On October 21, the European Commission opened proceedings examining Booking.com’s handling of fraudulent listings and phishing involving reservation and guest data. This is an investigation, not a finding of wrongdoing. Criminals can compromise accommodation accounts and send convincing payment requests containing genuine reservation details even through legitimate messaging channels. Knowing the hotel name and travel dates does not authenticate the sender. Travelers should open their reservation independently, verify unexpected payment requests through separately obtained contact details, and contact their card issuer promptly if they paid.
The following blog article explains why an authentic reservation and familiar messaging interface cannot guarantee that a payment request is safe:
https://www.bitdefender.com/en-us/blog/hotforsecurity/eu-booking-com-phishing-scams-investigation
