Booking.com – the popular website for holiday accommodation – has become a hotbed for phishing scams as users around the world report fraudulent activities that can cost thousands.
Extra caution is being urged when making reservations via the site, as holidaymakers are being caught out by phishing and misleading advertisements that sometimes are listed repeatedly.
An increasing number of people in Belgium who had either checked in or were due to check in to a hotel or flat they had reserved using the platform have fallen victim to sophisticated fraud schemes, the Centre for Cyber Security Belgium (CCB) warned on the Safeonweb website.
"Customers received an email or a notification in the app that appeared to come from Booking.com explaining that their payment had been unsuccessful or that they should check their payment details," experts warned. Customers were asked to make a new payments or provide their bank details, or risk having their booking cancelled. The scam has also affected users of the mobile application.
The public is warned to be especially vigilant as the message contains correct reservation information, making people believe it is genuine. The scam was first reported several months ago but Booking.com has failed to address the issue or take steps to protect users of its site.
In the meantime, Safeonweb – a cybersecurity site supported by the Belgian Government – urged people not to pay through email links but to check reservations on their Booking.com account, which will indicate if further payments are required.
The dirty truth
Separately, misleading photos advertised on the site have resulted in people around Europe booking accommodation that in reality is in a far worse state than images online had suggested. In some instances, listings that presented pristine properties turned out to be almost uninhabitable.
Juergen Horn, a travel blogger for almost 15 years who has been affected, told The Brussels Times about an experience in Kuala Lumpur. "Booking.com provides a platform for scammers to take advantage of tourists. They allow unauthenticated property owners to advertise insalubrious apartments which they then take down after a succession of bad reviews. The same apartments are then relisted under a slightly different name, attracting new victims."
Horn visited the Malaysian capital and booked an apartment with a company called "Comfort Suites KLCC By Vortex". Images presented a tidy propert and reviews were largely positive. "There were a few extremely negative comments but we figured that perhaps those guests had been unlucky, or too sensitive." In fact, it turned out that the poorest reviews were the most accurate.
Credit: Juergen Horn
Horn had to pay a deposit and the owner wanted him to pay for his stay in cash before seeing the flat. After asking to see the flat first, the host became angry and threatened to cancel the stay. Since it was almost midnight, Horn decided to pay and was left to go up to the apartment.
"The pristine images online simply did not reflect the reality of the run-down, filthy apartment," he said. The bathroom ceilings were covered in mould, the drains were completely clogged, there was water damage on the floor and random nails were sticking out of walls. "There were also cockroaches, the place was nauseating." When it came to checking out the host never turned up, meaning Horn didn't get his deposit back.
Multiple listings
Angry with his experience, Horn looked into the accommodation and discovered a network of low-quality apartment companies in Kuala Lumpur. Hosts upload listings with fake reviews and alluring photos, which they then change after a number of negative reviews about the state of the properties. Fresh listings are then posted with the same photos and at the same location. The cycle is often repeated several times.
"We posted an abysmal review of our experience and 48 hours later the 'Comfort Suites KLCC By Vortex' was no longer accepting bookings," Horn said. "But you could book the same apartment with a different company called 'The Vortex Suites KLCC By Blissful'." Reviews on Google Maps show these apartments have been through several name changes.
"We searched Booking.com for accommodation in Kuala Lumpur at the end of March and the entire first page of results is spammed with this kind of properties." Horn's travel blog comments show that this was not an isolated incident. Many other vacationers have also fallen victim to similar scams. Horn noted that the same schemes exist on other booking platforms, like Agoda and Google Maps.
"We are still in shock. We emailed the Booking.com support page about the scheme and while our deposit was refunded, they never responded to our findings."
Booking.com responded to the payment scam, saying it is aware that some hosting partners as well as customers have been affected by phishing scams. "We constantly review and reinforce our security controls, and make significant investments to limit the impact of these ever-evolving tactics where possible. Our security team is also implementing new measures to ensure the account security of our customers and partners," its spokesperson told The Brussels Times.
"Considering the millions of bookings we facilitate every week, such cases remain fortunately very rare." It later confirmed the accommodation in question, Comfort Suites KLCC by Vortex, is no longer available on its platform. "The partner’s other listed properties are currently under investigation for potential action."
