Fraud on booking.com

In June 2025, Euroconsumers filled a formal GDPR complaint against Booking.com with the Dutch Data Protection Authority over an alleged data breach that enabled a targeted phishing scam. The complainant received fraudulent messages via WhatsApp, email and Booking.com’s internal messaging system, with scammers using precise booking details to make their requests appear legitimate.

Alleged data breach and security failures

The complaint argues that the incident points to unauthorised access to customers’ personal data, potentially through Booking.com or a compromised accommodation partner. Booking.com stated that there was no conclusive evidence its own systems had been compromised.

Our call

The complainant is seeking regulatory action to strengthen data protection measures and requests €2,500 in compensation for the alleged harm suffered. The Dutch authority is being asked to assess the case and determine whether corrective measures are warranted.