Booking.com scam: what to do when the property asks you to pay again

How the “payment failed” Booking.com scam works

The “payment failed” Booking.com scam, also called reservation hijacking, is a phishing message sent in the name of a property you really booked, claiming your card was declined and asking you to pay again on a page that imitates Booking.com. Booking.com says on its Trust & Safety page for travelers that it will never ask for credit card details by email, over the phone, by text or on WhatsApp. TrueScreen certifies the message and the page behind the link as they appear on your screen, before anyone can remove them.

The message is convincing because the booking details are real; the payment request is what gives it away.

It arrives in the official reservation chat, on WhatsApp, by SMS or by email. The reservation chat is the most deceptive, since criminals who get into a property’s extranet, the panel hosts use to manage bookings, read guests’ details and write from the real account. A deadline, a threat of cancellation and a fake payment link to a Booking.com clone follow.

Unlike the fake listing in our guide to the vacation rental scam and how to certify the evidence, here the room is real. A genuine prepayment or pre-authorization follows the conditions in your booking confirmation, and Booking.com says it will never ask for a payment outside them.

Signs that the message is fake

• It asks you to enter or “confirm” card details through a link.
• It sets a short deadline and threatens cancellation.
• It moves the conversation to WhatsApp, SMS or email.
• The link points to an address other than booking.com.
• The payment is not in your confirmation’s payment policy.

What the European Commission is investigating under the DSA

On 21 October 2026 the European Commission opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act by not diligently assessing or effectively mitigating the risks of fraudulent listings and phishing scams, according to its press release IP/26/2223. Opening proceedings does not prejudge the outcome and gives no individual traveler a right to a refund. In your own case, TrueScreen certifies the messages and the payment page your bank and the police will want to see.

The investigation looks at the platform’s safeguards and changes nothing about what you need to do today if you have been scammed.

It covers fraudulent listings; Booking.com phishing that exploits reservation and guest data, including how that data is shared with properties and how the messaging service works; and paid “boosted” listings not recognizable as advertising. If proven, the risk failings, phishing included, would breach Articles 34 and 35 of the Digital Services Act; the advertising issue falls under Article 26(1).

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said: “Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”

The proceedings are not a finding that Booking.com broke the law, and the release mentions no fines: if you were scammed, your protection still runs through your bank and the police.

What to do right after the suspicious message

Each step either stops the payment or preserves the proof, and both can slip away within hours.

1. 1

   Don’t reply or pay through the link

   Leave it unanswered and don’t call any number it gives.

2. 2

   Check the reservation in the official app

   Open the Booking.com app and compare the message with the payment policy in your confirmation.

3. 3

   Contact the property through a verified channel

   Use the contact details on the property’s page or the Booking.com Help Center, never those in the message.

4. 4

   Certify the chat and the payment page

   Record the conversation in the TrueScreen App and capture the page behind the link with the Forensic Browser, as the section on certification explains.

5. 5

   Call your bank and block the card

   If you entered card details, call the number on your card and ask the bank to block it and stop pending transactions.

6. 6

   Report it to the police and Booking.com

   File a report with the police or your national fraud reporting service, then report the message from the reservation.

If the payment has already gone: bank, police and platform

Once you have paid, the outcome depends on your bank and the facts of your case, so report quickly and don’t count on a refund.

Disputing the charge with your bank

Disputing a charge means formally contesting a payment with your bank and asking for it to be reversed through its dispute or chargeback process. In the EU and EEA, the Payment Services Directive (PSD2) protects you against unauthorized transactions: you notify the bank without undue delay and within 13 months of the debit (Article 71), the bank must prove the payment was authenticated (Article 72) and refund it by the end of the following business day unless it suspects fraud (Article 73), and your liability is capped at EUR 50 unless you acted fraudulently or with gross negligence (Article 74). TrueScreen certifies the messages and the page you show the bank, but has no say in its decision.

Those protections cover unauthorized payments. If you entered your card details and approved the payment with your bank’s code, the bank may treat it as authorized or argue gross negligence, and a dispute body or a court weighs that case by case. PSD2 covers EU and EEA payments, and national transposition can change the details; outside the EU, use your bank’s or card network’s dispute or chargeback process. Write to the bank at once and keep its payment notifications.

Reporting the scam to the police

Report the scam to the police or your national fraud reporting service, bringing the certified chat and page, your bank statement and the booking confirmation. Our guide on how to report an online scam lists what to include.

Reporting it to Booking.com

Report the message from the reservation, through the Help Center. Booking.com’s Trust & Safety page says such reports reach its dedicated security team.

What evidence to keep, and why a screenshot is not enough

A screenshot is an editable image file that says nothing reliable about where or when it was taken, so on its own it is weak proof of a message the sender can later delete. TrueScreen certifies the conversation and the page at the moment you see them, with an official digital seal and a qualified timestamp, recognized internationally.

Keep whatever shows what you were asked, where the money went and when you reacted, in a form whose integrity can be checked.

Screenshots are still worth keeping, though an image can be altered in minutes, as our guide on how a screenshot can be faked shows. A screenshot you have already taken can still be certified as a file: that fixes its content and date from then on, but cannot show when the messages were sent.

People who need to file a police report or dispute a charge use TrueScreen to certify the message before it disappears.

How do you certify the chat and the payment page?

With TrueScreen, the conversation and the payment page are certified at the moment you see them: a screen recording in the TrueScreen App captures the chat on your phone, the Forensic Browser captures the page behind the link, and each certification carries an official digital seal and a qualified timestamp, recognized internationally.

TrueScreen guarantees the how, not the what: it shows how and when the content was captured and that it has not been altered, not whether it is true.

It does not identify who wrote the message, guarantee a refund or any outcome, or replace a police report. Evidence captured with TrueScreen has a provable date and verifiable integrity, and your bank, the police or a court assesses it freely.

From your phone

Start a screen recording in the TrueScreen App, open the reservation chat or WhatsApp and scroll slowly down to the link. Before you stop, go back to the TrueScreen App: it shows a verification code on screen that the recording captures, which shows the video was recorded from your own device’s screen. When you tap Stop, the app checks it and preselects frames for the report. Long chats may need several recordings; screens an app protects from capture come out black.

From your computer

The Forensic Browser is a desktop application for macOS and Windows that captures WhatsApp Web or the Booking.com website chat and can also capture network traffic and attachments. For each payment page you get an image of the page and an archive with its source code, plus the site’s certificates and a clock check. Open the link only to document it and type in nothing; our guide to capturing evidence from phishing clone sites goes further.

An illustrative example, not a customer case: a traveler is told in the reservation chat that her card was declined and she has 12 hours to pay. She records the chat in the TrueScreen App and opens the link in the Forensic Browser. By morning the message has gone, but her certification is ready for the police and the bank.

Properties and hosts: proving you did not send those messages

A property whose Booking.com account has been compromised needs to show that the payment requests did not come from its staff, by documenting the messages sent from the account, alerts about unusual logins and its warnings to guests. A property can certify the reservation chat and its messages to guests with TrueScreen, documenting what left its account and when.

For a host the damage is double: guests lose money, and the property is blamed for messages it never wrote.

Certify the messages sent from your account before they are deleted and report the incident through the Booking.com partner channel, never through an emailed link. Warn upcoming guests not to pay through links, certify those warnings, and turn on two-factor authentication for the extranet.

Conclusion