Booking.com

Is Booking.com safe?

Booking a room on Booking.com is safe; trusting every message that follows is not. The app itself has no record of a mass account breach, and a reservation paid through it is a normal contract with the hotel. The trouble starts when a criminal gets into a hotel's Booking.com account, sees the real names, dates and phone numbers of upcoming guests and writes to them in the official chat. That scam has run for years, a data incident in April 2026 fed it fresh details, and on 21 October 2026 the European Commission opened formal proceedings under the Digital Services Act. We score Booking.com 47/100.

The hotel-account scam

The pattern is consistent across warnings from police and cyber agencies. A guest receives a message, in the Booking.com app or by WhatsApp or email, that names the right hotel and dates. It says the card payment failed or must be "verified", and that the booking will be cancelled unless the guest pays through a link within a few hours. The link leads to a convincing copy of a payment page.

Because the message often comes through the genuine chat, the usual advice to check the sender does not help. Switzerland's National Cyber Security Centre described this "account takeover via hacked hotel systems" in June 2026 as long known. It also reported a newer variant: WhatsApp messages offering a refund for a supposed booking error, which lead to a fake bank page. UK Action Fraud recorded 532 reports of Booking.com-related scams of this kind between June 2023 and September 2024, with losses of about £370,000.

The method behind the break-ins is phishing aimed at hotel staff. In a case that came to light in January 2019, criminals phoned employees at 40 hotels in the United Arab Emirates, obtained their logins and read the bookings of 4,109 guests, including card details for 283 of them. The Dutch data protection authority fined Booking.com €475,000 because it reported the breach 22 days after the 72-hour deadline. Booking.com did not appeal.

What happened in April 2026

Booking.com began notifying customers on 13 April 2026 that "unauthorized third parties" had accessed guest reservation data, according to Malwarebytes. The data included booking details, names, email and postal addresses and phone numbers. Hong Kong's HKCERT added messages between guests and properties to that list. Reports put the source in compromised hotel partner accounts rather than Booking.com's own customer logins, and we found no report that card numbers stored by Booking.com were taken. The company has not published a number of people affected.

For a guest the distinction matters little. The data a scammer needs to sound like your hotel is exactly the data that leaked.

Privacy: a thin label and a long policy

Apple's privacy label for the app is unusually short. It lists only device identifiers, marked as used to track you across other companies' apps and websites, and says no data is linked to your identity. Apple notes that labels are the developer's own statement and are not verified.

The privacy statement describes far more. Booking.com passes your name, contact and, unless you pay Booking.com directly, card details to the property. It may ask for a passport scan and a selfie for a verified badge. It shares data with other Booking Holdings companies, such as Agoda and OpenTable, and matches hashed email addresses and phone numbers with advertising partners, including Google. It offers access, erasure, portability and objection rights under the GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary. We score privacy on what the policy says, not on the label.

The group also publishes the Rentalcars.com car-hire app, under Booking.com Transport Limited. It is a separate app with its own store listing, so this score does not cover it.

Fines and EU oversight

The penalty that concerns guests most directly came from Texas. In 2023 the state's attorney general sued Booking Holdings, saying booking.com and its sister sites advertised room rates that left out mandatory resort and similar fees, then added them at checkout inside a single "Taxes and Fees" line. Booking Holdings settled in August 2025 for US$9.5 million and agreed to show such fees up front. The attorney general called it the largest amount a state had recovered over hidden hotel fees.

The biggest penalty is about hotels, not guests. On 30 July 2024 Spain's competition authority, the CNMC, fined Booking.com €413.24 million for abusing its dominant position since at least 2019. Its findings included a clause stopping hotels from selling rooms more cheaply on their own sites and a ranking system that pushed hotels to rely on Booking.com. Booking.com appealed on 30 October 2024, and in early 2025 Spain's National High Court suspended the fine until it rules.

The EU designated Booking as a gatekeeper under the Digital Markets Act on 13 May 2024. Since 14 November 2024 the DMA has banned those price parity clauses across the EU. The new DSA case goes further. The Commission will examine fake and non-compliant listings, the risk that data shared with hotels and the messaging service enable phishing, and whether paid "boosted" listings are clearly marked as ads. Opening proceedings does not mean Booking.com broke the law. A breach of the DSA can lead to fines of up to 6% of worldwide turnover.

How to book more safely

1. Treat any request to re-enter card details through a link as a scam, even inside the Booking.com chat.
2. Check payment status yourself: open the booking in the app, not from a message.
3. Call the hotel on a number from its own website, not one sent to you.
4. Where you can, choose to pay Booking.com online, so the hotel never gets your card details.
5. If you entered card details on a suspicious page, call your bank straight away to block the card.

How we scored it

Scams and harmful content (40) and security (44) are the weakest factors. Both reflect the same flaw: guest data that hotels can reach is a constant phishing target, and Booking.com's chat delivers those messages. Transparency and control (55) is the strongest factor, thanks to a clear policy and full GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary rights. The regulatory record (45) carries the US$9.5 million Texas settlement over hidden fees, the Dutch GDPR fine and an open EU case; the suspended Spanish fine counts for less because it is a competition case about hotels, not a privacy or consumer ruling. Airbnb, where most fraud happens off the platform, scores 60. Trip.com scores 52.