Comment by tomhoward | Hacker News Reader

Comment by tomhoward | Hacker News Reader

I fell for this, though I realised it was a scam in time and locked my card quickly enough that I didn't lose any money.

I'm pretty sure it's the first time, in over 20 years of using the internet, that I've fallen for a phishing scam.

It completely gets through your defences because the message is sent via the Booking.com app and is about a legit hotel booking you've made. Very nasty.

But very poor of Booking.com to not be better at detecting these messages. The first consumer reports I can find about this scam go back to January [1], and it shouldn't need very sophisticated text classification to recognise and block them.

More details about the scam here [2].

[1] https://insideflyer.co.uk/2023/01/beware-of-this-booking-com...

[2] https://perception-point.io/blog/booking-com-customers-hit-b...

I got one like the second link you posted a few months ago.

Had a trip booked to Japan, multiple hotels reserved with booking and Agoda.

At some point I received one of those messages, which arrived directly through Booking's system. As mentioned in the article it's not even though SMS -- technically it did come to my email but just as an email copy of the message from their system.

The oddest thing was that a couple days later I got a follow-up message with a profile icon matching the hotel, but a message written as if from a customer, and they said something about trying the spam link, putting their CC info in, and nothing happening.

I wasn't sure if that was the scammer trying to impersonate a customer or if somehow another customer was attached to my message thread.

If the latter, I'd surmise that Booking's message underlying system is email and somehow when the scam was sent out, it was done with cc or bcc to a set of customers rather than only me.

If the former, it doesn't really make sense to act like it didn't work otherwise the targeted customer is less likely to try it.

So odd.

Well if it is through Booking.com message system it’s their problem not yours. The card would promptly get you a chargeback if they charged you

Reply on news.ycombinator.com