A data breach at Booking.com means people should be wary of clicking on links sent via WhatsApp, email or SMS.
Mateusz Slodkowski/SOPA Images/LightRocket via Getty Images
This week, I received an email from Booking.com warning me that “unauthorised third parties may have been able to access certain booking information associated with your reservation”.
This appears to be part of a global breach of the Booking.com site, and according to the platform, the information that has been compromised includes booking details and name(s), emails, addresses, phone numbers associated with the booking, and anything you may have shared with the accommodation.
With all the necessary information, such as booking details, name, phone number, and email address, it would be very easy for a criminal syndicate to impersonate Booking.com.
Scams involving Booking.com have been prolific, though in most cases they stem from a breach of security on the accommodation provider platform and then using the details to contact customers.
A common scam is for the criminal actor to pose as Booking.com or the accommodation provider by sending a WhatsApp or email confirming the reservation and asking the victim to update their payment details or make payment by clicking a link.
This is the second major data breach involving Booking.com. In 2020 the Dutch Supervisory Authority (SA) imposed a €475 000 fine on Booking.com because the company took too long to report a data breach that occurred in December 2018. According to the European Data Protection Board, the telephone scam targeted 40 hotels in the United Arab Emirates (UAE), where criminals persuaded hotel staff to reveal the login details for their accounts in a Booking.com system, accessing the data of 4 109 people who had booked a hotel room in the UAE. The data included their names, addresses and telephone numbers, as well as details of their booking.
Booking.com has reminded clients that it will never ask you to share credit card details by email, over the phone or through text or WhatsApp messages. It will also not ask you to make a bank transfer that is different from the payment policy details in your booking confirmation.
Booking.com has issued new PINs for the reservations, but the best policy is to treat any communication that is not via the app as suspicious. Never click on any links sent to you via email, WhatsApp or text.
If you wish to verify your booking, do so in the Booking.com app.
