Booking.com Phishing Attack Leaves Exeter Business Owner Facing £1m Refund Demand and Abusive Calls

A small property management company in Exeter has been left reeling after a sophisticated phishing attack hijacked its Booking.com account and flooded the platform with thousands of fake reservations for properties that did not exist. Victoria Pollard, who runs Life's 2 Short, described herself as "devastated and exhausted" by an ordeal that has stretched on for weeks and left her business fighting to stay afloat.

The 46-year-old said the cyber-attack, which unfolded in August, cut her off from her own accounts just as genuine customers were trying to make legitimate bookings. The consequences were immediate and severe: real reservations were missed while her inbox and phone lines were overwhelmed by a deluge of complaints from people who had been duped by the fraudulent listings.

Pollard explained that some of those affected had travelled from overseas, only to arrive with nowhere to stay. The fake properties advertised in her company's name had never existed, meaning guests who had already paid for flights and accommodation were left stranded and searching for answers.

The abuse directed at Pollard and her small team has been relentless. She said she had received "horrendous" messages from disappointed guests who believed she was personally responsible for the scam. At one point, she was forced to switch her phone to airplane mode because it was ringing 20 to 30 times every minute, with callers venting their fury at a business that had itself become a victim.

She described being accused of ruining people's lives and their holidays, with angry customers calling her "all the names under the sun". The emotional toll has been compounded by the sheer volume of work required to untangle the mess. Pollard said she had spent as many as 12 hours a day trying to resolve the issue, while legitimate customers were unable to reach her because the lines were jammed.

"I cannot continue as a business with 10,000 emails a day that are not concerned with my legitimate business," she said, adding that genuine calls were being missed as a result. For a company that employs only one other person besides Pollard, the strain of managing such an unprecedented crisis has been immense.

Perhaps the most alarming development came when Booking.com initially told Pollard she would be liable for refunds totalling just over £1 million. The figure reflects the scale of the fraudulent activity carried out in her company's name, and the prospect of being held financially responsible for a crime committed against her business left her at her "wits' end".

Pollard also criticised the platform's response, claiming that employees at Booking.com had failed to communicate with one another and describing the situation as "carnage". She argued that a problem that could have been contained and shut down within 24 hours had instead dragged on for weeks, with little sign of resolution.

Booking.com has since apologised and said it is offering its "full support" to Pollard. The company said all impacted listings had been removed and that customers were offered relocations, refunds or free cancellations depending on their individual circumstances. It added that its investigation indicated the accommodation was likely the victim of a sophisticated phishing attack by cyber criminals, which affected the partner's own computer systems and led to temporary unauthorised access to the Booking.com account.

However, the platform declined to respond directly to Pollard's criticisms when approached for further comment, leaving questions unanswered about how a breach of this magnitude was able to persist for so long. The incident has also drawn attention to broader concerns about the robustness of Booking.com's fraud controls, particularly in light of a separate stunt in which consumer group Which? managed to list 10 Downing Street as a holiday rental.

Kat Cereda, from Which?, said that while people would like to believe such situations are incredibly rare, accounts like this are heard "all too often". She pointed to the Downing Street listing as evidence that obvious spoofs are slipping through the net, arguing that scam listings and phishing attacks are evading detection when even glaring examples fail to raise red flags. Cereda called on the prime minister to urge Ofcom to use the Online Safety Act to crack down on platforms that fail to protect users.

Booking.com responded to the Downing Street episode by saying it was a limited test that did not reflect the experience of millions of listings or reviews on its platform. It noted that because the listing was not "live" across the two months it was present, some of its automatic fraud controls were not triggered to completely remove the closed listing. People could only see it and request to book during a 20-minute window opened by Which? so its researchers could attempt a booking.

A government spokesperson emphasised that the law is crystal clear, stating that online platforms falling under the Online Safety Act, including Booking.com, have a legal duty to ensure their sites are not providing a forum for material intended to scam the public. The spokesperson added that platforms must remove such content where it is found, and that failure to protect users from illegal fraudulent content can lead to consequences including fines, with the regulator having full government backing to take action.

In its response, Booking.com reiterated that all impacted listings were removed and customers with future stays were contacted and supported, which could mean relocations, refunds or free cancellations depending on individual circumstances. For Pollard, however, the damage has already been done. She remains cut off from the normal rhythm of her business, still battling the fallout from a scam she did not commit, and facing a future in which her company's reputation and finances hang in the balance.