Exeter Holiday Lets Owner Left 'Devastated' After Booking.com Phishing Attack Triggers £1m Refund Demand

A small property management business in Exeter has been left reeling after a sophisticated phishing attack hijacked its Booking.com account and flooded the platform with thousands of fraudulent reservations for accommodation that did not exist, according to the BBC.

Victoria Pollard, who runs Life's 2 Short, described herself as "devastated and exhausted" by an ordeal that has consumed her working life since the breach in August. Her company employs only one other person, making the fallout all the more difficult to absorb.

The 46-year-old explained that the cyber attack locked her out of her own accounts, meaning legitimate bookings went unnoticed and unanswered while fake listings multiplied in her business's name. Some travellers who booked the fictitious properties had already flown in from overseas, only to find themselves with nowhere to stay on arrival.

Booking.com has since issued an apology and said it is offering its "full support" to Pollard. The company confirmed that all affected listings were taken down and that customers were offered relocations, refunds or free cancellations depending on their circumstances.

In a statement, the platform said its investigation suggested the accommodation partner had "likely" been the victim of a sophisticated phishing operation carried out by cyber criminals. According to Booking.com, the attack compromised the business's own computer systems before granting the attackers temporary unauthorised access to its Booking.com account.

The consequences for Pollard have extended well beyond lost bookings. She said she received what she described as "horrendous" abuse online from disappointed guests who believed she was personally responsible for the fake listings. Many of those affected had already paid for flights and were left scrambling for alternative accommodation.

She recounted being accused of ruining people's holidays, with angry customers "calling us all the names under the sun". At the peak of the incident, her phone was receiving between 20 and 30 calls every minute, forcing her to switch it to airplane mode simply to cope. She estimated spending up to 12 hours a day trying to untangle the crisis.

The sheer volume of correspondence has made normal trading almost impossible. Pollard said her inbox was receiving around 10,000 emails daily that had nothing to do with her genuine business, while real customer calls went unanswered because the lines were jammed.

She also revealed that Booking.com initially told her she would be held liable for refunds connected to the fraudulent reservations, a sum she said totalled just over £1m. That prospect, combined with the administrative collapse, left her fearing for the future of the company.

Pollard was sharply critical of how Booking.com handled the episode, claiming staff at the platform failed to communicate with one another and describing the overall response as "carnage". In her view, a problem that could have been contained within 24 hours dragged on for weeks without resolution.

"Something that could've been dealt with and shut down within 24 hours has taken weeks, and we are still no further forward," she said, adding that she was now at her "wits' end". Booking.com did not respond to her specific criticisms when the BBC approached it for further comment.

The case has also drawn attention to wider concerns about how well online booking platforms police fraudulent listings. Kat Cereda, from the consumer group Which?, said stories of this kind are heard "all too often", despite the assumption that such incidents are rare.

She pointed to a separate Which? investigation in which the organisation succeeded in listing 10 Downing Street as a holiday rental. The platform, she argued, failed to recognise the entry as an obvious spoof, suggesting that more subtle scams could easily slip through its defences.

Cereda said it was time for the prime minister to press Ofcom to use the Online Safety Act to crack down on the problem, arguing that obvious red flags are not being acted upon quickly enough. Responding to the Downing Street episode, Booking.com said the "limited test" did not reflect the experience of the millions of listings and reviews published on its platform.

The company explained that because the Which? listing was never truly live across the two months it appeared, some automatic fraud controls were not triggered in a way that would have removed the closed entry altogether. The public could only view the listing and request to book it during a 20-minute window that Which? opened so its researchers could attempt a reservation.

A government spokesperson said the law is "crystal clear" on the matter. Platforms covered by the Online Safety Act, including Booking.com, have a legal duty to prevent their sites from becoming a forum for material intended to scam the public, and they must remove such content when it is identified.

The spokesperson added that platforms failing to protect users from illegal fraudulent content can face consequences including fines, and that the regulator has the government's full backing to take action. In response, Booking.com repeated that all impacted listings were removed and that customers with future stays had been contacted and supported.

For Pollard, however, the practical and emotional toll continues. She said she had been left "devastated and exhausted by it all", with the attack damaging not only her business but also her reputation among travellers who had no way of knowing they were dealing with fraudsters rather than a legitimate Exeter company.