Holiday Let Owner Scammed Via Booking.com, Highlighting Online Safety Concerns

The owner of a small property management firm, Victoria Pollard, has described herself as "devastated and exhausted" after thousands of fraudulent property reservations were advertised using her company's name on Booking.com. The phishing attack left Pollard, who runs Exeter-based Life's 2 Short, without access to her accounts for a significant period in August, resulting in missed genuine reservations.

Some individuals who made these fake bookings had traveled from overseas and arrived to find no accommodation available. Pollard explained that disappointed guests, believing she was responsible for the non-existent properties, subjected her business to "horrendous" online abuse. She reported receiving "20 to 30 calls a minute" at one point and dedicated up to 12 hours daily to addressing the crisis, forcing her to put her phone on airplane mode.

Booking.com has apologized for the incident, stating it is offering "full support" to Pollard. The company confirmed that all affected listings were removed and that customers were offered "relocations, refunds or free cancellations." An investigation by Booking.com indicated that the property was likely targeted by cybercriminals through a sophisticated phishing attack that compromised Pollard's computer systems and led to temporary unauthorized access to her account on the platform.

This incident echoes broader concerns about online safety and platform accountability. Kat Cereda, a consumer expert at Which?, noted that while such events might be expected to be rare, they are unfortunately common. Cereda pointed to a previous instance where Which? listed 10 Downing Street as a holiday rental, which the platform failed to identify as a spoof. This, she argued, suggests that scam listings and phishing attacks can easily bypass platform defenses when even obvious fake listings are not flagged.

Cereda called on the Prime Minister to direct Ofcom to utilize the Online Safety Act to implement stricter regulations. In response to the 10 Downing Street listing incident, Booking.com stated that the "limited test is not a true reflection of the experience of millions of listings or reviews published on our platform." The company explained that because the listing was not actively "live" on its site for an extended period, some automatic fraud controls were not triggered.

A government spokesperson affirmed that online platforms covered by the Online Safety Act, including Booking.com, have a legal obligation to prevent their sites from being used for scams and must remove such content. The spokesperson added that platforms failing to protect users from illegal fraudulent content could face penalties, including fines, and that regulators have the government's full backing to take action. Booking.com reiterated its commitment to supporting affected customers with relocations, refunds, or free cancellations.