Agoda

Is Agoda safe?

For booking a room or a flight, Agoda is reasonably safe: we found no report of a breach of its own systems, it pays outside researchers to find security bugs, and it offers two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. The risks are in the fine print and in the chat. In July 2026 Korea fined Agoda about US$1.7 million for hiding flight refund terms and leaving a surcharge out of its pay-later prices. And like its sister site Booking.com, it has hotel partners whose accounts criminals take over to message guests. We score Agoda 52/100.

What Korea found in 2026

Korea's media and communications regulator opened an investigation in September 2024 and announced its decision in early July 2026: a fine of ₩2.424 billion, about US$1.7 million, under the Telecommunications Business Act. It made two main findings.

The first concerned flights. Notices that a ticket could not be refunded or changed appeared only after a click on a link labelled as the baggage allowance policy, not on the main booking screen. The second concerned "Pay Later". The price shown as the current rate left out an adjustment of up to 5% that was charged when the payment went through, sometimes in a foreign currency and described only as "5% adjustment included". The regulator also ordered Agoda to change its booking flow so that final totals, refund rules and fees are clear.

Complaints had been climbing before the decision. SBS reported that relief applications against Agoda at the Korea Consumer Agency rose from 131 in 2022 to 620 in 2024.

This is not a one-off. In 2023 the Texas attorney general sued Agoda's parent, Booking Holdings, and listed agoda.com among the group's sites that advertised hotel rates without mandatory fees, which appeared only at checkout. Booking Holdings settled in August 2025 for US$9.5 million and agreed to show such fees up front. The attorney general's announcement named Booking.com, Priceline.com and Kayak.com; the petition also listed agoda.com.

In 2022 Korea's Fair Trade Commission fined Agoda ₩2.5 million for labelling paid search placements with vague names such as "Agoda Growth Program", which customers could take for a quality ranking. In 2019 Agoda was one of six booking sites that gave formal undertakings to the UK Competition and Markets Authority after its investigation into pressure selling, misleading discounts, hidden charges and commission-driven rankings.

Fake messages from real hotels

Agoda's guests face the same scam as Booking.com's, on a smaller documented scale. Criminals send hotel staff phishing emails or malware, often disguised as a guest asking the hotel to open a file. Once inside the hotel's account they see upcoming bookings and write to guests, usually saying a card payment failed and the booking will be cancelled unless they pay through a link.

On its partner site, Agoda says it has seen "targeted phishing emails and malware attacks against some of our hotel partners". It also says the breach "was not on Agoda's platform" and its own systems were not compromised. That distinction matters for Agoda's security record. It matters less to a guest, because the message can arrive through the genuine booking chat with the correct hotel name and dates. Agoda tells hotels to turn on multi-factor login for the partner portal, using a phone rather than email.

What the app collects

Apple's privacy label is fairly broad. Identifiers are used to track you across other companies' apps and websites. Linked to your identity are purchases, payment info, name, email, phone number and address, photos or videos, search history, usage data and diagnostics. Unlike Klook, the label does not list location.

The privacy policy, updated in September 2026, goes further than the label. Agoda collects passport or national ID details for some bookings, and tax IDs where local law requires them. It shares one-way hashed information with advertising partners, naming Meta and Google, so they can show you Agoda ads elsewhere. It also links browsers and devices that may belong to the same person. It exchanges data with Booking Holdings companies for fraud checks. Its AI travel assistant passes your chats and past bookings to third-party language models to build a travel profile. You can ask for access, deletion and a portable copy through [email protected]. The policy says Agoda verifies your identity before it answers.

Security basics

Agoda runs a public bug bounty on HackerOne, and its security.txt file points researchers there. It says it follows the PCI DSS card security standard. Two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary is available but off by default, and Agoda's own policy recommends turning it on. We found no report of a mass breach of Agoda customer accounts. The weak link is hotel partners, not Agoda's own servers.

How to book on Agoda more safely

1. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary in your account settings.
2. Never pay through a link sent in a message, even one in the Agoda chat. Open the booking in the app to check its status.
3. Before you choose Pay Later, check the final amount and currency on the payment summary.
4. For flights, find the refund and change rules before you pay. If you cannot see them, assume the fare is non-refundable.
5. If you typed card details into a suspicious page, call your bank at once to block the card.

How we scored it

Security (58) is the strongest factor: no known breach of Agoda's own systems, a paid bug bounty and optional two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. Transparency and control (48) is the weakest, because a regulator found refund terms and surcharges hidden in the booking flow. The regulatory record (52) rests on two mid-sized consumer penalties, the Korean fine and the Texas hidden-fee settlement, plus a small earlier fine and UK undertakings. Booking.com, which shares Agoda's parent, scores 47 and Trip.com 52.