Hotels & Lodging · Online travel agency · Data breach
Booking.com (Booking Holdings)
Headline
The most effective scam in travel runs through Booking.com's own legitimate messaging channel: criminals compromise a hotel's partner account, then message guests from inside the real system, referencing the real…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The most effective scam in travel runs through Booking.com's own legitimate messaging channel: criminals compromise a hotel's partner account, then message guests from inside the real system, referencing the real booking, asking for card details to 'confirm' the reservation. Every signal a consumer is taught to check — correct sender, correct reference number, correct property — is genuine, because the attacker is using the hotel's actual account. Booking Holdings also owns Priceline, Agoda, Kayak and OpenTable, so hotel, flight and restaurant reservation data consolidate under one parent.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Netherlands-governed terms for much of the business; EU consumers hold GDPR rights and access to supervisory authorities rather than arbitration.
Data sharing
Dutch-controlled entity, so GDPR applies at the controller level for a large share of processing. Booking Holdings also owns Priceline, Agoda, Kayak and OpenTable — meaning restaurant reservation data and flight search data sit under the same corporate roof as hotel bookings.
Fees and billing
Commission structures and 'rate parity' clauses have been the subject of major EU competition enforcement, and the EU designated Booking.com a gatekeeper under the Digital Markets Act.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.booking.com/content/privacy.html | Not fetched yet | N |
| Terms of service https://www.booking.com/content/terms.html | Not fetched yet | N |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.