Booking.com Faces Triple Threat: Data Breach, Deceptive Partners, and Revolt from Hoteliers
Data Security Incident
Unauthorized Access Notification
Booking.com has notified some customers that their personal information may have been accessed by unauthorized third parties. The company stated it noticed suspicious activity affecting a number of reservations and took action to contain the issue.
Information Potentially Accessed
Information that could have been accessed includes:
- Booking details
- Customer names
- Email addresses
- Phone numbers
- Home addresses
- Other information shared with accommodation properties
Company Response
As a security measure, Booking.com changed reservation PIN numbers. The company advised customers to install antivirus software and be alert to phishing attempts.
"The security of your personal information is our utmost priority. We'll continue to enhance and extend the robust security measures we have in place to secure your reservations with us."
— Booking.com, in an email to affected customers
The company warned that suspicious emails or phone calls may be from malicious actors impersonating the company or accommodation providers. Booking.com stated it would never ask for credit card details over the phone, through text message, WhatsApp, or for bank transfers that differ from the payment policy details in booking confirmations.
Unknown Factors
The number of affected customers has not been disclosed. Whether credit card details were compromised is not known.
Related Customer Incidents
Steve Atkin from Port Macquarie reported receiving a call from someone impersonating a Booking.com staff member after requesting a refund for accommodation in Bali. According to Atkin, approximately $100 was deducted from his account without him providing credit card details to the caller. Atkin said Booking.com told him the individual had never worked for the company and was not authorized to act on its behalf. Atkin received refunds for both the fraudulent transaction and his accommodation two months later.
Context
Booking.com operates more than 28 million accommodation listings globally and connects travelers to hotels, apartments, flights, rental cars, and attractions. The company is the main brand of Booking Holdings, which generated more than $38 billion in revenue last year and also owns Agoda, Kayak, and Priceline. In Australia, Booking.com accounts for more than 30% of online travel agent bookings, according to IbisWorld data.
National figures compiled by the ABC showed 842 complaints were made about Booking.com to state and territory consumer bodies over the past two years. The actual number is likely higher, as Victoria, Western Australia, and the Northern Territory do not disclose complaints about individual companies.
According to the National Anti-Scam Centre, phishing scams resulted in losses of more than $31 million in Australia last year. More than 65,000 scams were reported to Scamwatch in 2025.
Guest Reservations Third-Party Platform Concerns
Accusations of Deceptive Practices
Guest Reservations, a global travel platform, is facing accusations of using website design tactics that allegedly mislead travelers. One traveler, Jacob Cass, reported mistakenly booking accommodation through Guest Reservations, believing it was the official website of a holiday park. He was charged approximately $1,500 Australian dollars for the booking, which he stated was about $150 more per night than direct booking. Cass said the fees and the US dollar denomination were not mentioned during the booking process. His request for a refund was denied by Priceline, which responded on behalf of its "hotel partner."
Corporate Relationships
Priceline is owned by Booking Holdings. An accommodation provider told the ABC that reservations from Guest Reservations often appear as if they originated from Booking.com. Booking.com did not confirm a direct relationship but stated it works with "affiliate partners." Shoal Bay Holiday Park requested and successfully obtained its removal from the Guest Reservations website by liaising with Booking.com. Other hotels, including Ramada Resort at Shoal Bay and Parkroyal Melbourne Airport, reported no affiliation with Guest Reservations.
Website Design Features
Testing by the ABC revealed that Guest Reservations uses website design features sometimes referred to as "dark patterns" and "drip pricing." This includes sponsored Google ads that lead to URLs designed to resemble official hotel sites. These sites display a base nightly rate but include additional fees, reportedly exceeding 30% of the total cost in some cases, in small print or later in the booking process. Features such as an alarm clock indicating limited availability were used on the site.
Consumer Advocacy
Consumer advocate Erin Turner stated she is filing a complaint with the Australian Competition and Consumer Commission (ACCC) and advocated for an investigation into Guest Reservations. Turner also requested Booking.com explain its role and financial benefit from any relationship with Guest Reservations. Mr. Cass called on NSW Fair Trading and the ACCC to investigate.
Government Response
Assistant Minister for Competition, Andrew Leigh, announced that legislative reforms to ban unfair trading practices, including deceptive design features and drip pricing, are progressing and will be introduced. The proposed laws aim to ensure up-front, transparent pricing for consumers.
Industry Perspective
Richard Munro of Bowerbird Technologies, a service assisting hotels against what he described as "rogue" online travel agents, estimates over 400 such operators exist. Munro criticized Google for displaying Guest Reservations' advertising prominently, often allowing it to outbid hotels for their own names in search results. Google stated that Guest Reservations' advertising complies with its policies and that payment disputes are between customers and third-party providers. Google declined to disclose advertising revenue from Guest Reservations. Guest Reservations did not respond to media inquiries. Company records indicate it is registered in Delaware.
Motel Owner Contract Breach and Industry Complaints
Contract Breach
Simon Wurs, owner of the Bendigo City Centre motel, stated he deliberately breached his contract with Booking.com by offering lower rates to customers who book directly ($165 per night) compared to the rate on Booking.com ($190 per night). Wurs stated that Booking.com charges commissions of 12-15% on average, which he said cost him thousands of dollars monthly and reduced his profit margins. Wurs acknowledged he still needs the platform to maintain revenue.
"The security of your personal information is our utmost priority. We'll continue to enhance and extend the robust security measures we have in place to secure your reservations with us."
— Booking.com, in an email to affected customers
Background on Parity Clauses
A 2016 ACCC investigation resulted in changes allowing hotels to offer cheaper rates over the phone or in person, but not on their own websites. Parity clauses require hotels to offer the same or better rates and conditions on Booking.com as on other channels. Standard commission is reported to be around 15%, potentially reaching 30% with voluntary programs.
Calls for Reform
Accommodation Australia CEO James Goodwin called for a government review of parity clauses, commission rates, and restrictive practices, stating the 2016 changes are "out of date." Two Dutch consumer groups are suing Booking.com in a class action in the Netherlands, alleging overcharging due to parity clauses and the use of dark patterns. Australian consumer advocates stated that Australian consumers lack similar legal recourse. Australian consumer Allison Hyland called for an investigation into potential overcharging of Australian travelers. Assistant Minister Andrew Leigh noted the ACCC can use existing legal powers if companies abuse parity clauses, and the government has introduced legislation to ban unfair trading practices.
Booking.com Response
Booking.com defended its commissions as "some of the lowest" globally and stated partners control pricing and optional programs. The company stated that it may offer discounts from its own earnings.