Booking.com and Airbnb Scams: How to Spot Hijacked Listings Before You Book

You found a stunning apartment in Barcelona at an unbelievable price. The photos look professional, the reviews are glowing, and the location is perfect. You book it, pay upfront, and arrive to discover the listing does not exist. Or worse, someone else is already staying there.

Listing hijack scams on platforms like Booking.com and Airbnb have surged in recent years. Scammers compromise legitimate host accounts, alter payment details, and pocket your money before anyone notices. This guide explains how these scams work and how to protect yourself.

How Listing Hijack Scams Work

Step 1: The Host Account Gets Compromised

Scammers gain access to a real host's account through phishing emails, credential stuffing, or malware. Because the account is legitimate — with real reviews and history — the listing looks completely trustworthy.

Step 2: Payment Details Are Changed

Once inside, the scammer changes the payout bank account or inserts new payment instructions. Some modify the listing description to include off-platform payment requests disguised as "special offers."

Step 3: Guests Book and Pay

Travelers book the property through normal channels. The money goes to the scammer's account. The real host often does not realize anything happened until guests start arriving at their door.

Red Flags to Watch For

Warning Sign	What It Means
Price significantly below market rate	Scammers use low prices to create urgency
Request to pay outside the platform	Legitimate hosts never need off-platform payments
New messages asking you to click a link	Phishing attempt to steal your credentials
Sudden change in communication style	A different person may have taken over the account
"Confirm your booking" emails from unofficial addresses	Phishing emails mimicking Booking.com or Airbnb
Property details are vague or inconsistent	Copy-pasted or AI-generated descriptions

The Phishing Message Trap

One of the most common attacks starts after you have already booked. You receive a message — apparently from the host or the platform — asking you to "verify your payment" or "confirm your card details" through a link. The link leads to a convincing replica of Booking.com or Airbnb that captures your credentials and payment information.

These messages increasingly arrive through the platform's own messaging system, because the scammer controls the host account.

How to Defend Against This

• Never click links in messages that ask you to re-enter payment details
• Go directly to the app or website by typing the URL yourself
• Enable two-factor authentication on your booking platform accounts
• Check the sender's email domain carefully for slight misspellings

Practical Steps Before Every Booking

1. Verify the Property Exists

Copy the property name and address into Google Maps or Street View. Check that the building matches the photos. Reverse-image search listing photos to see if they appear on other sites under different names.

2. Read Reviews Carefully

Look for recent reviews that mention specific details about the property. A sudden gap in reviews or a cluster of generic five-star reviews may indicate a compromised account.

3. Communicate Only on the Platform

Keep all conversations within Booking.com or Airbnb's messaging system. If a host asks you to move to iMessage, Messenger, or email, that is a red flag. Platforms can only protect you if the transaction stays on their system.

4. Pay Only Through the Platform

Never wire money, send gift cards, or use cryptocurrency to pay for a booking. Legitimate platforms handle all payments through their own checkout process.

5. Use a Credit Card

Credit cards offer chargeback protection that debit cards and bank transfers do not. If you are scammed, you have a much better chance of recovering your money.

What to Do If You Have Been Scammed

1. Contact the platform immediately — both Booking.com and Airbnb have fraud departments
2. File a chargeback with your credit card company
3. Report the listing so it gets taken down
4. Change your passwords on all travel-related accounts
5. Document everything — screenshots of messages, confirmation emails, payment receipts

Protecting Your Travel Information

Travel planning involves sharing a lot of sensitive information: passport details, flight itineraries, hotel confirmations, and credit card numbers. If you need to share booking confirmations or travel details with family or travel companions, consider using a password-protected link through LOCK.PUB instead of sending them in plain text through email or messaging apps. This way, even if a message is intercepted, the sensitive details remain encrypted.

The Bigger Picture

Booking platform scams succeed because they exploit trust. You trust the platform, you trust the reviews, and you trust the host. Scammers insert themselves into that chain of trust by taking over legitimate accounts.

The best defense is healthy skepticism combined with practical verification. If a deal seems too good to be true, it almost certainly is. Take five extra minutes to verify before you pay — those five minutes can save you thousands.

For sharing any sensitive travel documents, booking confirmations, or emergency contact details during your trip, LOCK.PUB lets you create password-protected links that expire automatically, keeping your information safe even if your messages are compromised.

---

Stay safe when you travel. Use LOCK.PUB to securely share booking details, passport info, and travel itineraries with your travel companions — no app download required.