Exeter Holiday Lets Owner Left 'Devastated and Exhausted' After Booking.com Account Hacked in Phishing Scam

The owner of a small property management company in Exeter has spoken of her distress after her Booking.com account was hijacked by cyber criminals, leading to thousands of fraudulent reservations being advertised in her firm's name.

Victoria Pollard, who runs Life's 2 Short, described herself as "devastated and exhausted" following the phishing attack, which she said left her locked out of her own accounts in August and caused genuine bookings to be overlooked. The 46-year-old's business employs just one other member of staff, making the disruption particularly acute for such a small operation.

According to Pollard, the consequences of the breach were severe and wide-ranging. Some of the people who made the fake bookings had travelled from overseas, only to discover upon arrival that the properties they believed they had reserved did not actually exist. Those travellers were left with nowhere to stay, turning planned holidays into stressful ordeals.

Booking.com has since issued an apology and stated that it is offering its "full support" to Pollard. The platform said all affected listings had been taken down and that customers were provided with options including relocations, refunds or free cancellations. "We are sorry to hear about this accommodation partner's experience," the company said in a statement.

The booking giant explained that its investigation pointed to a sophisticated phishing attack carried out by cyber criminals. According to Booking.com, the attack compromised the accommodation partner's own computer systems, which in turn led to temporary unauthorised access to her Booking.com account. Phishing scams of this kind typically involve criminals tricking victims into revealing login credentials or downloading malicious software, often through convincing but fake emails or messages.

The fallout for Pollard extended well beyond the technical breach itself. She said she faced "horrendous" online abuse from disappointed guests who assumed she was to blame for the fictitious listings. Many of those affected, she explained, accused her of ruining their lives and their holidays after they had already paid for flights and found themselves without accommodation.

The volume of angry correspondence was overwhelming. Pollard said she was forced to switch her phone to airplane mode at one stage because she was receiving between 20 and 30 calls every minute. She estimated that she was spending as much as 12 hours a day simply trying to resolve the crisis, leaving little time for the day-to-day running of her legitimate business.

"I cannot continue as a business with 10,000 emails a day that are not concerned with my legitimate business," she said, adding that genuine calls from real customers were being missed amid the flood of complaints related to the fraudulent bookings. She pointed out that this created a damaging cycle, as unanswered legitimate enquiries risked harming the reputation of her genuine operation.

At one point during the ordeal, Pollard said Booking.com informed her that she would be liable for refunds totalling just over £1m — an amount that would be catastrophic for a company of her size. She also criticised what she described as a lack of coordination among Booking.com staff, characterising the overall handling of the situation as "carnage."

"Something that could've been dealt with and shut down within 24 hours has taken weeks, and we are still no further forward," she said. Reflecting on the toll the episode had taken, she added that she was at her "wits' end" and felt "devastated and exhausted by it all." Booking.com did not respond to these specific criticisms when approached by the BBC for further comment.

The case has drawn attention from consumer advocates. Kat Cereda, from the consumer group Which?, said that while people might hope such situations are rare, accounts of this nature are reported all too often. She referenced a previous Which? investigation in which the group listed 10 Downing Street as a holiday rental, only for the platform to fail to recognise it as an obvious spoof.

Cereda argued that if such a blatantly fake listing could slip through the net, it is unsurprising that scam listings and phishing attacks more generally are evading detection. She called on the prime minister to urge the communications regulator Ofcom to use the Online Safety Act to crack down on such failures.

In response to the 10 Downing Street listing incident, Booking.com defended its systems, saying the limited test did not represent the experience of the millions of listings and reviews published on its platform. The company noted that because the Which? listing was never "live" on its site during the two months it was present, some of its automatic fraud controls were not triggered to fully remove the closed listing. In practice, the property could only be viewed and requested during a 20-minute window that Which? opened so its researchers could attempt a booking.

A government spokesperson weighed in on the wider issue, stating that the law is clear: online platforms covered by the Online Safety Act, including Booking.com, have a legal duty to ensure their sites do not serve as a forum for material intended to scam the public, and they must remove such content when it is found. The spokesperson warned that platforms failing to protect users from illegal fraudulent content could face consequences, including fines, and said the regulator has the government's full backing to take action.

Booking.com reiterated its position on the Pollard case, stressing that all impacted listings were removed and that customers with future stays were contacted and supported. Depending on individual circumstances, that support could include relocations, refunds or free cancellations. The company has not indicated whether it will review its fraud detection procedures or its communication with partners in light of the incident.

The episode highlights the vulnerability of small businesses to increasingly sophisticated cyber attacks, as well as the heavy reputational and emotional burden that can follow when criminals operate under a legitimate company's name. For Pollard, the priority now is recovering her business and restoring trust with genuine customers — a task made harder by the sheer scale of the fraudulent activity carried out in her company's identity.