshots, emails and links: you will need them for the platform and the police report.
Have a technician check the computer if you ran anything.

Where to get help and report

Spain: INCIBE's 017 line is free and confidential, 8:00 to 23:00 every day, also for businesses (WhatsApp 900 116 117, Telegram @INCIBE017). It gives advice but does not take reports: file a report with the police (Fuerzas y Cuerpos de Seguridad).
Portugal: file a complaint with the police. For IT incidents there is also the National Cybersecurity Centre (CNCS).
Italy: the Polizia Postale takes reports through the 'Commissariato di P.S. online'.
Greece: the police Cybercrime Division answers on 11188 and at ccu@cybercrimeunit.gov.gr; information at cyberalert.gr.

How iQuota helps

With iQuota, payment is always made at the property and card details are never requested by message. AI assistants get your data from your listing, not from emails. This does not replace securing your platform accounts, but it is one more channel with no payments through links.

Want an official booking page AI can read and a connector with your real prices, commission-free? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Can Booking.com ask for my password on the phone?

No. According to Booking.com, its agents only ask for your property ID and never your password or card number.

A guest paid through a fake link: what do I tell them?

To call their bank now, report it to the platform through its official channel and keep the evidence for a police report.

Is calling 017 the same as filing a report?

No: 017 gives advice; reports are filed with the police.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά