Online Booking Fraud Has Changed. But Who Protects the Accommodation Provider?

When I first wrote about online travel scams on 20 June 2024, the focus was largely on phishing emails, fake payment links, copied accommodation listings and criminals trying to obtain travellers’ card details.

Just over two years later, those risks certainly have not disappeared, but the nature of the problem has evolved considerably.

Booking.com and other OTAs (Online Travel Agents) continue to warn travellers about phishing messages which can look convincingly genuine, including messages appearing to come from Booking.com or an accommodation provider and asking the recipient to click a link, provide information or make an unexpected payment.

Accommodation providers are targets too. Booking.com advises partners to protect their accounts against phishing, social engineering and unauthorised access, and to keep communications within official Booking.com channels wherever possible.

But our latest experience at Glamping with Llamas has highlighted another side of online booking risk.

Sometimes there is no fake website.

There is no suspicious payment link.

The reservation itself is completely genuine.

The problem might be the person making it.

When a Guest Returns Under Different Details

We recently received a reservation through Booking.com which appeared perfectly ordinary.

It was only after the guests had left the following morning that we began to realise something was not right.

The hot tub had been used but remained unpaid for. During their stay, we recalled that one of the guests had also casually mentioned that they had visited us once before, that they lived only around two miles from our farm and even recognised one of our llamas by name from their previous visit.

That comment prompted us to look back through our previous booking records.

When we did, we discovered that this was not an isolated issue.

During the previous stay, the same guest had also used the hot tub and left without paying for it. We subsequently tried to recover the outstanding payment with Booking.com's assistance, but despite asking the platform to intervene, the matter was never resolved and the money remained unpaid.

Following that experience, we barred that guest from booking with us again.

However, because the more recent reservation was made using a different surname, we had no reason to realise that the person making the booking was somebody we had already prevented from returning.

That is an important point.

Accommodation providers may believe they have protected themselves by blocking or restricting a previous guest, but that protection is only effective if the booking platform is able to identify when the same person returns using altered details.

The details used for the more recent booking were sufficiently different that we had not connected the two reservations at the time.

On the later reservation:

• the surname being used through the booking account had changed;

• contact information differed;

• the mobile telephone number was unusable;

• the address information was incomplete; and

• information supplied regarding the age of a child in the party was inaccurate.

Had the information matched the previous reservation, we would have recognised the booking immediately. There was another difficulty with the contact information supplied.

On both occasions, the mobile telephone number provided contained an additional digit.

That meant we were unable to contact the guest directly using the telephone number supplied with either booking.

Again, we cannot know whether that was deliberate or simply an error. But from an accommodation provider's perspective, the result is exactly the same: the contact information was unusable. That matters for reasons extending far beyond payment.

If there had been an emergency, a safeguarding concern, an urgent problem with the accommodation or any other circumstance requiring us to contact the guest, the telephone number held against the booking would have been of no practical use.

The latest stay then ended in circumstances which were remarkably similar to the first. The hot tub had again been used without being paid for. But this time there was something else. Around 20 minutes after the guests had left, we discovered that one of the plush llama toys belonging to the accommodation was missing.

What made that particularly troubling was a comment made during the stay.

One of the guests had admired the plush llamas and jokingly remarked that they would have to make sure one did not somehow end up in their suitcase. The following morning, after the party had left, one of those plush llamas was gone.

We tried to contact the guest promptly and asked them to check their luggage, giving every opportunity for the item to be returned if it had somehow been packed accidentally. But of course, with a fake phone number and different identity, they were uncontactable. It has therefore not been returned.

The particular plush llamas we provide are no longer manufactured and, despite searching, we have been unable to source a replacement. Taken together, those circumstances are extremely difficult for us to dismiss as an innocent coincidence.

So, following two separate stays, we were left with:

• two unpaid hot-tub charges;

• a guest who had previously been barred but had returned under a different surname;

• unusable telephone information on both bookings;

• incomplete or questionable address information;

• inaccurate information concerning a child travelling with the party; and

• on the second occasion, an irreplaceable item belonging to the accommodation which disappeared immediately after a guest had specifically joked about it ending up in their suitcase.

We reported the latest matter to Booking.com as guest misconduct the following morning.

More than a week later, at the time of writing, we are still awaiting any response whatsoever to that guest misconduct report.

This Wasn't Somebody Hundreds of Miles Away

Perhaps one of the most uncomfortable aspects of the experience is that this was not some faceless online fraudster operating from another country. The booking party came from our wider local community, approximately two miles from our property.

We are deliberately not naming anybody because there is no evidence to suggest that every member of the party knew about the booking, payment or property issues.

The purpose of writing this is not to conduct a public trial of individual guests. It is to highlight something that independent accommodation providers need to understand. A person does not need to create a sophisticated false identity to avoid being recognised by a small business. Sometimes apparently minor alterations to the information attached to a reservation can be enough.

A Genuine Booking Platform Does Not Make Every Guest Detail Genuine

There is an understandable tendency for accommodation providers to feel reassured when a reservation comes through a major platform.

• The booking is in the system.

• The confirmation is there.

• The platform knows about the reservation.

• Therefore everything must be fine.

But those things only establish that a reservation has been made. They do not necessarily establish that every piece of information supplied by the person making it is accurate.

That distinction matters.

Guest names, the number of occupants and children's ages are not merely administrative details for accommodation businesses.

Saying a child over 8 is a 0-year-old infant simply to avoid the cost of adding a child to your booking is not a harmless little discrepancy. It affects pricing, occupancy information, preparation of the accommodation and, potentially, safety and insurance considerations. Accommodation providers need to be able to rely on the information supplied with a reservation being accurate.

But What If the Problem Were More Serious?

This is not the first time we have questioned the information Booking.com holds about a guest. On a previous and entirely separate occasion, another guest left without paying for use of the hot tub.

When we examined that reservation afterwards, there was no residential address listed for the guest at all.

We raised a very simple concern with Booking.com at the time. What if this had not merely been an unpaid charge?

What if a serious incident had taken place at our property and the police needed to identify or locate the person who had booked the accommodation?

As an accommodation provider, we had assumed that a major international booking platform would at least hold sufficient verified information to identify the person it was sending to stay on our property. In that case, there was no address available to us.

Our latest experience has raised exactly the same concern again. The address supplied with this reservation consisted only of a house name, and that house name appeared to have been slightly misspelled. We cannot know why it was entered that way, but it made independently identifying the address considerably more difficult.

Taken alongside the altered surname, unusable telephone number and inaccurate information concerning the child travelling with the party, it raises a broader question about how thoroughly guest identity information is actually verified before somebody is sent to an accommodation provider. Booking.com says it carries out verification and fraud checks and provides tools designed to improve the quality of guest information. That is reassuring in principle, but in reality, is it?

Hosts need to understand exactly what “verified” means in practice apart from taking a credit/debit card payment from someone.

If something genuinely serious occurred, would Booking.com be able to provide the police with a verified identity and address for the person concerned?

That is not an abstract question for us.

We live on the same property on which our guests stay.

Our animals are here.

Our belongings are here.

We meet guests face-to-face.

For many independent accommodation businesses, the premises are not simply a commercial building staffed around the clock.

They are also our homes.

That makes knowing who is actually coming onto the property a fundamental safety issue, not simply an administrative preference.

Booking.com itself provides accommodation partners with a mechanism for reporting guest misconduct. That sounds reassuring, but is it?

Our difficulty has been what happens after pressing the button.

Could the Technology Already Exist?

This raises another question. Booking.com is not a small business working from a spreadsheet of guest names. It operates millions of customer profiles and reservations and already uses sophisticated technology to identify fraud and unusual activity, or so it proclaims!

Booking.com itself says that artificial intelligence and machine-learning systems are used within its fraud and security processes and that information including contact details, account information, reservation history and other identifiers may be used when assessing risk.

So is it unreasonable to ask whether that same technology could identify patterns which an individual accommodation provider simply does not have the time or resources to investigate manually?

In our case, there were multiple potential signals:

• A guest previously barred from booking our property returned under a different surname.

• The telephone number supplied on both visits was identical but contained an additional digit and was therefore unusable.

• The address on the later reservation was identical, incomplete and appeared to contain a misspelling.

• Information about a child travelling with the party was inaccurate.

• There were similarities within the travelling party and previous booking history which became apparent once we manually investigated the earlier reservation.

We are not suggesting that any one of those things should automatically cause somebody's reservation to be rejected, but all at the same time?

People change names.

People make typing mistakes.

People move house.

Contact details change.

But several inconsistencies associated with potentially connected reservations ought surely to be capable of generating a flag for review.

The question for accommodation providers is therefore not simply whether the technology exists. It is whether enough of that technology is actually being used to protect the people and businesses who actually open their doors to the guests the platform sends them and from which their profits are fruitful.

A simple alert saying:

“This reservation may be associated with a guest you have previously blocked. Please review before accepting.”

could make an enormous difference.

That would not require Booking.com to accuse anybody of wrongdoing. It would simply give the accommodation provider information they need to make an informed decision about who they allow onto their property.

We Did What Accommodation Providers Are Told to Do

1. We documented the problem.

2. We retained the booking information.

3. We communicated through official channels.

4. We reported the guest misconduct promptly, the morning after departure.

And then we waited.

At the time this article is being published, more than a week has passed without any response whatsoever to the report.

That is not good enough for a small independent business dealing with an incident involving unpaid money and missing property.

We are not suggesting Booking.com should automatically believe an accommodation provider simply because a complaint has been submitted.

Guests deserve fairness too.

Both sides should have an opportunity to provide information and allegations should be investigated properly.

But given the commission charged by OTAs, we think it is entirely reasonable to expect serious misconduct reports to be investigated promptly.

There is a very considerable difference between investigation and total silence.

A 9.9/10 Hosting: but who protects the accommodation provider if something goes wrong?

There is another aspect of this which deserves discussion.

Glamping with Llamas currently has a Booking.com guest review score of 9.9 out of 10.

We are immensely proud of that because it has been earned through the experiences reported by the people who actually stay here. Yet when we require help from the platform, that performance appears to make no practical difference whatsoever.

We receive the same route into support and appear to wait in the same queue as everybody else.

Perhaps that would be entirely reasonable if our commercial relationship with Booking.com were also exactly the same as everybody else's.

But it isn't.

The Yellow Badge Comes at a Price

We participate in the Booking.com Preferred Plus programme, represented by the familiar yellow thumbs-up badge displayed alongside qualifying properties.

Booking.com describes Preferred Plus as the premium tier of its Preferred Partner Programme and promotes it as a way of achieving greater visibility.

Greater visibility is precisely what accommodation businesses are being sold.

But greater visibility comes with greater commission.

The standard Booking.com commission arrangement is 15%.

Through the additional visibility programme, we have seen the effective commission taken from reservations reach 23%.

That is a substantial proportion of the value of every booking. For a £150 stay (not uncommon here), 23% represents £34.50 gone before we have provided accommodation, heating, electricity, linen, cleaning, guest amenities, staff time, animal care and all the other costs involved in running the business.

We accept that enhanced visibility has a commercial value. What has become very clear, however, is what that additional commission apparently does not purchase.

• It does not appear to provide enhanced host protection.

• It does not appear to provide priority assistance when serious guest misconduct is reported.

• It does not appear to produce a faster response when money is outstanding or property disappears.

Accommodation providers considering these programmes should understand that distinction.

You are paying more to be seen more.

You should not assume you are paying more to be protected more.

The Relationship Between Platforms, Guests and Hosts Needs to Be More Balanced

Large online travel agencies have transformed the accommodation industry.

They give small properties access to enormous audiences which most independent businesses could never reach through their own advertising budgets.

We benefit from that. We are not pretending otherwise.

But platforms cannot function without accommodation providers either.

A Booking.com reservation ultimately becomes a real person arriving at somebody's hotel, cottage, B&B, campsite, glamping site or home.

The platform supplies the booking.

The accommodation provider assumes much of the physical risk.

• We provide the building.

• We provide the contents.

• We accommodate the guest.

• We deal with problems on site.

• We absorb unpaid extras.

• We discover damage.

• We replace missing items.

• And, in extreme cases, we are the people who may have to deal face-to-face with somebody whose behaviour has become problematic.

That makes meaningful partner support rather more important than another visibility badge.

What Should Accommodation Providers Be Expected to Do?

There are sensible precautions every accommodation provider should take. We keep records of our bookings, document significant incidents and use official booking-platform communication wherever possible.

We take payment for services where appropriate and report serious guest misconduct promptly.

But there has to be a reasonable limit to what a small accommodation business can be expected to do.

We do not have the time, resources or access to information required to manually investigate every reservation, comparing names, telephone numbers, addresses and historical bookings in an attempt to establish whether somebody may previously have stayed with us under different details. Nor should that realistically be our responsibility.

We use a major international booking platform precisely because there is an expectation that the basic information attached to a reservation is sufficiently accurate and reliable for us to know who we are allowing onto our property.

If somebody we have already barred from returning can make another reservation using a different surname, an unusable telephone number and incomplete or inaccurate address information without that connection being identified, individual accommodation providers cannot reasonably be expected to compensate for that weakness by becoming amateur investigators.

It is also important to put unpaid extras into perspective. Virtually every guest who uses our hot tub or additional services pays for it without issue.

On the very rare occasion somebody leaves having genuinely forgotten to pay, a quick message normally results in immediate payment accompanied by a sincere apology. That is ordinary human forgetfulness, and we treat it as such. The concern arises when an unpaid service forms part of a much wider pattern of altered information, unusable contact details, previous unpaid charges and other troubling circumstances.

None of this means viewing every guest with suspicion.

Incidents like this are so rare that, when they do happen, they leave us genuinely upset and confused as to why someone would choose to treat us in this way.

They respect the accommodation, they respect our animals, they pay what they owe and many leave as people we are genuinely delighted to welcome back.

Good hospitality depends upon trust.

But accommodation providers should also be able to trust the platform through which the reservation arrives.

Advice for Travellers Has Changed Too

For travellers, many of the basic precautions still apply.

• Book through an established platform or directly through the accommodation provider's genuine website.

• Be suspicious of unexpected requests to make payments by a different method from the one stated in your reservation.

• Do not provide card information in response to an unexpected email, text or WhatsApp message.

• If something appears odd, open the booking platform independently rather than following a link contained in the message.

• And perhaps one piece of advice from my original 2024 article now deserves retiring: poor spelling and grammar are no longer particularly reliable indicators of fraud.

• Modern scam communications can be polished, grammatically correct and visually convincing.

Behaviour is often the more useful warning sign:

• unexpected urgency;

• changed information;

• unusual payment requests;

• inconsistencies between communications;

• attempts to move conversations away from official channels; or

• details which simply do not add up.

Booking.com, We Would Welcome Your Response

We will be sharing this article with Booking.com because there are questions we genuinely believe deserve answers.

1. Why can an accommodation provider submit a serious guest misconduct report and hear nothing whatsoever for more than a week?

2. What process takes place after a misconduct report is submitted?

3. What protection is available when a returning guest uses materially different booking information?

4. Does Booking.com examine whether previous guest accounts or reservations may be connected?

5. If Preferred Plus partners are being asked to surrender a considerably greater percentage of each reservation for additional visibility, should some form of enhanced partner support accompany that commercial relationship?

6. What does Booking.com actually mean when guest information is described as verified, and what information would be available to the police if a serious incident occurred at an accommodation provider's property?

7. If the Booking.com technology is capable of identifying fraud and unusual patterns across millions of reservations, could that technology also flag a booking which appears to be connected with a guest previously barred by the accommodation provider?

We are not asking for preferential judgement. We are asking for effective support.

There is a difference.

Online Fraud Is Not Always What We Imagine

Travel scams have become more sophisticated.

Those warnings matter. But accommodation providers should remember that misconduct does not always arrive through a malicious link.

Sometimes:

• The website is genuine.

• The payment platform is genuine.

• The reservation is genuine.

• The guest genuinely arrives.

• And the problem only becomes apparent afterwards.

Sometimes the risk is not thousands of miles away. Sometimes it is two miles down the road.

At Glamping with Llamas, we will continue welcoming people warmly and absolute trust in our guests, because overwhelmingly that trust has always been repaid.

And more than a week after reporting this particular incident, we are still waiting for Booking.com to do its part.