Booking.com controversies

Phishing scam hijacked Booking.com listings, sending tourists to a Wetherspoon pub address

Issue disclosure

Consumer group Which? disclosed that scammers used a sophisticated phishing attack to hijack legitimate property listings on Booking.com, including a fake listing for 'The London Crown' luxury apartments whose given address was actually The Liberty Bounds, a Wetherspoon pub near Tower Bridge. A customer paid £73 via Booking.com for a one-night family stay and discovered the address was the pub, and Which? said Wetherspoon staff have been turning away up to 20 tourists a day. Booking.com said the attack affected the properties' own computer systems and gave cybercriminals temporary, unauthorised access to the accommodations' Booking.com accounts; a second hijacked listing, 'Apartments near Big Ben', used the address of Portcullis House on the House of Commons estate. The fake listing had drawn 250 negative reviews across August and September, according to Which?. Booking.com said it suspended bookings at both properties and is supporting affected customers, while Wetherspoon said it notified Booking.com and asked for the listing to be permanently removed.

EU investigation targeting Booking.com over phishing scams and fraudulent listings

Investigation

Booking.com, the online travel booking platform, was the subject of a European Union investigation concerning phishing scams and fraudulent listings, according to a Reuters report. The investigation focused on the platform in connection with these reported issues. The report did not specify the outcome of the investigation or any findings against the company. The event was reported on October 21, 2026.

Reuters reported that Booking.com was targeted in an EU investigation into phishing scams and fraudulent listings.

Accommodation-partner payment delays

Thousands of accommodation partners in multiple countries reported delayed payments. Booking.com attributed the problem to unforeseen technical issues, while Hungarian authorities opened an expedited investigation and the company's chief executive later apologized to affected hosts.

Fraud through property accounts and messaging channels

Investigations and media reports described fraudsters compromising or impersonating accommodation accounts and contacting guests through platform messages, email, or WhatsApp to request card details or additional payments.

Listings in Israeli settlements controversy

Human-rights organizations criticized the platform for listing properties in Israeli settlements in the occupied West Bank and filed a criminal complaint in the Netherlands alleging corporate involvement in activities connected to alleged international-law violations. Booking.com rejected wrongdoing.

Late notification of data breach

The Dutch Data Protection Authority fined Booking.com €475,000 for failing to report a breach within the period required by European data-protection rules.

Russia fines Booking.com $17.5 million

Fine or penalty

In 2021, Russia fined Booking.com $17.5 million for allegedly abusing its dominant position in the market. The regulator said the company imposed price-parity obligations on hotels and hostels. Booking.com said it intended to appeal. The event was reported as a controversy note concerning the brand.

Booking.com fined for late data-breach notification

Fine or penalty

The Dutch Data Protection Authority fined Booking.com €475,000 after finding that it reported a 2018 customer data breach 22 days after being notified, rather than within the GDPR's 72-hour reporting period. The breach exposed personal details of more than 4,100 customers and credit card details of 283 customers.

Hungary's GVH fines Booking.com

Fine or penalty

Hungary's competition watchdog, the GVH, fined Booking.com 2.5 billion forints (reported as £6.1 million) for misleading advertisements and aggressive sales tactics. The watchdog said the practices involved claims of free cancellation and psychological pressure to facilitate faster bookings.

Customer-data breach and phishing fraud

Criminals obtained customer information and used it in fraudulent communications targeting travelers in several countries. Booking.com said it worked to restrict access, remove phishing sites, and cooperate with financial institutions.