Holiday Booking Fraud: £11 Million Lost in a Year and the Fake Hotel Messages to Watch For

Every summer, British fraud reports follow the holiday calendar. Action Fraud, the UK's national fraud reporting centre, logged 6,066 holiday fraud reports in 2024 with losses of £11,183,957. That's an average of £1,844 a victim. In 2023 the figures were 6,640 reports and £12.3 million lost, peaking in July and August. Those are only the people who reported it.

The scams haven't changed much. The delivery has.

The best version of the trip. Bag packed, booking confirmed, walking to the hotel. The worst version starts the same way and ends at a front desk that has never heard of you, or at an apartment that was never for rent.

The hotel message that isn't from the hotel

The most effective scam of the last two years runs through real booking platforms. Criminals break into a hotel's account on a site like Booking.com, often by sending the staff a fake guest complaint that installs malware. Microsoft has tied one such campaign to a group it calls Storm-1865. With access to the hotel's account, they can see real reservations and message real guests inside the real app.

The message says your card didn't go through and asks you to pay again, or to "verify" your card on a link, within 24 hours or the room is cancelled. It looks right because it is, mostly. Real hotel name, real dates, real price.

In April 2026 Booking.com started telling customers that unauthorised people had accessed reservation details, including names, emails, phone numbers and booking data, apparently through compromised hotel partners. It hasn't said how many customers were affected. Between June 2023 and September 2024 Action Fraud had already logged 532 reports linked to Booking.com scams, with about £370,000 lost.

Booking.com's line is clear: it never asks for card details or bank transfers by message. If in doubt, call the hotel on a number you find yourself.

The old tricks

Fake rental listings are still the classic. Nice photos lifted from another listing, a price slightly too good, and a host who wants payment by bank transfer, gift cards or a payment app outside the platform. Once the money leaves the platform, so does your protection. Clone travel agency websites and fake ATOL numbers catch package buyers.

There's new help on rentals. Since May 20 2026, an EU regulation says every short-term rental listing must carry a registration number, which platforms must display and check, and listings with invalid numbers have to come down. A missing number on a European listing is now a red flag on its own.

Pay by credit card and stay on the platform. And treat a deadline in a payment message as the warning sign it usually is.