Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Booking.com users angry at firm's response to hacks

bbc.com

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Booking.com users angry at firm's response to hacks

#31

Post by bsdz »

daveoc64 wrote: post #18
lol768 wrote: post #16

These media reports are REALLY misleading, and I would be fuming if I worked at Booking.com at how much damage these media reports have done to the brand. > The company, which is one of the biggest hotel and holiday websites in the world, has not itself been hacked. > > Instead, criminals have tricked their way into the administration portals of individual hotels that use the service. > > This enables them to send me…

As others have said, requiring two-factor authentication would go a long way to stopping this. Nothing in the report or what you have quoted is misleading.

Apparently, from a related article, the hotels do have 2FA.

https://www.theguardian.com/money/2023/oct/23/bookingcom-cus...

Re: Booking.com users angry at firm's response to hacks

#32

Post by onetokeoverthe »

traceroute66 wrote: post #14
ghostpepper wrote: post #3

Unless they stop using the service then the company won't care that they're angry. What alternatives are people using?

> What alternatives are people using? Book online directly. The hotels hate OTAs (Online Travel Agents). You can typically find better terms direct on the hotel website (e.g. breakfast included or more flexible cancellation). If you are in a financial position where you need to watch every penny, then take the extra time and effort to book by phone or email, because in some jurisdictions the hotels have rate-parity c…

Hotels will usually NOT meet or beat the booking.com price even when i am standing right in front of them.

Re: Booking.com users angry at firm's response to hacks

#33

Post by poisonborz »

danielodievich wrote: post #15

My mother (against my strong advice) booked something on booking.com for ~$6.5K and then couldn't find any evidence of in their "My Trips" interface. I advised her to call the credit card and file fraud. Instead, the customer support agent of the credit card gave her some 1-800 number for booking.com customer support (Booking.com doesn't offer 1-800 number) and when she called it, someone with strong Indian accent wo…

Booking.com's common user scenario is budget ~50-200$/night hotels and apartments for 1-2 weeks where the support and reviews really help, anyone spending this kind of money on trips can of course get better deals without the ~15% platform tax.

Re: Booking.com users angry at firm's response to hacks

#34

Post by insomniacity »

lol768 wrote: post #29
daveoc64 wrote: post #27

Earlier quoted context omitted.

I don't think the scams use links. They post bank account details for the customer to send a payment to. Manually typing a link may not seem suspicious to many customers anyway. Edit: Looks like the scam may involve credit/debit cards and links. The messages may be sent to customers via email, and the links are clickable that way. Not sure if that's an email client thing or if Booking.com makes them clickable in HTML…

> They post bank account details for the customer to send a payment to. This is even less credible to me than a phishing site set-up to take card details. As soon as you try to make a payment to a scammer's bank account, confirmation of payee will fail because the bank details won't match the hotel's. It should also raise alarm bells because it's a completely out-of-character thing to be asked to do prior to a stay w…

Does Confirmation of Payee even exist outside the UK? Even if it did exist within other countries, I highly doubt there is international integration.

Re: Booking.com users angry at firm's response to hacks

#35

Post by FireBeyond »

onetokeoverthe wrote: post #32
traceroute66 wrote: post #14

Earlier quoted context omitted.

> What alternatives are people using? Book online directly. The hotels hate OTAs (Online Travel Agents). You can typically find better terms direct on the hotel website (e.g. breakfast included or more flexible cancellation). If you are in a financial position where you need to watch every penny, then take the extra time and effort to book by phone or email, because in some jurisdictions the hotels have rate-parity c…

Hotels will usually NOT meet or beat the booking.com price even when i am standing right in front of them.

Well, standing right in front of them, they have you over a barrel. What, are you going to call an Uber and go to another hotel in the hope that they have rooms?

Re: Booking.com users angry at firm's response to hacks

#36

Post by lol768 »

insomniacity wrote: post #34
lol768 wrote: post #29

Earlier quoted context omitted.

> They post bank account details for the customer to send a payment to. This is even less credible to me than a phishing site set-up to take card details. As soon as you try to make a payment to a scammer's bank account, confirmation of payee will fail because the bank details won't match the hotel's. It should also raise alarm bells because it's a completely out-of-character thing to be asked to do prior to a stay w…

Does Confirmation of Payee even exist outside the UK? Even if it did exist within other countries, I highly doubt there is international integration.

PSD3 covers international IBAN verification and will, thanks to regulation, ensure that this works cross-border. I think the technical aspects are fairly similar to CoP as we have it in the UK. Even in its absence though, the international payment flow puts enough friction into the process it would probably ring some alarm bells for a potential victim.

Re: Booking.com users angry at firm's response to hacks

#37

Post by potatopatch »

ghostpepper wrote: post #25
callalex wrote: post #4

Earlier quoted context omitted.

Calling hotels on the phone. When I suggest it to my 30-something peers they look at me like I have two heads though.

I think the biggest draw of booking.com is the blanket cancellation policy up to a few days ahead

That's a standard from industry that you will still get from most traditional hotels, unless you book them at a no cancelation discount rate through booking.com.

Re: Booking.com users angry at firm's response to hacks

#38

Post by Celmfire »

daveoc64 wrote: post #27
lol768 wrote: post #24

Earlier quoted context omitted.

The messaging system is full of disclaimers ("The content of the message from Malmaison was not generated by Booking.com") and, looking at a message I've received, it doesn't even support links. Anyone getting phished would have to manually type in a URL in their address bar if this was the vector used.

I don't think the scams use links. They post bank account details for the customer to send a payment to. Manually typing a link may not seem suspicious to many customers anyway. Edit: Looks like the scam may involve credit/debit cards and links. The messages may be sent to customers via email, and the links are clickable that way. Not sure if that's an email client thing or if Booking.com makes them clickable in HTML…

I have received one of these scam messages in the app - they do indeed contain clickable links which go to a replica of the real website, where customers are asked to input credit card details to "confirm their booking". In my case the message promised "your card will not be charged at this time".

I must say it's a clever approach; generally poor English in messages is a red flag for scams, but you tend to forgive that when you know it's coming from a hotel in another country.

Re: Booking.com users angry at firm's response to hacks

#39

Post by devilbunny »

poisonborz wrote: post #33
danielodievich wrote: post #15

My mother (against my strong advice) booked something on booking.com for ~$6.5K and then couldn't find any evidence of in their "My Trips" interface. I advised her to call the credit card and file fraud. Instead, the customer support agent of the credit card gave her some 1-800 number for booking.com customer support (Booking.com doesn't offer 1-800 number) and when she called it, someone with strong Indian accent wo…

Booking.com's common user scenario is budget ~50-200$/night hotels and apartments for 1-2 weeks where the support and reviews really help, anyone spending this kind of money on trips can of course get better deals without the ~15% platform tax.

Booking also has one feature that I've not seen replicated elsewhere: you can search for rooms that include bathtubs (not just showers). This is often a challenging thing to find in Europe. My wife has long enough hair that she can't really wash it more than once a week; it would dry out too badly, not to mention the time commitment to dry it all.

Re: Booking.com users angry at firm's response to hacks

#40

Post by onetokeoverthe »

FireBeyond wrote: post #35
onetokeoverthe wrote: post #32

Earlier quoted context omitted.

Hotels will usually NOT meet or beat the booking.com price even when i am standing right in front of them.

Well, standing right in front of them, they have you over a barrel. What, are you going to call an Uber and go to another hotel in the hope that they have rooms?

[dead]
Post reply on HN