Yzabelle Bostyn
BRITISH tourists are warning holidaymakers after a Booking.com scam saw them lose thousands to fraudsters.
Unfortunate sun seekers have seen their holiday plans ruined after falling victim to a scam on Booking.com this summer.
The scam has been running for over a year, but the number of reports have spiked during the summer months.
It sees customers duped into paying scammers to ‘confirm’ legitimate hotel reservations made on the holiday booking website.
In some instances, victims have turned over thousands of pounds.
One of these victims was Mick Thomas, 77.
He and his wife were going to set off from Evesham, Worcestershire on a road trip around Europe.
Mick had booked a hotel at their first destination, Amsterdam, for early September, for which he had agreed to pay just before arriving.
However, he received a message in July on Booking.com asking him to follow a link and pay €1,001 to confirm his booking (£848.95 at the time).
He said: “I received a message supposedly from the hotel, via Booking.com, asking for my card details, it said failure to do so meant that my booking may be annulled.”
Despite clicking the link twice, it didn’t work so he checked his account.
To his surprise, he found £1,697.90 had been paid and suspected a scam.
He quickly contacted Booking.com and his bank, Monzo.
They froze his card and began investigating the fraud.
Despite showing as ‘pending’ and freezing the card, the payment still went through.
Monzo began an investigation which it claimed could take up to six weeks.
As reported by This is Money, once the news outlet got in touch to inquire about the report, the entire sum was refunded.
A Monzo spokesman said: “Falling victim to fraud is distressing and we’re sorry it happened to our customer. This was a sophisticated scam where the communication through a booking platform was compromised by fraudsters.
“Though this happened outside Monzo, we’ve reimbursed our customer so they aren’t left out of pocket.”
According to Booking.com’s chief information security officer, Marnie Wilking, the number of scams carried out on the platform have increased by 500-900% in the past 18 months.
The messages, sent via the platform’s internal messaging system, claims guests must pay an extra fee to secure their booking and invites them to click a link to a third-party website to pay.
The money then goes directly to the scammers.
Because the scam works inside Booking.com’s internal messaging system, they are more likely to believe the request is legitimate.
This is Money claims they received many reports from customers who have also received messages.
Following the scam, Booking.com has faced calls to increase its security.
But fraud experts claim the company is not compromised.
Rather, criminals are accessing the accounts owned by hotels.
They target small, often family run hotels and Airbnb-style rentals with little-to no cyber security budget.
This is Money spoke to scam expert, Jake Moore of Eset cyber security firm.
He said it is likely the hotels are being tricked into installing malware which gives criminals access to their computers.
Often, the scammers pose as customers in order to trick staff into opening an attachment or clicking a link.
For instance, Moore said a hotel got an email from a supposed ‘former guest’ saying they had accidentally left medication behind.
They then attached a document with the ‘details of their medication’ which was actually a malware installer.
Although Booking.com does use security measures such as two-factor authentication, hotels often stay logged into their device, allowing criminals to bypass that layer of security.
He advises holidaymakers to never leave the Booking.com messaging portal as well as being aware of the payment conditions already agreed.
The platform now has a warning within the messaging system reading: “Avoid suspicious activity – do not click on or respond to unusual links or messages.”
This is Money helps customers to secure refunds, such as Kelly, who lost £3,138 after paying scammers posing as the owners of a Mallorca villa.
Similarly, Rachel Bolton, an expat living in Spain, was planning on going on a cruise around the Greek Islands.
She booked a hotel for the night before the cruise but was scammed out of €336 despite having already paid for the reservation.
Later, she received a message from the hotel saying some customers’ credit card details were stolen and hers was among them.
A few days after the incident, the fraudsters attempted to take more money, but luckily she had frozen her card.
According to a Booking.com spokesperson: “Phishing attacks by professional criminals pose a significant challenge for travel and many other industries. While not unique to Booking.com, we continue to invest significantly to limit the impact of scams, using the latest technology and innovations.
“We are also committed to proactively helping our accommodation partners and customers to stay protected.
“A lot of this is via education, informing our partners of the types of scams we are seeing – through regular and as-needed communications, face-to-face workshops, and a dedicated cyber-security advice hub – while arming our customers with practical advice that they can apply as they search for their holiday.
“We are sorry to hear about the experiences of the customers you have brought to our attention and we are reaching out to each to ensure they are not left out of pocket.”
READ MORE: Razor blade scammers looked for €1m bonanza by selling top ‘brand name’ imported fakes in Spain
