Exeter holiday lets owner 'devastated' after Booking.com phishing attack floods her with 10,000 emails a day

A small business owner from Exeter has described being left "devastated and exhausted" after her Booking.com account was hijacked by cyber criminals, who used her company's name to advertise thousands of fake property reservations.

Victoria Pollard, 46, runs Life's 2 Short, a property management firm that employs just one other person. She said the phishing attack, which took place in August, locked her out of her own accounts and allowed fraudsters to post bogus listings under her company's identity. Some of the travellers who booked those non-existent properties had flown in from overseas, only to discover they had nowhere to stay.

The fallout was immediate and overwhelming. Pollard said her phone was inundated with calls from angry guests who believed she was to blame for their ruined trips. At the peak of the incident, she was receiving between 20 and 30 calls every minute, forcing her to switch her phone to airplane mode simply to cope. She also faced what she described as "horrendous" abuse online, with disappointed customers accusing her of destroying their holidays after they had already paid for flights.

"They were calling us all the names under the sun, saying we have ruined their life and their holiday, as they have booked their flights and have nowhere to stay," she said.

Pollard explained that the sheer volume of correspondence generated by the scam — roughly 10,000 emails a day — was making it impossible to run her legitimate business. Genuine enquiries and bookings were being missed because her inbox and phone lines were consumed by messages about reservations she had never created.

"I cannot continue as a business with 10,000 emails a day that are not concerned with my legitimate business," she said. "We are missing actual calls that are for our actual business."

The financial stakes were also far higher than she initially realised. At one stage, Pollard said Booking.com told her she would be liable for refunds tied to the fraudulent bookings, a sum that totalled just over £1m. She described the handling of the case as "carnage", claiming that staff at the platform failed to communicate with one another and that the response dragged on for weeks rather than being resolved within days. "Something that could've been dealt with and shut down within 24 hours has taken weeks, and we are still no further forward," she said.

She added that she had spent as long as 12 hours a day trying to untangle the mess, and was now at her "wits' end" and "devastated and exhausted by it all". Booking.com did not respond to her specific criticisms when the BBC approached the company for further comment.

In its response, Booking.com apologised and said it was offering Pollard its "full support". The company said its investigation indicated the accommodation was "likely the victim of a sophisticated phishing attack by cyber criminals, which affected their own computer systems and led to temporary unauthorised access to the accommodation partner's Booking.com account." It added that all impacted listings had been removed and that affected customers were offered "relocations, refunds or free cancellations".

The incident has also drawn attention to wider concerns about how well travel platforms police their own listings. Kat Cereda, from the consumer group Which?, said accounts like Pollard's are reported "all too often", and pointed to a recent stunt in which the campaign group successfully listed 10 Downing Street as a holiday rental on Booking.com. She argued that if such an obviously implausible listing failed to trigger red flags, it is little wonder that scam listings and phishing attacks are slipping through the net. "It's time for the prime minister to call on Ofcom to use the online safety act to crack down," she said.

Booking.com responded to the Downing Street episode by saying it was a "limited test" that did not reflect the experience of the millions of listings and reviews published on its platform. It explained that because the Which? listing was not "live" on its site across the two months it was present, some of its automatic fraud controls were not triggered to remove the closed listing entirely. According to the company, the listing was only visible — and bookable — during a 20-minute window opened by Which? so its researchers could attempt a booking.

A government spokesperson said the law is "crystal clear" and that online platforms falling under the Online Safety Act, including Booking.com, have a legal duty to ensure their sites are not providing a forum for material intended to scam the public. Platforms must remove such content where it is found, the spokesperson said, warning that failures to protect users from illegal fraudulent content can lead to consequences including fines, with regulators backed to take action.

Booking.com reiterated that all impacted listings had been removed and that customers with future stays had been contacted and supported. Depending on individual circumstances, that support could include relocations, refunds or free cancellations. The case remains a stark illustration of how a single compromise of an account can cascade into financial liability, reputational damage and weeks of disruption for a very small firm with limited resources.