Exeter holiday lets owner left 'devastated' after Booking.com phishing attack triggers £1m refund demand

A small business owner from Exeter has spoken of her exhaustion and distress after her Booking.com account was hijacked by cyber criminals, leading to thousands of fraudulent property reservations being advertised in her company's name and leaving her facing a potential refund bill of more than £1m.

Victoria Pollard, 46, runs Life's 2 Short, a property management firm that employs just one other person alongside her. She said the phishing attack in August stripped her of access to her accounts, prevented her from handling genuine bookings, and triggered a torrent of online abuse from travellers who believed she was responsible for holidays that never existed.

Pollard described the fallout as overwhelming, saying she had been forced to switch her phone to airplane mode at one stage because she was receiving between 20 and 30 calls every minute. She said she had spent as much as 12 hours a day trying to untangle the mess, while still attempting to keep her legitimate business running.

The fraudulent listings attracted guests from overseas, some of whom had already booked flights and arrived with nowhere to stay. Pollard said the abuse directed at her and her firm was "horrendous", with disappointed customers accusing the business of ruining their holidays and their lives. She stressed that the fake reservations were for properties that did not exist and that she had no role in creating them.

Among the most alarming developments for Pollard was being told by Booking.com that she would be liable for refunds totalling just over £1m. She said the platform's staff appeared not to be communicating with one another, describing the handling of the case as "carnage" and arguing that a problem that could have been shut down within a day had instead dragged on for weeks.

She added that she could not continue operating a business that was receiving 10,000 emails a day unrelated to its real work, and that genuine calls from actual customers were being missed as a result. Pollard said she was at her "wits' end" and felt "devastated and exhausted by it all".

Booking.com has apologised for the incident and said it was offering its full support to Pollard. The company said its investigation indicated the accommodation was likely the victim of a sophisticated phishing attack by cyber criminals, which affected her own computer systems and led to temporary unauthorised access to her Booking.com account.

The platform said all impacted listings had been removed and that customers had been offered relocations, refunds or free cancellations depending on their circumstances. It added that it was sorry to hear about the partner's experience. Booking.com did not respond to Pollard's specific criticisms when approached for further comment.

The case has drawn attention to wider concerns about how well online booking platforms detect and remove fraudulent listings. Kat Cereda, from the consumer group Which?, said that while people might hope such situations were incredibly rare, accounts like this are heard all too often.

Cereda pointed to a recent Which? investigation in which the consumer group listed 10 Downing Street as a holiday rental. She said the platform failed to spot that the listing was clearly a spoof, arguing it was therefore no wonder that scam listings and phishing attacks were slipping through the net when such an obvious example failed to raise red flags. She called on the prime minister to ask Ofcom to use the Online Safety Act to crack down on the problem.

Booking.com responded to the Downing Street listing by saying the limited test was not a true reflection of the experience of millions of listings and reviews published on its platform. It said that because the Which? listing was not live on its site during the two months it was present, some of its automatic fraud controls were not triggered to completely remove the closed listing. The property could only be seen and requested during a 20-minute window opened by Which? so its researchers could attempt a booking.

A government spokesperson said the law was crystal clear, adding that online platforms falling under the Online Safety Act, including Booking.com, have a legal duty to ensure their sites are not providing a forum for material intended to scam the public, and must remove it when found. The spokesperson said platforms that fail to protect users from illegal fraudulent content can face consequences, including fines, and that the regulator has the government's full backing to take action.

Booking.com reiterated in response that all impacted listings were removed and that customers with future stays were contacted and supported, which could mean relocations, refunds or free cancellations depending on individual circumstances. The company's position underlines the pressure platforms now face to demonstrate that their fraud detection systems are robust enough to protect both hosts and guests.

For Pollard, the practical consequences continue. She said the attack left her without access to her accounts, causing genuine reservations to be missed and placing her small operation under strain it was never designed to withstand. With only one other employee, Life's 2 Short lacks the resources of larger hospitality businesses to absorb a crisis of this scale.

The episode highlights how phishing attacks can cascade far beyond the initial security breach. A compromised account can be used to publish fake listings, draw in unsuspecting travellers, generate refund liabilities and expose the legitimate business owner to public anger, all while the criminals behind the scheme remain largely invisible.

It also raises questions about responsibility when a platform account is breached. Pollard's account of being told she would be liable for more than £1m in refunds contrasts with Booking.com's statement that it is supporting affected customers, leaving unresolved the question of who ultimately bears the cost when fraudsters exploit a host's credentials.

Consumer advocates argue the burden should not fall on small businesses or travellers. The Which? intervention suggests that scrutiny of booking platforms is intensifying, particularly as regulators gain stronger powers under the Online Safety Act to pursue companies that fail to remove fraudulent content from their sites.

For now, Pollard says she is simply trying to keep her Exeter-based business alive while dealing with the aftermath of an attack she did not initiate. Her experience serves as a warning about the vulnerability of small accommodation providers to increasingly sophisticated cyber crime, and about the human cost when a trusted platform becomes the vector for a scam.