Eurovision 2023: Hotel phishing scam targets song contest fans

Eurovision fans who booked rooms for May’s song contest in Liverpool have had their data put at risk by scammers targeting hotel chains.

Booking.com confirmed to BBC News that “some accommodation partners were targeted by phishing emails” but denied it had suffered a data-security breach.

Customers are advised to speak directly with their hotels if they have any concerns.

The travel company said “multiple accounts” were affected by the cyber attacks which were “quickly closed”.

It claimed that some businesses had “accidentally compromised their own internal systems by clicking on links contained in these messages”.

BBC News has been unable to verify how the scammers obtained the customer data. However, in May a number of fans of the song contest contacted the BBC’s Eurovisioncast podcast, outlining their experiences of near-falls involving scandals related to accommodation booked for Eurovision.

Booking.com said it was “actively supporting our partners as well as any potentially affected customers” and continued to “make security and data protection a top priority”.

Marc Deruel booked an apartment through the travel site, for himself and three friends, for what he says was a “very good price” in Liverpool during the competition.

In early February he was contacted on WhatsApp by someone claiming to be a receptionist, initially asking if he needed parking, and then claiming there was a problem with his payment, similar to The problem shows up on their Booking.com account.

“I thought it should be fine,” he told BBC News. “I got a text message from my bank and I had a phone call from them saying someone is trying to cheat me out of my money.”

Around £800 was being transferred to Uganda but the transaction was cancelled.

“I felt really stupid because I’ve never been this close to a scandal,” he says. “It just took the fun out of it and I don’t want to go anymore because they’ll know all my details and know I’m away from home, so I canceled.”

Mark calls his accommodation supplier, who tells him that he has heard similar stories, which the BBC has been able to confirm.

UKHospitality, which represents more than 700 companies, says if customers have concerns, it is best to deal with hotels directly rather than through third-party booking platforms.

“Hotel will very rarely contact you on WhatsApp,” says Kate Nicholls, chief executive. “For the first time you have especially a lot of young people who normally wouldn’t book and travel for these events and [scammers] Exploiting the weak.”

Such phishing scams are believed to be bigger than Eurovision and the city of Liverpool.

Booking.com confirmed that any valid transaction would not require the customer to provide credit-card details by phone, text message or email.

All the build-up, insight and analysis is explored each week on a new BBC podcast called EurovisionCast.