Fake Booking.com Loyalty Points Redemption Scam
Fraudsters impersonate Booking.com with messages claiming your Genius loyalty points or wallet credit are about to expire, luring you to a phishing page that steals your account credentials and saved payment details.
Part of: Fake Loyalty Points Redemption Scams
Last reviewed: 8 June 2026
Booking.com operates a tiered loyalty programme called Genius that offers discounts and perks to frequent travellers, and a Booking.com Wallet that stores credits. Scammers exploit travellers' awareness of these real features by sending urgent expiry warnings for points or credits that do not actually expire in the way described.
The phishing message is timed to reach travellers during peak booking seasons — spring and autumn — when people are actively thinking about travel plans. The urgency of expiring loyalty value makes victims act quickly without verifying through their actual account.
Booking.com Genius status and wallet credits visible in the mobile app or website are the only authoritative source of your balance. Any external message claiming a different balance or threatening imminent expiry should be treated with scepticism until verified directly in the app.
How this scam works on the Booking.com brand
Emails arrive from domains designed to resemble booking.com — 'booking-genius.com' or 'booking-wallet-alert.net' — and replicate the brand's blue colour scheme. The message states that the recipient has earned a substantial travel credit or cash-equivalent reward and that it will expire in 72 hours if not redeemed.
The 'Redeem Now' button leads to a spoofed Booking.com login page. After the victim enters their credentials, a second screen lists their upcoming reservations (populated with vague placeholder text) and asks them to 'confirm their payment method' to receive the wallet credit, harvesting a full card number.
A smaller subset of this scam targets property owners on Booking.com's extranet, telling them that their Genius partner bonus is about to expire and directing them to a fake partner login page — compromising the property owner account instead of the traveller account.
Common red flags
- Email arrives from a domain other than '@booking.com' — Booking.com sends all official mail from '@booking.com' only
- The message quotes a specific wallet credit or points balance that does not match what is shown in your actual Booking.com app
- You are asked to re-enter your payment card details to 'unlock' a credit you supposedly already earned
- Countdown timer or 48-72 hour expiry warning that is not reflected in your account
- The sign-in page URL in your browser is not booking.com
- Genius status on Booking.com does not involve expiring points — it is a tier based on completed bookings, not a balance that depletes
How to protect yourself
- Log in directly via the Booking.com app or bookmark to check your Genius tier and wallet balance
- Booking.com Genius perks do not expire like airline miles — any email claiming expiring points is a red flag
- Enable two-factor authentication in your Booking.com account security settings
- Check your saved payment methods in your account after any suspected phishing to ensure nothing has been added
- Never type your Booking.com credentials on any site reached from an email link; always navigate independently
- If you suspect your account was compromised, contact Booking.com customer service immediately via the app chat feature
How to report it
- Report the phishing email to Booking.com at [email protected]
- Forward suspicious emails to the FTC at ReportFraud.ftc.gov
- If financial details were entered, alert your card issuer immediately
- File with the IC3 at ic3.gov if you suffered financial loss
Frequently asked questions
I'm a property host on Booking.com's extranet — am I also at risk from this scam?
Yes — a parallel version targets hosts with fake 'partner bonus' expiry messages that lead to a lookalike extranet login page. If you manage a listing, access the extranet by typing the URL yourself rather than clicking an emailed link, and review your payout settings regularly.
Can I get a refund if I already paid using a card I entered on the fake page for an upcoming trip?
That depends on exactly what you entered — if you only logged in with your Booking.com password, no payment was made yet, but if you entered a full card number on a second page, contact your card issuer immediately. Booking.com itself did not charge you; any recovery here goes through your bank or card issuer.
How do I know if an email claiming to be from Booking.com is genuine?
Check that it comes from an '@booking.com' address, and cross-reference any offer or balance it mentions against what's shown when you log in to the app directly — real communications never require you to re-enter payment details just to 'unlock' something you already have. When in doubt, ignore the email link and check your account the normal way.
Do Booking.com Genius points expire?
Booking.com Genius is a status tier — not a points balance — and it does not expire in the traditional sense. Any email claiming your 'points are expiring' is almost certainly fraudulent.
Can scammers access my saved hotel payment details through my Booking.com account?
Booking.com stores limited card information for pre-authorisation purposes. A compromised account could expose booking history and potentially stored card summaries. Change your password immediately if you suspect access.
How do I verify my Wallet balance?
Open the Booking.com app, tap your profile, and select 'Booking.com Wallet'. This is the only accurate balance — do not trust external messages quoting a different figure.