Two years after initially reporting a major security breach, Booking.com travelers are still receiving scam messages from fraudsters who have gained access to the platform's internal systems.
The ongoing issue came to light again when a traveler who first posted about the breach in 2024 reported they're still receiving fraudulent messages in 2026, suggesting the platform's security vulnerabilities remain unpatched or that leaked data continues to circulate.
The scam typically works like this: After booking accommodation through Booking.com, travelers receive official-looking messages through the platform's messaging system claiming there's an issue with their payment or reservation. The messages, which appear to come from within Booking.com's system, direct users to click links or provide additional payment information.
Because the messages come through Booking.com's official channels rather than external email, many travelers assume they're legitimate correspondence from their accommodation or the platform itself.
A Security Failure, Not Just Old News
What makes this particularly concerning is the timeline. Data breaches typically result in immediate exploitation followed by declining activity as leaked information becomes stale. The fact that travelers continue reporting these scams two years later suggests either ongoing unauthorized access to Booking.com's systems or that the original breach was substantial enough that fraudsters are still working through the stolen data.
For travelers booking summer 2026 accommodations, this represents an active threat. With peak travel season approaching, millions of users will be making reservations and could potentially receive these fraudulent messages.
Security experts recommend several protective measures:
• Never click payment links sent via messaging systems - Legitimate accommodation providers and booking platforms will not ask you to re-enter payment information through chat links
• Verify directly - If you receive any message claiming there's an issue with your booking, contact the accommodation provider or Booking.com directly through their official website or phone number, not through links in messages
• Monitor your accounts - Check your credit card and bank statements regularly for unauthorized charges after booking travel
