Booking.com account scams: how to protect your property and your guests

Criminals get into a property's Booking.com extranet (the partner back office where you manage rates, bookings and guest messages) with stolen passwords. Often a fake Booking.com e-mail sends a member of staff to a page that asks them to paste a command into the computer, or hidden malware copies the passwords saved in the browser. Once inside, they write to your guests through Booking's real chat, with the right name, dates and price, and ask them to "re-confirm the card" on a fake page. The defences are within a manager's reach: app-based login codes, one login per person, a reception rule against pasting commands, and a warning to guests in your confirmation message.

How the criminals get into the account

The method Microsoft, Securonix and Sekoia have described is called ClickFix. On 13 March 2025, Microsoft Threat Intelligence described a campaign it tracks as Storm-1865, running since December 2024 against staff at hotels and other properties that work with Booking.com in Europe, North America, South and Southeast Asia and Oceania. The e-mails look like Booking.com and mention a negative review, a request from a prospective guest, a promotion or an account check. The link opens a fake "I'm not a robot" box on a faded Booking.com background, which tells the person to open the Windows "Run" box with a keyboard shortcut and paste in text the page has already copied to the clipboard. That text installs malware that steals passwords and payment data.

On 5 January 2026, Securonix published another version, aimed at European hospitality businesses: a fake Booking.com cancellation notice with a large charge in euros (€1,004.38 in one example), a page that fakes a browser error and then the Windows blue screen, and three steps to "fix" it: Windows+R, Ctrl+V, Enter. The end result is a program that gives the attacker remote control of the computer.

It doesn't always start with an e-mail. In 2023 Akamai described attacks that began with an ordinary booking request; the "guest" then sent the hotel urgent, emotional e-mails with a link to "photos", which installed data-stealing malware. Between April and October 2025, Sekoia followed a campaign that used ClickFix and a remote-access tool to steal hotels' Booking.com and Expedia logins. According to Sekoia, those stolen logins are sold on criminal forums, singly or in bulk, and the best-quality ones go for between $5 and $5,000 each.

How guests get scammed

With the extranet open, the criminal sees what your reception sees: guest name, dates, price and message history. They write through Booking's chat, WhatsApp, text message or e-mail, around the time the guest expects to hear from you. In the case Akamai described, the message asked the guest to "re-confirm their credit card" and threatened to cancel the booking if nothing was done within 24 hours. The link opens a page that looks like Booking.com, sometimes with a fake "support" chat to keep the guest paying. Sekoia named the campaign "I Paid Twice" after a guest who paid for the same stay twice, once to the hotel and once to the criminals.

On 28 May 2026, Gen Digital, the company behind Norton, counted more than 350 properties in 50 countries whose booking data had been used in these attacks, and called the figure conservative. In April 2026, Booking.com said it had detected suspicious activity on its systems and told customers that unauthorised third parties had accessed data from some reservations (names, e-mail addresses, phone numbers and booking details). It added that card data was not affected and reset those reservations' PINs, according to a summary by INCIBE-CERT, Spain's incident response team, which in May described the exact origin as still under investigation. On 21 October 2026, the European Commission opened formal proceedings under the Digital Services Act that cover, among other things, how reservation and guest data is shared with properties and how Booking's messaging service works.

The damage reaches you afterwards: the guest blames whoever wrote "on behalf of the hotel", leaves a poor review, asks for their money back or disputes payments.

What Booking.com asks of its partners

Booking's account security page on the Partner Hub says two-factor login has been mandatory since registration: as well as the password, Booking sends a code to a team phone or to the Pulse app (Booking's app for partners). The same page recommends codes generated in the app (called TOTP) over text messages, because texts can be read by others, last longer and are not encrypted, while app codes expire quickly. You switch it on in the extranet under the account icon, "My devices": pick the device and choose "Enable 2FA via Pulse".

Booking.com says it never asks partners for login details. If someone on your team has given the password and code to an outsider, or has had calls or messages asking for account changes, Booking asks you to contact it within 24 hours. To guests, Booking.com says it never asks for card details by e-mail, phone, text or WhatsApp, or for a bank transfer that differs from the payment policy in the booking confirmation.

What to do this week

A manager can do all of this without outside help, and it is what we go through with the team during the on-site Raio-X.

1. Switch on Pulse app codes for everyone who logs into the extranet, and check that the registered phone belongs to someone who still works for you.
2. Give each person their own extranet login, with only the permissions they need. Delete logins of people who have left and retire the shared reception password. Under "My devices", remove any device you don't recognise.
3. Protect the e-mail account linked to your Booking.com login with two-factor login and a password used nowhere else. Whoever controls that inbox can reset the extranet password.
4. Stick a one-line rule next to the reception computer: "No website, no 'verification' and no caller will ever ask us to press Windows+R, paste and press Enter. If you see it, close the page and tell the manager."
5. Take 20 minutes with the team and show the real lures: a negative review, a cancellation with a big charge, a guest sending a link to photos, an account check. Agree that any such notice is checked by typing the extranet address by hand or opening the Pulse app, never through the link.
6. Don't save the extranet password in the reception computer's browser, and keep that computer for work only.
7. Add a line like this to your confirmation and pre-arrival messages: "We will never ask for your card details by message, WhatsApp or link. If you receive a request like that in our name, don't pay and call us on +351 ...".
8. Check that your property's domain has a DMARC policy of quarantine or reject, so nobody can send e-mail that appears to come from your address. In November 2026 we checked the 109 websites that tourist establishments in the eastern Algarve (Sotavento) list in Portugal's national tourism register, and 56 of the 83 domains (67%) gave receiving mail servers no instruction to reject or quarantine forged mail. Our plain guide to SPF, DKIM and DMARC explains the fix, and the free Raio-X Digital includes this check.

What only shows up inside the property

These campaigns run in bulk: Gen Digital describes fake pages generated at scale for hotels, hostels, guesthouses, villas and apartments. Fake e-mails reach properties of every size, well-run ones included, so the useful question is what happens when one reaches yours. In the Microsoft, Securonix, Sekoia and Akamai campaigns, the way in was a staff member's computer.

An on-site check looks at what nobody can see from outside:

• staff computers and phones with the system and browser up to date and virus protection switched on;
• no remote-control program, such as AnyDesk or TeamViewer, installed or left running when nobody needs it;
• the router's admin access locked, and nothing open to the internet that shouldn't be, such as cameras or video recorders;
• guest Wi-Fi kept separate from the office network and the cameras;
• backups that have been restored at least once;
• one account per person.

That is what we check on the on-site Raio-X, a visit in which we also lock down your accounts, with a short written report at the end and a quote on request for anything that needs fixing.

What to do if the account has already been hit

Start with the computer. Disconnect the machine where someone pasted the command or clicked the link, and don't use it for the extranet again until it has been cleaned or reinstalled. The malware in these campaigns steals passwords, including those saved in the browser, so change every one of them from a different device, starting with your e-mail and Booking.com.

Then follow Booking's own steps: reset the password with "Forgot your password?" on the extranet sign-in page, check whether anything in the extranet has changed (contact details, bank details, users or sent messages, for example) and use "Report a security issue" within 24 hours. Phone Booking.com partner support as well.

Warn guests with upcoming stays, by phone or by e-mail from your own domain, that you never ask for payment by link and that they should ignore any recent message saying otherwise. Anyone who has already paid should call their bank at once.

Keep the evidence before deleting anything: the fake e-mails with their headers, screenshots of messages sent in your name, the links and the times. Then make a formal criminal complaint (a "queixa") to the police: the PSP in towns, the GNR (the National Republican Guard, which polices most rural areas, including many quintas), the Polícia Judiciária (the criminal investigation police) or the Public Prosecutor's office. If you are filing as an individual rather than as a company, you can also report fraud ("burla") online through the Interior Ministry's Queixa Eletrónica site, which is in Portuguese. The incident can also be reported to CERT.PT, the response team of Portugal's National Cybersecurity Centre (CNCS), through its MyCiber platform or at cert@cert.pt, as the CNCS notification page explains.

If outsiders saw guests' personal data, Article 33 of the GDPR requires you to notify the supervisory authority, in Portugal the CNPD, where feasible within 72 hours, unless the breach is unlikely to put people at risk, and to keep a record of the incident even when you don't notify. The CNPD has its own form for this.