A few days ago I booked a Novotel hotel on Booking.com - two days later I received these phishing messages via WhatsApp. Both knew my exact name, phone number, location of stay, and date of stay.
Luckily, both were fairly inept. Let's take a quick look at them.
The first came from a Portuguese business account.
Obviously the name doesn't match that of the large chain hotel I booked with. The domain name doesn't look anything like what I'd expect from either Booking.com or Novotel. They note this isn't an emergency - presumably to bypass the warnings that you shouldn't act on any message trying to convey a sense of urgency. The "Cancel" button on the bottom makes this look more genuine though.
The second one is slightly different.
This is from a much more generic business account, albeit a UK-based one. The date is formatted differently. There's no cancel button. But the wording is identical.
So are these both from the same scammer?
The domains were both registered on the same day - the 21st of October - within hours of each other. They're both protected by CloudFlare, but were registered at two different registrars - one Chinese and one Japanese. Lots of scammers use CloudFlare (who seem to relish in being the protectors of all sorts of unsavoury characters). A smart scammer would register their domains on multiple registrars to avoid all of them getting banned at once. So that's a bit inconclusive.
Looking at the source code for the pages, they appear to be identical.
That means one of two things:
- There is one incompetent scammer who doesn't keep a record of which messages they've sent to which victims.
- There are multiple scammers who are all using the same "off the shelf" phishing kit.
But how did my data leak in the first place?
The first place to look, as always, is within. My Booking.com account uses a strong and unique password. It has a unique email address tied to it. I have MFA via an authenticator app. I regularly use the "Sign out of other sessions" options in the Booking.com app.
My email is similarly secure. And, frankly, if scammers were in there then they could do a lot more damage than sending me a phishing link!
That leaves either Booking.com, Novotel, or one of their systems.
It's fair to say this is a persistent problem with Booking.com - they were breached in 2023 and these sorts of phishing attacks happen regularly.
Although I couldn't find any record of Accor (the owners of Novotel) being breached, it's fair to say other hotels suffer from this problem. It seems depressingly easy to con or bribe a worker into allowing scammers access into a booking system.
This sort of "reservation hijacking" is now depressingly common.
There's a slight twist in the tale. A few moments after I made the original reservation, I received this message directly from the hotel via the Booking.com messaging system:
I can only assume that Novotel are aware of the persistent problem they're facing and this is their attempt to deflect blame.
So I called the hotel (using the number on their website) and they confirmed my reservation. When I mentioned the phishing messages the hotel were very quick to tell me they were a scam, that I shouldn't click any links, and to delete them right away. I did ask if they'd suffered a data breach but, understandably, they don't tell receptionists that.
I've reported the problem to both Accor and Booking.com - we'll see who comes up with the most convincing explanation.
As it happens, a few days ago, the European Commission announced it was investigating Booking.com:
The Commission will also investigate whether the provider of Booking.com has diligently assessed and addressed the risks that phishing scams pose to consumers.
In particular, the investigation will focus on risks related to the way reservation and guest data is shared with accommodation providers, and the design and functioning of Booking.com's messaging service.
The Commission will also examine whether the company has put in place sufficient safeguards to prevent data from being misused to carry out phishing and solicit fraudulent payments.
Stay safe out there!
Update: 2nd November 2026
After some back and forth with the hotel, they said to me:
To clarify, the information automatically transferred from Booking.com to our hotel’s property management system (PMS) is limited to guests’ names and dates of stay. Telephone numbers, email addresses and credit card details are not shared through this system so it is unlikely the breach was from our system which has two factor authentication.
That seems relatively convincing to me. Regardless of how effective their 2FA is, if they don't have my details then they can't leak them.
Booking.com have not meaningfully replied to my queries.
11 thoughts on “More phishing messages via Booking.com and Novotel”
@Edent booking.com has always been a bit of a hellscape.
I'm old enough to remember that they would take your card details on the website all nice and padlocked and all, and then... just fax them to the hotel.
| Reply to original comment on thx.gg
I assume the ICO has been informed of this data breach?
From me? No, not yet. I'm waiting to see which one of them leaked my data first. No point me running to the regulator before the parties involved have a chance to investigate.
@Edent my gut feeling is some affiliate layer in between possibly.
| Reply to original comment on universeodon.com
It definitely seems to be a persistent problem with booking dot com, as you're far from the first person I've heard this happen to. Makes me very wary of using them.
| Reply to original comment on bsky.app
If only someone was not so …porous… with our data
| Reply to original comment on bsky.app
Earlier this year I got similar a phishing message (well, different wording) when I booked a hotel directly from their own website, without using Booking at all. Around the same time, I received about 50 spam/phishing e-mails.
If I were to suspect, some supplier of software for hotels (i.e. hotel management system) is probably vulnerable.
I faced the exact same situation a year ago in a trip of mine to Taiwan. I also searched the hotel contact details, contacted them and received a message that my reservation was already booked and no further actions required from my side.
Given the commonality of this sort of phishing attack, I'm surprised how Booking.com is still allowed to operate.
| Reply to original comment on libranet.de
My husband got a similar message recently about a booking we have for next year, and in our research we found out that the leak was from the hotels' side, whereby hackers phished hotel employees and got access to the backend of booking software they use (namely Cloudbed, and potentially others). The issue has been ongoing as of December 2024, apparently, and it'll only get more sophisticated as long as those bad actors continue to have access to that backend—I've even seen instances online where the scammers sent a message via the Booking.com interface, so it looks even more legit.
That might be all they get in the request email, but I've seen bookings that have access to phone number and address, so I don't think that's right. Given who it is, a compromise of the hotel's account is the most likely story here.
| Reply to original comment on bsky.app
Neil Lawrence
Yep, very familiar story - same things happened to us last year, although my wife had gone through the steps of making a payment before I managed to spot it. Money returned thanks to it being a credit card payment.
It was the hotel that had been hacked rather than Booking.com in our case, which made us decide never to book at that property/chain again.
More comments on Mastodon.