⚠️ Warning to Hosts: Fake Booking.com Payment Link Scam

Several accommodation providers have recently reported a coordinated scam targeting Booking.com hosts, where fraudsters exploit legitimate bookings to initiate off-platform communication and attempt to collect sensitive financial or personal information. The scam typically involves sending fake payment links that closely imitate official Booking.com pages, making them appear authentic at first glance.

A common early warning sign is when a guest insists on moving the conversation away from the Booking.com messaging system to WhatsApp or another external platform. Since Booking.com already provides a secure, logged communication channel for hosts and guests, any attempt to bypass it—especially when combined with payment-related requests—should immediately raise concern.

What To Do If You Receive Such a Message

Do not move the conversation outside Booking.com.
Politely insist on keeping all communication within the Booking.com messaging platform, where messages are recorded and can be reviewed by support teams if needed.
Do not click on external payment or verification links.
Booking.com does not require hosts to accept payments via external URLs sent by guests.
Never share sensitive information.
This includes bank details, login credentials, verification codes, or identity documents outside official channels.
Report the incident immediately.
Use the Booking.com Partner Support or Extranet to flag the message as suspicious or potentially fraudulent.
Inform your staff and partners.
Make sure front-office and reservation staff are aware of this scam pattern so no one accidentally engages with fraudulent requests.

In short, if a guest requests WhatsApp contact, pressures for immediate payment, or sends a link that looks like Booking.com but uses an unfamiliar domain, treat it as a red flag and pause all action until the legitimacy is confirmed through official Booking.com channels.

Security Analysis: Phishing Alert

CRITICAL: We checked one such link and it is a confirmed phishing page designed to steal sensitive data and monitor administrator activity, with links named as booking.com but going to other domains.

After analyzing the source code of eg : https://booking.xx478x.cfd/reservation/?id=0xXxX3Xxxx, we have identified several malicious mechanisms used to deceive users and bypass security protocols.

Technical Red Flags Identified

1. Anti-Forensic Scripts The code contains a script that disables the F12 key and Ctrl+Shift+I. If you try to inspect the page, it executes notifyBackend() to alert the attacker that someone is analyzing their site.
2. Social Engineering & Brand Impersonation The page uses og:site_name and og:title set to "Booking.com" to look legitimate in WhatsApp/social media previews. It also pulls an icon from imgur.com, a common tactic for hackers to host assets outside the real domain.
3. Data Exfiltration Endpoint The code includes a hidden form that sends captured data (messages, images, and session info) to a suspicious PHP script: /chat/api_send_photo.php.
4. Visitor Tracking The script specifically captured and logged your IP address (2402:4000:23d0:e3b1...) and assigned a unique ID 0mKaE3Ydjb to track this specific interaction.
5. Content Camouflage The HTML is filled with "hidden" poetic text. This is a "Bayesian Poisoning" technique used to trick email and browser filters into thinking the page is an article or blog rather than a malicious form.

Recommended Action Plan

Do Not Click: Ensure no staff members interact with the link.
Block & Report: Block the WhatsApp sender immediately.
Notify Booking.com: Report the "Guest" and the link to the official Booking.com partner support.
Secure Your Device: If any information was already entered, change your Booking.com Extranet passwords immediately and enable 2FA.

How the Scam Typically Works

A booking is made through Booking.com, often using overseas phone numbers (commonly reported from countries such as the Philippines or Russia).
Shortly after booking, the guest sends a message via the Booking.com messaging system asking to continue the conversation on WhatsApp.
Once contacted on WhatsApp, the guest pressures the host to accept an immediate payment.
The guest sends a fake payment link that visually imitates Booking.com but uses a suspicious domain, often ending in .cfd.

Sample Scam Messages (Common Patterns)

The following are real-world style examples reported by hosts. If you receive messages similar to these, proceed with caution:

Message 1 (via Booking.com chat):
“Hello! I have a couple of questions about my booking. Can you please write me on WhatsApp? Number: +XX XXXXXXXX. Thanks!”

Message 2 (via WhatsApp):
“Hello, thank you for responding. Can I pay for the apartment right now?”

Message 3:
“I need to show the booking payment confirmation to my employer.”

Message 4:
“I can pay via Booking.com. You will receive money directly to your bank account.”

Final Step – Fake Payment Link:
A link that looks like Booking.com but uses a domain such as:
https://booking.[random-text].cfd

Why This Is a Red Flag

Booking.com does not request hosts to accept payments via external links.
Domains ending in .cfd are not associated with Booking.com.
Fake pages often copy logos and footers but lack functional navigation links.
These pages are designed to collect sensitive information such as bank or login details.

What Hosts Should Do

Do not click on external payment links.
Do not communicate outside the Booking.com platform.
Never enter bank or login details on non-official pages.
Report the incident immediately to Booking.com Partner Support.

This article is intended as an awareness notice for accommodation providers. When in doubt, always verify directly with Booking.com before taking any action.

Written by : Sanjaya Gunasiri

Digital Business

Tuesday, January 13, 2026

Fake Booking.com Payment Link Scam