Booking.com host scams: how to avoid falling for them

Anyone who lists on Booking.com learns early that most bookings go smoothly. But Booking.com host scams are real, and they aim at a specific target: you, the host. Contrary to what many people assume, the most common one does not start with a dishonest guest at the front door. It lands in your inbox, polite, carrying the platform logo and an urgent subject line about a reservation.

The script repeats itself and has a single root: getting you out of the official environment. On Airbnb, the usual vector is a guest asking to close the deal off the platform, and the mechanics there are different. On Booking.com, communication with partners runs through email, the management panel lives on the web and, for many listings, the payment passes through your hands. Each of those three doors becomes bait.

This guide covers the scams that target hosts on Booking.com, why phishing tops the list, what the platform never asks for and the protocol for reacting without losing your account or your money. Almost every scam fails once you stop reacting in a panic and start recognizing the script before you reply.

Key takeaways

• Email phishing is the number one scam against hosts on Booking.com, not the guest at the door.
• Booking.com never asks for your password, a fee to release a payout or a command pasted into your computer.
• Outside official payments, a fake receipt or a stolen card takes your money with no recourse.
• Two habits remove most of the risk: turning on two-factor authentication and typing the extranet URL yourself.

Which Booking.com scams target the host?

Scams that target hosts on Booking.com revolve around five scripts, and the first one accounts for the biggest share. Email phishing heads the list: a message imitates Booking.com and tries to steal access to your partner account. Next comes the request to pay outside the platform, then the fake payment receipt, the fraudulent booking and the stolen card that turns into a chargeback. All of them bet on your hurry and your wish not to lose the dates.

The chart ranks the five scripts from the one that shows up most to the one that shows up least in a host's day to day.

Notice the thread that runs through the whole list. The criminal rarely invents anything new. He counts on your rush to fill the calendar and on the trust that a message with the platform's brand inspires. Whether a host falls for it or not depends far more on protocol than on luck. Hosts with volume notice that the booking that seemed to save the weekend was only a pretext to extract money or access to the extranet. Read what the message asks for, not how urgent it sounds. Whenever it pushes you away from the extranet, towards a one-off bank transfer or an odd link, the script has already given itself away, however polished it looks. Recognizing that move is worth more than memorizing every new variant of the scam.

Why is phishing the number one scam on Booking.com?

Phishing leads because Booking.com talks to its partners through exactly the channels the scam imitates. Phishing is fraud in which someone poses as a trusted company, by email or message, to steal your login, your data or your money. In practice, an email with the Booking.com brand is the easiest door to force, because you already expect booking notifications to arrive there.

The extranet is the name of the Booking.com partner panel, where you manage calendar, rates, bookings and bank details. It is the safe of your operation. Whoever steals your extranet password does not even need to set foot in the property: they can message guests in your name, change the payout account and scam your guests using your credibility.

This is not a theoretical threat. Since late 2024, Microsoft has tracked a phishing campaign that impersonates Booking.com and targets hospitality businesses worldwide. The emails use familiar bait: a new guest message, a last-minute booking, a negative review or an account verification request. Some lead to a tactic called ClickFix, which shows a fake error and asks you to paste a command into your computer, installing a program that steals passwords. With the credentials in hand, the criminal contacts your guests asking for payment, and the damage spills onto your reputation.

Phishing arrives through more than one channel, but one of them carries most of the volume. The chart shows where the bait usually comes in.

What does Booking.com never ask a host for?

Booking.com never asks for your password, never charges a fee to release a payout and never tells you to run a command on your computer. Keep that sentence in mind: it knocks out most attempts before you even look at the sender. If the message asks for any of these things, it is a scam, however perfect the logo and however friendly the tone.

The table separates the suspicious request from what is really behind it.

The strongest technical defense against credential theft is free and takes two minutes. Two-factor authentication is the feature that requires a second code, on top of the password, to log in. With it switched on, a password stolen through a fake link is not enough to break into the extranet. The Booking.com partner security center itself recommends turning it on and stresses that the platform does not ask for passwords by email. Turn it on today, before you need it.

Why is accepting payment outside the platform the gateway to fraud?

Accepting payment outside the platform opens the door to fraud because, without Booking.com's payment system, you become the cashier and take on all the risk. Booking.com was built for hotels, so many bookings do not require payment upfront: the guest books with free cancellation and pays on arrival. When the money passes through your hands, there is room for three classic frauds.

The first is the fake receipt. The supposed guest books for a day or two later, sends a transfer receipt and asks to check in before the money clears. The receipt is an edited image, the money never arrives, and you find out too late. The second is the stolen card. A chargeback is the reversal the cardholder asks their bank for to cancel a charge. With a stolen card, the stay happens and the reversal comes afterwards, leaving you without the amount. The third is the fraudulent booking, made only to test access or harvest data.

The pattern that gives these three away is always the same: hurry and a short lead time. The criminal sets the arrival for very soon, before any transfer can clear, and insists on settling things off the platform. One simple habit kills the fake receipt: never hand over the key against a receipt, only against money actually credited to your account. Since a bank transfer can take business days to clear, a Friday booking that has "already been paid" deserves twice the attention before check-in. Apply the rule on every stay, with no exception for the friendly guest or for the dates you wanted so badly to fill. Experienced hosts treat that mix of urgency and off-platform payment almost as a fraud detector built into the routine.

The structural fix is to let the platform handle the money. Booking Payments is the system in which Booking.com itself collects the guest's payment and pays you out, taking the card and the transfer out of your hands. It does not remove the commission, but it moves the payment fraud risk to the party with the structure to absorb it. Between paying the commission and swallowing a chargeback, the numbers almost always favor the official system. The same logic holds on Airbnb: asking the guest to pay you directly is one of the costly mistakes covered in what to do when an Airbnb payout has not arrived.

How do I spot a fake Booking.com email?

You spot a fake email by the combination of signs, never by a single one. The sender comes from a domain that looks like the real one but is not identical, sometimes with one swapped letter that fools a hurried eye. The tone leans on urgency and the threat of suspending your account. And at some point the request slides towards a password, a card or a link outside the extranet. Each sign on its own can be innocent. Several together form the script.

The chart ranks the warning signs by how much weight they usually carry when deciding whether to be suspicious.

A side-by-side comparison helps train your eye. The table contrasts what is usually genuine with what is usually a scam.

This is where the root difference between the two platforms matters, because it changes your defense. The table sums up where the scam gets in on each one.

What should you do if you fall for a scam?

If you fell for it, or nearly did, act fast and in the right order. First, stop: do not click again, do not pay, do not paste any command. Then check the information through the official channel, always typing the Booking.com address into your browser instead of clicking the link you received. Next, change your password and turn on two-factor authentication. Finally, report it to Booking.com and, if the account was compromised, tell your active guests there was an incident.

This protocol matters because fraud counts on improvisation. When all your guest communication already goes out through one consistent channel, it becomes much easier to notice when something is off. A payment request you would never make, or a message in a tone that is not yours, stands out immediately. This is where guest messaging automation helps security as well as response time. Tools like Anfitrione answer common questions on WhatsApp and keep messages consistent, while payment and booking always stay on the platform, where the protection is. Standardizing guest messages also standardizes your defense, because it creates a clear baseline of what normal looks like. An organized operation makes fewer panic mistakes and regains control faster.

The chart shows the difference following the protocol makes to the damage of an incident.

Day to day, defense is routine, not luck. A few practices, repeated on every booking, remove most of the risk. The table pairs each habit with the scam it blocks.

If the worst happens and a booking looks fraudulent, Booking.com keeps an official route inside the extranet for you to report and block fake bookings. Use that channel, with screenshots and dates, instead of trying to sort it out on your own with the supposed guest. The more of the conversation stayed on the platform, the stronger your case. It works the same way on Airbnb, where the platform chat is often the evidence that decides a request to remove an unfair review.

Being wary of email is part of running the operation

Security on Booking.com does not come from treating every guest as a fraudster. It comes from knowing the script and keeping the operation inside the official environment, where the protection exists. The common thread of almost every fraud is the invitation to step outside: a payment off the platform, a link instead of the extranet, a password typed where it should not be. Your best defense is to turn down that invitation calmly and methodically.

Turn on two-factor authentication, check the sender before clicking, leave payment to the platform and standardize how you talk to guests. If you list on both Airbnb and Booking.com, keep the same routine on both channels, so the security habits hold up over time.