Exeter Business Owner Left 'Devastated and Exhausted' After Booking.com Account Hacked in Phishing Attack

A small business owner from Exeter has spoken of her distress after her Booking.com account was compromised in a phishing attack, resulting in thousands of fraudulent property listings appearing under her company's name and genuine bookings being lost.

Victoria Pollard, who runs Life's 2 Short, a property management firm that employs just one other member of staff, said the ordeal had left her feeling shattered and worn down. The 46-year-old explained that some of the travellers who had made the fake reservations had journeyed from abroad, only to discover upon arrival that no accommodation existed and they had nowhere to stay.

The incident, which occurred in August, saw Pollard locked out of her own accounts while fraudulent bookings continued to be advertised on the platform. According to Pollard, the attack meant that legitimate reservations tied to her real business were overlooked because she could not access the system to manage them.

Booking.com has issued an apology and stated that it is providing its "full support" to Pollard. The company said that all affected listings have since been taken down and that customers who had been caught up in the scam were offered assistance in the form of relocations, refunds or the option to cancel without charge.

In a statement, Booking.com said: "We are sorry to hear about this accommodation partner's experience." The platform's investigation, it added, suggested that the accommodation provider was "likely the victim of a sophisticated phishing attack by cyber criminals, which affected their own computer systems and led to temporary unauthorised access to the accommodation partner's Booking.com account."

Pollard described being subjected to a torrent of abuse online from would-be guests who believed she was behind the fake listings for properties that did not exist. She said the messages were "horrendous", with people accusing her of ruining their holidays and their lives after they had already paid for flights and were left with no place to stay.

The volume of contact became so overwhelming that Pollard said she had to switch her phone to airplane mode at one stage, as she was receiving between 20 and 30 calls every minute. She estimated that she had been working up to 12 hours a day in an attempt to resolve the crisis and restore her business operations.

She described the situation as "carnage", explaining that she was unable to continue running a legitimate enterprise while being flooded with around 10,000 emails a day that had nothing to do with her actual business. She added that genuine calls from real customers were being missed amid the chaos.

At one point, Pollard said Booking.com had informed her that she would be held liable for refunds that totalled just over £1m. She also claimed that staff at the platform had failed to communicate with one another, compounding the difficulty of getting the situation under control.

Reflecting on how the matter had been handled, Pollard said: "Something that could've been dealt with and shut down within 24 hours has taken weeks, and we are still no further forward." She added that she was now at her "wits' end" and felt "devastated and exhausted by it all". Booking.com did not respond to her criticisms when it was approached for further comment.

The case has drawn attention from consumer experts. Kat Cereda, from the consumer group Which?, said that while people would like to believe such situations are very rare, reports of this kind are heard "all too often". She pointed to a recent episode in which Which? listed 10 Downing Street as a holiday rental, only for the platform to fail to recognise the listing as an obvious spoof.

Cereda argued that it was little wonder that scam listings and phishing attacks were slipping through the net when even glaringly false entries did not trigger red flags. She called on the prime minister to urge the communications regulator, Ofcom, to use the Online Safety Act to crack down on the problem.

In response to the 10 Downing Street listing, Booking.com said the exercise was a "limited test" that did not reflect the experience of the millions of listings and reviews published on its platform. It explained that because the Which? listing was not "live" across the two months it was present, some of its automatic fraud controls were not triggered to remove the closed listing entirely; visibility was limited to a 20-minute window that Which? opened so its researchers could attempt a booking.

A government spokesperson said the law was "crystal clear", noting that online platforms falling under the Online Safety Act, including Booking.com, have a legal duty to ensure their sites do not provide a forum for material intended to scam the public, and must remove such content when it is found. The spokesperson warned that platforms failing to protect users from illegal fraudulent content could face consequences, including fines, and said the regulator had the government's full backing to take action.

Booking.com reiterated that all impacted listings had been removed and that customers with future stays had been contacted and supported, with help potentially including relocations, refunds or free cancellations depending on individual circumstances.

The episode highlights the vulnerability of small operators to cybercrime and the reputational damage that can follow when fraudsters exploit trusted booking platforms. For Pollard, the aftermath has meant weeks of disruption, lost business and emotional strain, with the promised support arriving only after significant damage had already been done.