News for hackers. Stuff that matters.
Re:Booking.com hackers increase attacks on customers by kubectl_h on Friday December 01, 2023 @10:07AM (#38487553)
Within the last few days I booked a hotel on Booking.com and then got a call the next day from the hotel saying they actually don't use the Booking.com anymore (and that their account is inactive so they can't log in) and that I needed to cancel the stay through booking.com (the booking was pay on arrival but I still entered a CC).

I re-booked with the hotel directly through their site (small independently owned hotel in a ski town). The whole process felt _shady_ but also it seems like the owner couldn't find a way to get their Booking.com listing removed. I am regretting not using a virtual card number for the initial booking through Booking.com.

Re:Booking.com hackers increase attacks on customers by isotopp on Friday December 01, 2023 @11:15AM (#38488391)
If you booked with Booking, and the hotel called you back, and told you they don't use Booking any more, how do you imagine did they get the information needed to call you back and knew of the booking?

What you have here is commission fraud on behalf of the hotel against Booking.com, and if you call back Booking.com and tell them about it, they will set the hotel straight.

Or you get back to the hotel, tell them you understand how commission fraud works and if they are willing to split that commission (18%) half and half with you.

Re:Booking.com hackers increase attacks on customers by pxeboot on Friday December 01, 2023 @11:26AM (#38488542)
> how do you imagine did they get the information needed to call you back and knew of the booking?

Maybe booking.com sends an email to the hotel, but they legitimately don't have the login credentials to cancel the reservation?

Re:Booking.com hackers increase attacks on customers by kubectl_h on Friday December 01, 2023 @12:55PM (#38489837)
This was it. They add calendar events too apparently.
Re:Booking.com hackers increase attacks on customers by baz00 on Friday December 01, 2023 @11:29AM (#38488583)
Had this. That was exactly what happened to me. It was refunded and I decided never to use booking.com ever again.
Re:Booking.com hackers increase attacks on customers by codr7 on Friday December 01, 2023 @01:40PM (#38490504)
Good choice, for several reasons.
Re:Booking.com hackers increase attacks on customers by carlosjobim on Friday December 01, 2023 @01:38PM (#38490473)
There's 0% chance this is what happened. Hotels can get in touch with booking easily by phone or e-mail to fix any login issues, or to delist from booking if they don't want to be partners. Also, why would they have to log in? Booking.com sends their invoices by e-mail as well.

This case was commission fraud by the hotel against booking.com

Re:Booking.com hackers increase attacks on customers by smueller1234 on Friday December 01, 2023 @01:52PM (#38490643)
IIRC when I worked at booking until 2017, they had already stopped the practice to share customer data via email for privacy+security reasons years ago.
Re:Booking.com hackers increase attacks on customers by ww520 on Friday December 01, 2023 @12:18PM (#38489298)
All reservations are forwarded to the hotel; otherwise, how does the hotel know who’s coming?
Re:Booking.com hackers increase attacks on customers by MakeThemMoney on Friday December 01, 2023 @07:51PM (#38494662)
How do Uber drivers know who to pick up?
Re:Booking.com hackers increase attacks on customers by kadoban on Friday December 01, 2023 @01:48PM (#38490594)
> Or you get back to the hotel, tell them you understand how commission fraud works and if they are willing to split that commission (18%) half and half with you.

That sure sounds like a crime in itself, no?

Re:Booking.com hackers increase attacks on customers by edgyquant on Friday December 01, 2023 @09:05PM (#38495153)
It sounds ridiculous. You pay that 18% so how would they even split it?
Re:Booking.com hackers increase attacks on customers by JumpCrisscross on Friday December 01, 2023 @09:33PM (#38495322)
> You pay that 18% so how would they even split it?

You don’t. You cancel on Booking.com and then pay the hotel 90% of what Booking quoted.

Re:Booking.com hackers increase attacks on customers by petre on Friday December 01, 2023 @02:15PM (#38490913)
Booking.com hasn't paid some hotelliers for months, so there you have it. It's not comission fraud, it's either loss mitigation or the very same scam that the article describes.

https://www.theguardian.com/business/2023/oct/01/booking-com...

Having been scammed by booking.com car rentals myself, I see no surprises there.

Re:Booking.com hackers increase attacks on customers by tuukkah on Friday December 01, 2023 @11:05PM (#38495774)
Ouch:

> an Australian running a two-bedroom villa in Bali [--] managed to get paid out last week for the A$11,000 she was owed since March by tracking down a finance officer on Facebook.

Re:Booking.com hackers increase attacks on customers by jacquesm on Friday December 01, 2023 @02:52PM (#38491384)
More likely you'll be staying for free and they might toss in a dinner. They live and die by booking.com/hotels.com/expedia etc.

Then again: these 'new middlemen' are all equally shady themselves.

Re:Booking.com hackers increase attacks on customers by edgyquant on Friday December 01, 2023 @09:05PM (#38495150)
How would splitting a commission that you pay for anyway even work?
Re:Booking.com hackers increase attacks on customers by dboreham on Friday December 01, 2023 @09:50PM (#38495419)
You cancel the original booking then place a second one direct with the hotel at cost A-(A-B)/2.

I've done this many times (not exactly the same, see below) with AirBnB and Redweek rentals -- once you get to know the property owner by staying there once or twice through Redweek they will happily agree to a better rate to deal direct.

Re:Booking.com hackers increase attacks on customers by JumpCrisscross on Friday December 01, 2023 @09:34PM (#38495329)
> commission fraud

Is it fraud? Sounds like bog-standard disintermediation.

Re:Booking.com hackers increase attacks on customers by dboreham on Friday December 01, 2023 @09:48PM (#38495404)
Disruption.
Re:Booking.com hackers increase attacks on customers by xnx on Friday December 01, 2023 @11:01AM (#38488226)
Sounds a lot like the bad-old-days of taxi's where the driver would say "the credit card machine doesn't work.
Re:Booking.com hackers increase attacks on customers by flemhans on Friday December 01, 2023 @11:09PM (#38495795)
Copenhagen, 2023. And Uber is banned.
Re:Booking.com hackers increase attacks on customers by Our_Benefactors on Saturday December 02, 2023 @12:05PM (#38500008)
lol, this is still how NYC operates at large
Re:Booking.com hackers increase attacks on customers by cjrp on Friday December 01, 2023 @10:57AM (#38488186)
Is it possible they just wanted you to book direct so they don't pay the Booking.com commission?
Re:Booking.com hackers increase attacks on customers by kubectl_h on Friday December 01, 2023 @12:58PM (#38489870)
Maybe, though the owner seemed legitimately annoyed with Booking.com having the listing still active. Their direct price ended up being 10-15% cheaper in any case.
Re:Booking.com hackers increase attacks on customers by ChatGTP on Friday December 01, 2023 @02:55PM (#38491416)
I've heard from friends o friends who use Booking.com that their payment system broke down earlier this year and booking.com still has not paid them hundreds / thousands they are owed. So might be why they're avoiding taking bookings through the site.
Re:Booking.com hackers increase attacks on customers by neilv on Friday December 01, 2023 @09:48PM (#38495405)
> that their payment system broke down earlier this year and booking.com still has not paid them hundreds / thousands they are owed.

"Aw, shucks, the payment system is still broke. Just be a few months before the repair company can be by to fix it. Nothing to worry about here. No need to contact a lawyer or the AG's office." ?

Re:Booking.com hackers increase attacks on customers by nroets on Friday December 01, 2023 @10:22AM (#38487754)
If a property asks you to cancel your booking on Booking, please make sure that Booking knows the real reason.

(I'm leading a very nomadic lifestyle and I've used Booking over 50 times)

Re:Booking.com hackers increase attacks on customers by throwaway290 on Friday December 01, 2023 @10:45AM (#38488080)
I used Booking way more times. I'd say just call support and explain what happened.

Also maybe do not provide card info "for card confirmation". It literally gets just sent to the place in the clear. Many of them print it and keep for who knows how long for anyone to see.

Re:Booking.com hackers increase attacks on customers by kubectl_h on Friday December 01, 2023 @01:03PM (#38489979)
> Also maybe do not provide card info "for card confirmation".

I could be wrong but I don't believe I was given the option not to. I was unaware it was sent in the clear until now.

Re:Booking.com hackers increase attacks on customers by throwaway290 on Saturday December 02, 2023 @01:39AM (#38496484)
Some listings support pay via Booking now, I prefer those unless I trust the place enough. Otherwise I would choose a debit card that I wouldn't have much balance on.
Re:Booking.com hackers increase attacks on customers by carlosjobim on Friday December 01, 2023 @01:41PM (#38490526)
> It literally gets just sent to the place in the clear.

Nowadays they send a virtual card that has been generated by booking.com to the hotel. The card details of the guest stay with booking.com

Re:Booking.com hackers increase attacks on customers by throwaway290 on Saturday December 02, 2023 @01:40AM (#38496486)
A few years I saw paper sheets with my card info printed at the hotel. Good to know it changed
Re:Booking.com hackers increase attacks on customers by ratg13 on Friday December 01, 2023 @01:10PM (#38490074)
I've used booking.com hundreds of times, but would not recommend using them currently with all of the problems that they have had paying hotels for the past 6 months.
Re:Booking.com hackers increase attacks on customers by pinkgolem on Friday December 01, 2023 @01:18PM (#38490200)
I asked my last two hosts and both told me they had no problems what so ever with booking

Do you know what region/hotels are actually affected by this?

Re:Booking.com hackers increase attacks on customers by ratg13 on Friday December 01, 2023 @01:36PM (#38490459)
I think the root cause may be resolved, but don't know the status of the backlog.

Found this article from last month about places still waiting for their money with no signs of when or if it might come.

https://www.theguardian.com/travel/2023/nov/10/booking-com-t...

Re:Booking.com hackers increase attacks on customers by seabass-labrax on Friday December 01, 2023 @10:19AM (#38487715)
Is this 'virtual card number' something that Booking.com provides as an option to you, or do you have a third-party service for this?
Re:Booking.com hackers increase attacks on customers by swozey on Friday December 01, 2023 @10:41AM (#38488022)
Privacy.com has a 1password integration so I have it create cards instead of filling in my real card

https://blog.1password.com/privacy-virtual-cards/

Re:Booking.com hackers increase attacks on customers by flutas on Friday December 01, 2023 @12:41PM (#38489592)
Just an FYI, Privacy won't help you out if something gets charged fraudulently to a card.

Had a place triple charge me, place ignored all CS attempts from me. Privacy refused to help basically saying all three must have been valid and "they have policies with banks" that meant they "couldn't chargeback".

Re:Booking.com hackers increase attacks on customers by bitvoid on Friday December 01, 2023 @02:10PM (#38490850)
Isn't that what the spend limit option is for?
Re:Booking.com hackers increase attacks on customers by LoganDark on Friday December 01, 2023 @08:46PM (#38495005)
While I agree that allowing a fraudulent charge to appear on your card in the first place is user error (they should all be paused when not in use, and anything that remains unpaused should have strict spend limits set to within a dollar), the inconvenience of doing this properly can be too great for someone who makes purchases regularly.

Or someone who uses Amazon at all, because they don't actually charge your card when you make a purchase, they charge it randomly about 6 hours later. This trips me up all the time.

Re:Booking.com hackers increase attacks on customers by LoganDark on Friday December 01, 2023 @08:45PM (#38494997)
> Just an FYI, Privacy won't help you out if something gets charged fraudulently to a card.

Yes they will. I tried to buy a VPS from OVH, and then they immediately locked my account, demanded ID, and refused to refund. Contacted Privacy support to file a chargeback, and they just gave me an equivalent amount of Privacy credit and said not to worry about it, since an actual chargeback would be far more inconvenient for me.

How large was the fraudulent charge?

Re:Booking.com hackers increase attacks on customers by davchana on Friday December 01, 2023 @10:27PM (#38495605)
privacy.com is not good. one loses the cashback or points. privacy.com wants the bank account details aka access. one loses any credit card related protections like insurance, price protection, charge back, fraud etc.
Re:Booking.com hackers increase attacks on customers by luma on Friday December 01, 2023 @11:06AM (#38488282)
For supported cards, this function is built straight into Chrome. Works on my AmEx for example, every time Chrome prompts to auto-fill payment details one of the options is a one-time virtual card that gets automatically handled by Chrome itself. Works a treat!
Re:Booking.com hackers increase attacks on customers by jksflkjl3jk3 on Friday December 01, 2023 @11:31AM (#38488616)
That seems very shady. Surely there must be a financial institution behind the virtual number, no? Is Chrome a white label for one of these financial services?
Re:Booking.com hackers increase attacks on customers by ta1356356 on Friday December 01, 2023 @11:59AM (#38489034)
Nothing shady, just an alias to your real account #/card number, its got to be supported by your bank and ties back to a real account. Thought it'd been commonplace for quite a while.
Re:Booking.com hackers increase attacks on customers by davchana on Friday December 01, 2023 @10:25PM (#38495595)
nothing shady. you add the actual card number in chrome. chrome saves it. chrome knows this card supports virtual card numbers. at the time of any payment, chrome gives option to autofill card details with actual card or virtual card. if virtual selected, chrome gives/send/syncs that virtual card with issuer/original card.

capital one supports it. Amex too.

Re:Booking.com hackers increase attacks on customers by solardev on Friday December 01, 2023 @11:49AM (#38488891)
Is this only on Android, with Google Pay integration? Or desktop Chrome too? News to me!
Re:Booking.com hackers increase attacks on customers by lakpan on Friday December 01, 2023 @10:36AM (#38487946)
A lot of banks offer those nowadays. Wise has virtual cards and Revolut even has single-use cards, just to mention the most popular ones.
Re:Booking.com hackers increase attacks on customers by ben_w on Friday December 01, 2023 @10:34AM (#38487922)
I don't know what kubectl_h does, but I have a virtual card from Revolut
Re:Booking.com hackers increase attacks on customers by bozhark on Friday December 01, 2023 @10:45AM (#38488077)
Your credit card most likely offers the service
Re:Booking.com hackers increase attacks on customers by cultofmetatron on Friday December 01, 2023 @10:43AM (#38488054)
privacy.com is fantastic for this.
Re:Booking.com hackers increase attacks on customers by kubectl_h on Friday December 01, 2023 @01:00PM (#38489924)
Capital One makes it very easy to generate virtual card numbers that map to a credit card account.
Re:Booking.com hackers increase attacks on customers by robga on Saturday December 02, 2023 @04:06AM (#38497213)
That sounds shady enough that I may have backed out.

Generally speaking though, I’ll almost always try to “book direct” once I find a hotel on booking.com or other sites unless they are more than 5% more expensive. Advantages often include:

- pay on arrival, and cancel late

- ask for late check out or early arrival when you book

- better service upon arrival

- better actual room (may be an imagined benefit)

- let’s the vendor avoid the 3rd party fee, reducing their overall expenses and this overall room rates

- sometimes much more liberal on “number of persons in room” if you’re travelling with a small child, so I just search for 2 people on booking.com then check local hotel for ability to add the kid. Works for 3rd person and sofa beds too.

- discount for repeat business. More than once a small hotel has said “please book direct next time. We can offer you a discount if you come to us”.