Cybercriminals are eternally clued in to what’s happening in the world around them. They are eager to exploit the vulnerabilities of individuals and businesses and keenly aware that the possibility of punishment is remote.
The huge growth in the popularity of DIY holidays in recent years, and the online booking platforms that do so much to facilitate them, has inevitably attracted the attention of cyber thieves, who are fast becoming a plague on all our houses – and hotels.
Platforms don’t come much bigger than Booking.com. The Amsterdam-based operator connects travellers with more than 30 million different accommodation options across the world. It has processed about 6.5 billion bookings since 2010 – or more than 2,000 bookings every minute of every day for the past 15 years.
With all that coming and going and money changing hands, it is no surprise that Booking.com has become particularly attractive to the criminally minded.
Middle earners could be €750 better off post-budget, but they may not be impressed
Chief Rabbi: All the good that might have come from Ireland v Israel has been lost
Fake listings, phantom bookings and unhelpful bots: Booking.com’s credibility problem
The south sees Drumcree and thinks: we don’t want that sectarian mindset down here
Earlier this year it emerged that it suffered a data breach, with “unauthorised parties” gaining access to customers’ details. How many customers were impacted? Booking.com would not say. It did, however, say that no financial details were compromised and it told affected customers that what was compromised “could include booking details and names, emails, addresses, phone numbers associated with the booking and anything that you may have shared with the accommodation”.
That is a lot of information for criminals to play with. The breach immediately raised fears of reservation hijacking – a nasty practice that sees criminals target people they know have legitimate bookings with particular hotels in order to more easily steal money and sensitive data.
But while data breaches and hacks are a serious business, sometimes fraudsters targeting Booking.com require nothing more than a phone and a picture of a house or hotel, as the British consumer watchdog Which? Travel highlighted to comedic effect earlier this summer. To draw attention to Booking.com’s apparent over-reliance on AI and technology to weed out bad actors, it listed 10 Downing Street as a holiday rental and priced it as just £55 a night, a steal by any measure.
The Which? people were able to accept at least one payment – from an account they controlled – for the UK prime minister’s official residence. As if that wasn’t bad enough, they were also able to post glowing reviews about fictitious stays in Downing Street on the platform, which even included playful references to Larry the Cat. The absurdity of it all went completely over the heads of the Booking.com bots.
[ Booking.com scams are on the rise: Here’s how to avoid themOpens in new window ]
In response to queries from this newspaper at the time, Booking.com said the Which? Travel listing “does not reflect the experience of millions of listings and reviews on our platform”. It stressed that it uses “a range of checks, verification measures and AI-powered technologies to protect our platform, detecting and removing most fraudulent listings within 24 hours. We also have tools in place to help protect the integrity of our reviews programme.”
In some respects, that response inadvertently highlighted one of the big problems Booking.com has and may well have served as music to the ears of tech-minded thieves. Removing “most fraudulent listings within 24 hours” is not quite the same as removing “all fraudulent listings” and “within 24 hours” is not quite the same as immediately. A clever cybercriminal could dupe a lot of people out of a lot of money in a 24-hour window, particularly if the barriers to listing fraudulent properties seem to be inadequate.
They certainly seemed to be inadequate to a landlord who contacted this newspaper recently to complain that a property she owned and was renting to long-term tenants had been listed without her knowledge on the site. The listing had been used to extract money from visitors, some of whom had paid substantial sums to people unknown. When the landlord tried to contact the company to alert them to the fraud and to ask them to remove her property from the platform, she ran into multiple brick walls. It was only when this newspaper highlighted the issue that the property was delisted. That responsiveness is unacceptable.
But criminals operating out of the darkest recesses of the web are not the only challenges facing Booking.com.
Sometimes it has only itself to blame for the manner in which people are let down. Any company that processes 2,000 fairly complicated transactions a minute is inevitably going to have occasional problems – hotels will close or accommodation will not be up to scratch.
The issue with Booking.com is not so much about things going wrong but how they are managed when they do.
The platform has been found wanting too often and it seems clear that it struggles to deal with complaints in an expeditious fashion, even when they are very pressing.
In recent weeks this newspaper has highlighted multiple stories from people who have been let down by the service. People have made bookings only to discover when they arrive for their stay, the hotels do not exist or have permanently closed or left the platform. Many then have to spend weeks – if not months – chasing refunds and dealing with an endless string of bots, who seem incapable of, or unwilling to, resolve the problems.
Generally speaking, for understandable reasons, big companies attract more complaints than small companies. But the other side of that is that big companies should have the financial wherewithal, and the administrative capabilities, to resolve complaints more quickly and more efficiently than smaller companies. By failing to handle the concerns of customers – even if they make up a small percentage of the bookings – a platform such as Booking.com is doing both its customers and itself a great disservice.
It has made overseas travel easier, more accessible and often more secure for many people. But it must do more to protect its users from criminals, and to respond faster and more effectively to problems when they arise.
