Booking.com scam messages: the fake 'confirm your booking' payment request and how to avoid it

What's happened

On 21 October 2026 the European Commission opened formal proceedings to look at whether Booking.com "may have breached the Digital Services Act" by not doing enough about fraudulent listings and phishing scams. The investigation covers fake and non-compliant listings, phishing scams that exploit Booking.com's reservation and guest data, and paid-for boosted listings that aren't clearly labelled as adverts. No finding has been made yet.

Which? says it gets more complaints about alleged fraud on Booking.com than on any other accommodation platform. In a July 2025 survey of 237 of its members who had used the site in the previous two years, 9% said they'd seen messages they believed were attempted scams sent through Booking.com's own messaging system.

Booking.com told Which? that actual incidents on its platform are rare, that listings go through multiple checks, and that it is "cooperating fully" with the Commission.

The warning signs

Which? describes three main scams.

• A request to "confirm" or "re-verify" your booking by paying. The message may arrive in the Booking.com app, by email (sometimes looking as if it's from [email protected]) or on WhatsApp, often with a link and a deadline before your booking is "cancelled". Booking.com says it will never ask for card details by email, phone, text or WhatsApp, never asks for a bank transfer that doesn't match the payment policy in your confirmation, and never needs gift cards.
• A copied listing. Criminals list properties they don't own, sometimes using the real owner's photos. One Surrey guesthouse owner told Which? a fake listing using his photos stayed live for almost a month after he reported it, and came down only when he used Booking.com's illegal content reporting form.
• A booking you didn't make. In an account takeover, a fraudster books through your account, sometimes on a card you haven't used on the site for years.

Other red flags include a host who wants to move the conversation off the platform, pressure to pay within hours, and a price well below similar places nearby.

What it could cost: a worked example

This is an illustration, not a real case. Amir books a holiday let for half-term through Booking.com for £640. Two weeks later a message appears in the app, apparently from the property, saying his card payment "failed" and he must pay again within 24 hours or lose the booking. The link leads to a page asking for a bank transfer. He sends £640, and the "host" stops replying.

Because Amir paid by bank transfer, he can ask his bank for a refund under the Payment Systems Regulator's reimbursement rules, which cover Faster Payments and CHAPS transfers made on or after 7 October 2024. His bank can keep an optional excess of up to £100, so he should get back at least £540, normally within five business days of claiming. Banks can refuse if a customer was "grossly negligent", but the regulator calls that "a high bar".

Card payments aren't covered by these rules, as they have their own protections. If he'd typed his card details into the fake page instead, he'd need to call his card provider straight away to block the card and dispute the payment.

How to check before you pay

1. Go back to your booking confirmation. It sets out how and when you pay. Any request that doesn't match it is a warning sign.
2. Don't click links in messages about payment. Open the Booking.com app or type the website address yourself, and check your booking there.
3. Contact Booking.com or the property using details you've found yourself, not the ones in the message.
4. Check the listing and its reviews. If the same photos turn up elsewhere online under a different name, be wary. Which? found hundreds of reviewers complaining they'd been scammed at properties on Booking.com, so read recent reviews before you book.

What to do if you've been caught

1. Call your bank straight away on the number on the back of your card, or call 159 to reach your bank's fraud team. You have 13 months to claim under the bank transfer rules, but the sooner the better.
2. Report it to Report Fraud (formerly Action Fraud) on 0300 123 2040 or online if you live in England, Wales or Northern Ireland. In Scotland, call Police Scotland on 101.
3. Tell Booking.com. Use "Report that you may have been scammed" in your account so its security team can investigate. If you entered your password anywhere, reset it and turn on two-step verification.
4. Forward scam messages. Send scam texts to 7726 for free, and forward suspicious emails to [email protected].
5. Report a fake listing through Booking.com's illegal content reporting form.

Your questions answered

Will Booking.com refund me?

We couldn't find a published refund policy for scam victims. In one case Which? reported, Booking.com refunded a customer after a fraudster booked through his account, but only after Which? got in touch. If you paid by bank transfer, your bank is your best route.

Does the EU investigation help UK travellers?

Not directly, as the Digital Services Act is EU law. In the UK, Which? has asked Ofcom to look at whether Booking.com's systems comply with the Online Safety Act. Ofcom says platforms must take down illegal content once they're aware of it, and that it has opened investigations into more than 100 sites under the Act.

Sources: European Commission, Which?: the scam crisis on Booking.com, Booking.com: trust and safety for travellers, Payment Systems Regulator