For: anyone who has booked accommodation on Booking.com — upcoming or past stays. This article is based on Booking.com's notice to guests and its spokesperson's statements (as published by news outlets) and the company's official safety guidance. It does not cover attack methods.
What guests should do today
Don't open the link, don't pay on the spot
"Re-confirm your card to keep your reservation." "Pay within 24 hours or your booking will be cancelled." Booking.com's safety guidance names these urgent requests to (re)share payment information as the typical pattern, and warns that such messages often include convincing details about the dates and cost of your stay.
That applies to email, text, WhatsApp and phone calls alike. First: don't open the link, don't type anything, don't pay. You'll check it yourself in the next steps.
Open the official app yourself and look at the booking's payment policy
Don't follow the message's link. Open the Booking.com app from your home screen (or the official site from your own bookmark) and go to your booking. Look at the payment policy in the confirmation: whether prepayment is required, how you pay, and any damage deposit.
Booking.com says it will never ask for a bank transfer that differs from the payment policy in your booking confirmation, and never ask you to share card details by email, phone, text or WhatsApp.
If the request isn't in the policy, that alone is enough to call it a scam
Compare. If the message asks for any of the following, don't do it, no matter how accurate the rest is:
- a prepayment the policy doesn't mention
- re-entry of your card details
- payment on an outside site
- a transfer to a personal account
- payment in gift cards
Booking.com states plainly: if you're asked to pay for something that isn't in the policy, don't send it, and no legitimate transaction requires gift cards. If a property insists on moving the conversation off the Booking.com platform, the company recommends contacting customer service.
When unsure, ask customer service from inside the app
If you can't decide, contact customer service through the app or the official website, never through a phone number or link in the message.
According to Booking.com, customer service will only ever ask for your reservation ID and reservation PIN, and will never ask for your account password or card number. If your booking's PIN was updated in this incident, check the new PIN in the app.
Already entered your details? Call your card issuer, tell Booking.com, change your password
Booking.com's guidance has three parts:
- contact customer service immediately and report that you may have been scammed
- reset your account password and enable two-factor authentication
- contact your bank or payment provider to block the card, issue a new one, and flag any charges you don't recognize
Your local consumer or fraud reporting service can also help.
Turn on two-factor authentication and stop reusing passwords
Passwords are not listed in the notice. But someone who knows your booking can still send a "log in to check your reservation" message.
With two-factor authentication, typing your password into the wrong page does not immediately hand over your account (see choosing multi-factor authentication). If you reuse the password elsewhere, split it up with a password manager.
① A message claiming to be the property or Booking.com arrives
Correct hotel, dates, price, name → don't decide here
↓
② Skip the link, open the official app yourself
Your booking → payment policy (prepayment, payment method, deposit)
↓
③-A Not in the policy
Card re-entry / pay via link / transfer / gift cards → refuse. Ask from inside the app if worried
③-B Matches the policy
Pay through the app's own flow. Still don't use the message's link
What happened (from Booking.com's notice and statements)
The following is based on Booking.com's email notice to guests and its spokesperson's statements, as published by news outlets. As far as this site could check on September 30, 2026, Booking.com's own website and newsroom carry no dedicated notice about the incident.
- What happened
- It noticed suspicious activity involving unauthorized third parties being able to access some guests' booking information
- Information possibly accessed
- Per the notice: booking details, names, email addresses, phone numbers, addresses, and information shared with the property through the platform (outlets describe the "addresses" item differently)
- Financial information
- The spokesperson said it was not accessed
- Company response
- After discovering the activity it took action to contain the issue, updated the PINs of the affected reservations and emailed the guests
- Scale
- Not disclosed (the company says affected guests were notified individually)
- Timing and cause
- Not disclosed
How to read it: more is unknown than known
Booking.com has not said how many guests were affected, since when the access occurred, or where the data was taken from. Some coverage adds its own theories; this article treats only what the company confirmed as fact.
Even if you received no notice, respond to any message that seems to know your booking with the steps above. The defense is the same whether or not you were affected.
Why correct booking details prove nothing
Checks that no longer work
- The hotel, dates and price are right → probably real
- They know my name and phone number → must be the property
- They mention the exact room I booked → trustworthy
The check that still works
- Only ask: does the request match the payment policy?
- Check inside the official app you opened yourself
- Card re-entry, payment via a link, off-policy transfers: refuse, however accurate the message is
When deciding whether a message from a booking site is real, most people unconsciously ask: does it know things only I and the site should know? The hotel, the dates, the price, how many guests. Until now that mostly worked.
This time, what Booking.com acknowledged includes booking details and messages with properties. In other words, the very clues people rely on may now be in a third party's hands.
Booking.com's own safety guidance explains that an attack compromising traveller data may be used for fraud such as phishing via WhatsApp, phone or email.
This site's view: judge by what's being asked, not where it came from
Common advice for spotting impersonation is "check the sender's address" or "messages inside the official app are safe". Both are useful signals, but neither is decisive. Booking.com's guidance itself says such messages most often claim to come from the accommodation, and sometimes even from Booking.com.
Stop judging by who the sender seems to be or how the message arrived, and judge by the request. Payment terms for a booked stay almost never change, and they are written in the booking confirmation.
The rule if they ask for a payment the confirmation doesn't show, don't pay works no matter how much the other side knows and no matter which channel the message arrives through. It's the one rule worth sharing with family and travel companions.
For an overseas breach this year that included government ID numbers, see the Odido data breach in the Netherlands; for a Japanese case where identity-document images leaked, see the Times Car breach. Connectivity risks while travelling are covered in the dangers of public Wi-Fi.
Sources (public record)
The facts in this article are based on the public information below. The number affected, timing and cause, which Booking.com has not disclosed, are not guessed at.
- Booking.com, "Safety tips for travellers" (official safety guidance) — booking.com
- BleepingComputer (April 13, 2026: reproduces the notice to guests and the spokesperson's statement) — bleepingcomputer.com
- TechCrunch (April 13, 2026: spokesperson says it contained the issue, updated PINs and informed guests) — techcrunch.com
- ABC News (April 13, 2026: data items listed in the notice, and the spokesperson's statement that financial information was not accessed) — abc.net.au
Update history
2026-09-30: First version, based on Booking.com's notice to guests and spokesperson statements (published in April 2026 coverage) and its official safety guidance. Will be updated if the scale or cause is disclosed.
Read next
- Other overseas cases from October 2026: Florida DOE / iRhythm / Frontline Education / Covered California / University of Copenhagen / ENGIE / Bithumb / ConnectWise / Navigate360 P3 / Bitget / Double Counter / ASOS
- Same pattern in Japan: Temairazu (hotel channel manager)
- A case at a Japanese booking site, with overseas hotel bookings and partial card data affected: Rakuten Travel unauthorized access (up to about 2.6 million records)
- Another travel-booking case: Manchester Airports Group (parking and lounge bookings)
- Unauthorized access at an airline passenger service system vendor: JAL, JTA and ANA booking data (about 92,000 people)
- Scam messages: What is phishing? / Fake virus warnings (tech-support scams)
- Protecting your account: Choosing multi-factor authentication / Choosing a password manager
- While travelling: The dangers of public Wi-Fi / Securing a laptop you carry around
- Other 2026 incidents: The Odido data breach / The Times Car breach / List of breaches and cyberattacks (Japan and worldwide)
- Overseas cases in late October: Cloudflare Workers AI (other customers' data in responses) / Tampered extension on Cursor / Photon Health