Dear Booking.com Management, Fraud Department, Legal Department and Executive Customer Relations,
Since 27 June 2026, I have continuously informed Booking.com that my account was hacked and taken over by unauthorized third parties. I immediately reported the incident through emails, phone calls, security tickets, formal complaints, and I also provided a police report filed with the Italian authorities.
More than two months have now passed, yet Booking.com has failed to provide a definitive resolution to this case.
Despite my repeated warnings, fraudulent listings remained active on your platform and I have continued to suffer the consequences of a security breach that I reported immediately. During this period, I have received hundreds of phone calls and communications related to fraudulent reservations and activities that were created without my authorization.
What is even more concerning is that Booking.com continues to send invoices and payment requests concerning activities performed through an account that was officially reported as compromised.
I must reiterate that:
I had no control over the account after the security breach.
Booking.com was notified immediately and repeatedly.
I do not accept any financial responsibility for reservations, commissions, invoices, penalties, refunds, guest claims, or other costs generated after the account compromise.
Any consequences resulting from fraudulent activity occurred after Booking.com had already been informed of the incident.
I therefore formally request:
Immediate cancellation of all outstanding invoices related to this security incident.
Written confirmation that no debt collection procedures will be initiated.
A complete written report regarding the actions taken by Booking.com following my first notification on 27 June 2026.
Confirmation that the case has been reviewed by the Fraud and Legal Departments.
A final resolution of this matter without further delay.
If I do not receive a satisfactory response, I reserve the right to escalate the matter further through the relevant consumer protection authorities, data protection authorities, legal representatives, and other competent institutions.
I am extremely disappointed that, despite being the victim of a cybercrime and despite providing extensive evidence, I am still forced to spend considerable time defending myself against charges related to fraudulent activity that I neither created nor controlled.
I expect a written response as soon as possible.
