Booking.com Email spoofing scam: How fraudsters used a clone website and WhatsApp to steal £500 from an apartment owner

Inside the Booking.com Spoofing Scam: A Coordinated Digital Deception

A short-term rental property owner has lost £500 in what cybersecurity analysts describe as a “multi-layered social engineering operation” targeting hosts on Booking.com.

What initially appeared to be a routine account notification evolved into a sophisticated fraud involving email spoofing, impersonation, WhatsApp redirection, and a cloned verification website — all designed to simulate legitimacy.

This publication reconstructs the timeline of events and speaks with legal and cybersecurity experts about the growing threat facing hospitality operators.

Phase One: The Spoofed Email

The incident began with an email claiming the owner’s Booking.com account had been temporarily restricted. The message warned that failure to complete verification would result in permanent suspension and loss of access to new bookings.

At face value, the email resembled authentic correspondence from Booking.com. It referenced booking details and included formatting consistent with official notifications.

However, forensic review of the header revealed the sender’s domain was not an official Booking.com address — a classic case of email spoofing, where attackers manipulate display names and structures to appear legitimate.

Phase Two: Moving Off-Platform to WhatsApp

The email directed the owner to contact “support” via WhatsApp to expedite verification.

Cybersecurity experts say this tactic is deliberate.

“The moment communication is moved off the official platform, you’re outside the company’s monitoring and fraud detection systems,” explains a Ghana-based cybersecurity consultant familiar with booking platform fraud.
“That’s where criminals gain full control of the narrative.”

Once on WhatsApp, the scammers intensified pressure, warning of account suspension and lost revenue if immediate action was not taken

Why the Scam Was Convincing

According to digital fraud investigators, this case reflects a “hybrid phishing model” combining:

•Brand impersonation

•Urgency-based manipulation

•Platform switching (email → WhatsApp)

•Replica website deployment

•Real-time OTP harvesting

“This wasn’t random spam,” says a UK-based fraud risk analyst.

“It was tailored to property owners who depend on uninterrupted access to booking platforms. The threat of account suspension creates panic — and panic overrides caution.”

The Missing Link: The Fake Merchant App “SafuPay”

Beyond the spoofed email, WhatsApp manipulation, and cloned verification page, investigators say the fraudsters also used a questionable merchant app identified as SafuPay to process the unauthorized withdrawal.

Screenshots reviewed show the SafuPay app listed as a financial service application. However, in this case, it was allegedly used as the payment gateway through which the £500 transaction was processed after the victim submitted card details and OTP.

This suggests the attackers were not merely harvesting information — they had an operational merchant channel ready to execute real-time withdrawals.

How the Fake Merchant Layer Works

Cybersecurity analysts explain that many organized scam groups:

1.Create or register merchant accounts under shell entities

2.Integrate them with lesser-known payment apps

3.Use them to process stolen card transactions instantly

4.Rely on OTP capture to bypass bank fraud detection

Once the victim entered the OTP on the cloned website, the transaction was authorized as if it were legitimate.

“When a victim enters an OTP, the bank interprets that as full authorization,” explains a fraud prevention specialist.

“At that point, the transaction becomes technically ‘customer-approved,’ which complicates recovery.”

The SafuPay platform, in this context, appears to have functioned as the merchant endpoint where the stolen funds were routed.

Legal Implications: Who Is Responsible?

Legal experts note that liability in such cases can be complex.

While platforms like Booking.com implement anti-fraud systems, responsibility for safeguarding login credentials and financial information typically rests with the account holder.

However, a legal practitioner specialising in cybercrime notes:

“If a spoofed communication convincingly imitates a legitimate business and results in financial loss, victims may have grounds to report the matter to financial regulators and law enforcement agencies. Immediate reporting increases chances of fund recovery.”

Victims are advised to:

•Notify their bank immediately

•Request chargeback or fraud reversal procedures

•Report the incident to national cybercrime authorities

•Inform Booking.com through official extranet channels

A Growing Pattern in the Hospitality Sector

Industry observers say short-term rental hosts are increasingly targeted because:

•Many operate independently

•They respond quickly to booking alerts

•Revenue interruptions cause immediate anxiety

•They often manage multiple communication channels

Cybercriminal networks now design attacks specifically for hospitality operators — replicating dashboards, booking confirmations, and support templates with alarming accuracy.

Warning Signs Hosts Must Recognize

Experts highlight key red flags:

•Emails not strictly from an official domain

•Requests to communicate via WhatsApp or Telegram

•Urgent threats of permanent suspension

•Requests for card details to “restore” accounts

•Being asked to provide or enter OTP codes

“An OTP is the final security barrier,” the cybersecurity consultant warns.

“If you share it, you’re authorising the transaction yourself.”

Prevention: What Hosts Should Do Immediately

1.Always log in by manually typing the official website into your browser.

2.Never click verification links sent via WhatsApp.

3.Enable multi-factor authentication on booking platform accounts.

4.Never share OTP codes — with anyone.

5.Train staff managing listings to identify phishing tactics.

6.Verify suspicious emails directly inside the official extranet dashboard.

The Broader Lesson

This case underscores a harsh reality: digital fraud is evolving faster than many small business owners can adapt.

The £500 loss, while significant, could have been far worse. In similar cases, victims have lost thousands.

As online booking platforms remain central to the hospitality economy, cyber awareness is no longer optional — it is operational survival.