Exeter Holiday Lets Owner Says Booking.com Hack Left Her Facing £1m Refund Threat and 10,000 Daily Emails

The owner of a small holiday accommodation business in Exeter has spoken of her distress after fraudsters used her Booking.com account to advertise thousands of fake properties, leaving overseas travellers stranded and triggering a flood of abusive messages directed at her firm.

Victoria Pollard, who runs Life's 2 Short, said the sophisticated phishing attack in August cut her off from her own accounts, meant genuine customer bookings went unanswered and left her dealing with what she described as "carnage" for weeks.

The 46-year-old, whose company employs just one other person, told the BBC she felt "devastated and exhausted" by the experience and was now at her "wits' end" over the unresolved fallout.

According to Pollard, the incident involved a large number of fraudulent listings appearing in her business's name, drawing in guests who believed they had secured legitimate accommodation for their trips.

Some of those affected had already travelled from abroad before discovering that the properties they thought they had booked did not exist, leaving them with nowhere to stay when they arrived.

Pollard said she had been subjected to "horrendous" online abuse from disappointed customers who held her responsible for the fake reservations, with some accusing her of ruining their holidays and their lives.

She recounted that people were "calling us all the names under the sun", venting their anger at a business that had itself been targeted by criminals rather than being the source of the deception.

The volume of incoming messages became so overwhelming that Pollard said she had to switch her phone to airplane mode, having been receiving between 20 and 30 calls every minute at the height of the crisis.

Beyond the abuse, she estimated she was spending as much as 12 hours a day attempting to resolve the situation, while the constant barrage of emails and calls also meant she was missing genuine enquiries from real customers.

"I cannot continue as a business with 10,000 emails a day that are not concerned with my legitimate business," she said, adding that calls intended for her actual operation were going unanswered.

At one stage, Pollard said Booking.com had informed her that she would be liable for refunds linked to the fraudulent bookings, a sum that came to just over £1m — a figure far beyond the means of a two-person firm.

She also criticised the platform's handling of the case, saying different employees appeared not to have communicated with one another and describing the overall response as chaotic.

In her view, a problem that could have been identified and shut down within a day instead dragged on for weeks without meaningful progress, prolonging the damage to her business and reputation.

Booking.com has apologised to Pollard and said it was offering its "full support", adding that all the affected listings had been removed and that customers were offered relocations, refunds or free cancellations depending on their circumstances.

The company said its investigation indicated the accommodation partner had likely been the victim of a "sophisticated phishing attack by cyber criminals", which affected her own computer systems and led to temporary unauthorised access to her Booking.com account.

Booking.com did not respond to Pollard's specific criticisms when it was approached for further comment by the BBC.

The case has also drawn attention to wider concerns about fraud on major booking platforms, with consumer group Which? arguing that such incidents are far from isolated.

Kat Cereda, from Which?, said people would like to believe situations like this are incredibly rare, but that the organisation hears similar accounts all too often.

She pointed to a previous Which? experiment in which the consumer group listed 10 Downing Street as a holiday rental, saying the platform failed to spot that the listing was clearly a spoof.

Cereda argued that if such an obvious fake could slip through without raising red flags, it was no surprise that scam listings and phishing attacks were evading detection more broadly.

She called on the prime minister to press Ofcom to use the Online Safety Act to crack down on the problem, framing the issue as one requiring regulatory intervention rather than leaving platforms to police themselves.

In response to the 10 Downing Street listing, Booking.com said the limited test did not reflect the experience of the millions of listings and reviews published on its platform, and explained that because the listing was not "live" across the two months it was present, some automatic fraud controls were not triggered to remove it completely. The listing could only be seen, and booking requested, during a 20-minute window opened by Which? for its researchers.

A government spokesperson said the law was crystal clear, stating that online platforms falling under the Online Safety Act, including Booking.com, have a legal duty to ensure their sites do not provide a forum for material intended to scam the public, and must remove it when found. The spokesperson warned that platforms failing to protect users from illegal fraudulent content can face consequences including fines, and said the regulator has the government's full backing to take action.

Booking.com reiterated in response that all impacted listings were removed and customers with future stays contacted and supported, with outcomes that could include relocations, refunds or free cancellations depending on individual circumstances.

For Pollard, however, the practical and emotional toll continues, with the episode highlighting the vulnerability of very small operators when their accounts and systems are compromised, and the difficulty of restoring normal trading once a platform listing has been hijacked by fraudsters.