Exeter holiday lets owner left 'devastated' after Booking.com phishing attack floods her firm with fake reservations

A small property management company in Exeter has been left reeling after cyber criminals hijacked its Booking.com account and used it to advertise thousands of bogus holiday lets, triggering a wave of angry calls from travellers who had paid for accommodation that did not exist.

Victoria Pollard, who runs Life's 2 Short, said the attack in August left her locked out of her own accounts, caused genuine bookings to slip through the net, and turned her phone into a source of relentless abuse. The 46-year-old described herself as "devastated and exhausted" by an ordeal that she said should have been shut down within a day but instead dragged on for weeks.

The scam worked by exploiting access to her Booking.com profile to post listings for properties that were never available to rent. Some of the people who reserved those phantom stays had already flown in from overseas, only to discover on arrival that they had nowhere to sleep.

Pollard, whose business employs just one other person, said the fallout was immediate and brutal. She was inundated with calls and messages from disappointed guests who believed she was personally responsible for the fraud, with some accusing her of ruining their holidays and their lives after they had already paid for flights.

"It's horrendous," she said of the online abuse, explaining that callers were "calling us all the names under the sun". At the height of the crisis she was receiving between 20 and 30 calls every minute, forcing her to switch her phone to airplane mode simply to keep functioning. She estimated she was spending as much as 12 hours a day trying to untangle the mess.

The practical damage extended well beyond the abuse. Pollard said roughly 10,000 emails a day were pouring in, almost none of them related to her legitimate business, and genuine customer calls were being missed as a result. "I cannot continue as a business with 10,000 emails a day that are not concerned with my legitimate business," she said, adding that the situation had left her at her "wits' end".

At one stage, she said, Booking.com informed her she would be liable for refunds tied to the fraudulent reservations, a sum that came to just over £1m. She also criticised what she described as a lack of coordination among the platform's staff, saying employees did not appear to be communicating with one another, a breakdown she characterised as "carnage".

"Something that could've been dealt with and shut down within 24 hours has taken weeks, and we are still no further forward," she said.

Booking.com has apologised for the episode and said it was offering Pollard its "full support". The company said all the affected listings had been removed and that customers had been offered relocations, refunds or free cancellations depending on their circumstances.

In a statement, the platform said its investigation indicated the accommodation was "likely the victim of a sophisticated phishing attack by cyber criminals, which affected their own computer systems and led to temporary unauthorised access to the accommodation partner's Booking.com account". Booking.com did not respond to Pollard's specific criticisms when approached for further comment.

The case has drawn attention from consumer advocates who argue it is far from isolated. Kat Cereda, from the consumer group Which?, said stories like Pollard's surface "all too often", and pointed to her organisation's recent experiment in which it successfully listed 10 Downing Street as a holiday rental on the platform.

That spoof listing, she argued, should have been spotted immediately by Booking.com's systems. "It's no wonder that scam listings and phishing attacks are slipping through the net, when such obvious examples failed to raise red flags," she said. She called on the prime minister to press the communications regulator Ofcom to use the Online Safety Act to crack down on the problem.

Booking.com pushed back on the significance of the Downing Street test, describing it as a limited exercise that did not reflect the experience of the millions of listings and reviews published on its platform. The company said that because the Which? listing was not "live" across the two months it was present, some of its automatic fraud controls were not triggered to remove the closed listing entirely. According to the platform, the property could only be seen and requested during a 20-minute window that Which? opened so its researchers could attempt a booking.

A government spokesperson said the legal position was unambiguous, noting that online platforms covered by the Online Safety Act, including Booking.com, have a duty to ensure their sites do not provide a forum for material intended to defraud the public, and must remove such content when they find it. The spokesperson warned that platforms failing to protect users from illegal fraudulent content can face consequences including fines, and said the regulator has the government's full backing to act.

Booking.com reiterated that every impacted listing had been taken down and that customers with upcoming stays had been contacted and supported, with remedies ranging from relocations to refunds or free cancellations.

For Pollard, however, the episode has left deep scars on a business she built with a single employee. She said the experience had drained her financially and emotionally, and that the weeks of chaos had exposed how quickly a small operator can be overwhelmed when a major booking platform's security is breached. The abuse from travellers who mistook her for the perpetrator has been particularly hard to absorb, she added, because the fraud was committed against her company as much as against the guests.