Fake Booking.com payment requests: what a hotel can do

What is going on

In August 2025 the Centre for Cybersecurity Belgium (CCB) warned hotels about a phishing attack that is believed to run through Booking.com and through the accounts of hotels and other accommodation providers (CCB, Safeonweb@work). Guests receive a payment request, through Booking.com or by email, that mentions their name, their arrival and departure dates and the reservation number. Because those details are correct, the message seems to come from the hotel.

The CCB did not say how the criminals get into those accounts. Microsoft has described a campaign that can give criminals that access, although Microsoft does not link it to the CCB warning (Microsoft Threat Intelligence, 13 March 2025). From December 2024, and still running in February 2025, it targeted hotel staff likely to work with Booking.com, in Europe among other regions. The emails were about a negative guest review, a question from a prospective guest, an online promotion or an account check. A link, sometimes inside a PDF, led to a fake "prove you are human" page. It asked the employee to press a key combination that opens the Windows Run box, then paste a command and run it. That command downloaded malware that steals login details and financial data; some versions also let the criminal control the computer remotely.

What Booking.com says it never asks

Booking.com writes that it will never ask travellers to share credit card details by email, phone, text or WhatsApp, and never asks them for a bank transfer that differs from the payment policy in their booking confirmation (Booking.com, safety tips for travellers). To accommodation partners it writes that its partner service staff would not ask for the password of your Booking.com account or for card numbers, and only ever ask for your property ID (Booking.com, safety tips for partners).

That gives reception a clear line when a guest calls: a request for card details by message, or for a transfer that differs from the booking confirmation, is not genuine. If a request looks right but the guest is unsure, they call the hotel on the number in the confirmation before paying. Check first whether your hotel itself sends payment links, for example for prepaid rates, so that staff do not deny a real one.

What the hotel does beforehand

1. Turn on two-step login for every hotel account, starting with the mailbox, as the CCB advises. Booking.com also asks partners to turn it on for their Booking.com account.
2. Tell your staff that no genuine website asks you to press keys and paste something to prove you are human. Whoever sees such a page closes it and tells the manager.
3. Open messages about reviews, complaints or account problems in the Booking.com extranet itself, not through a link or attachment in an email.

When a guest calls about a suspicious payment request

• Ask the guest not to pay and not to click the link.
• Go through what the booking confirmation says about payment with the guest.
• From a different device you trust, change the passwords of the mailbox and the Booking.com account, sign out all other sessions and check that two-step login is on. Have the computer that opened the email checked before it is used again, because the malware can capture new passwords too.
• Report the incident to Booking.com straight away.
• Tell guests with current reservations that fake messages are going around, and give them an email address or phone number where they can safely reach you, as the CCB advises.
• Forward the message to suspicious@safeonweb.be and report the incident to the local police, as the CCB advises.
• If the guest has already paid, advise them to call their own bank straight away.

Practise this with your team

Our page for hotels shows how this fits with the rest of a hotel's network and accounts. In a workshop for a hotel we use this example to show how to secure the accounts and what reception says when a guest calls.