40 Fake Booking.com Sites/Day: AI-Powered Phishing Targets UK Travelers

For cybersecurity professionals, the explosion of AI-driven brand impersonation represents a significant escalation in the phishing threat landscape. The ability to instantly generate near-perfect replicas of trusted travel sites not only defeats traditional URL inspection by consumers but also challenges automated detection systems, raising urgent questions about how to defend against mass-scale, low-cost deception campaigns.

A surge in highly convincing fake travel booking websites is threatening UK consumers during the peak summer holiday season, with cybersecurity researchers at NordVPN reporting that approximately 40 counterfeit Booking.com domains were being detected each day during the February half-term booking peak. The trend has continued into July as families scramble for last-minute getaways, and the threat is exacerbated by artificial intelligence tools that allow scammers to create replicas of trusted booking sites that are virtually indistinguishable from the genuine articles. Booking.com alone accounts for around three-quarters of all fake travel websites detected so far this year, far outpacing any other travel brand. Airbnb, the second most targeted platform, trails significantly.

“

Marijus Briedis, chief technology officer at NordVPN, warns that the psychology of the scam is as damaging as its technology: the speed of transaction around an irresistible deal leaves no time for scrutiny.

The campaign leverages the universal trust placed in a household brand, with victims typically lured by offers too good to refuse—hotels listed at half the going rate. In the rush to secure a perceived bargain, travelers transfer payment and provide personal and banking details directly to fraudsters. By the time the booking is confirmed as non-existent, the holiday is ruined and financial data is compromised. Marijus Briedis, chief technology officer at NordVPN, warns that the psychology of the scam is as damaging as its technology: the speed of transaction around an irresistible deal leaves no time for scrutiny.

The role of generative AI is central. Where once phishing sites could be spotted through clumsy design, spelling errors, or inconsistent branding, today’s replicas are often pixel-perfect. Kate Allen, owner of Finest Stays, describes the fakes as 'incredibly convincing,' noting that the technology has effectively erased the visual cues that once protected users. This evolution represents a paradigm shift in consumer fraud: threat actors can now mass-produce custom-branded lures with minimal effort, rotating domains faster than takedown services can respond.

The implications extend beyond individual financial loss. The integrity of the entire online travel booking ecosystem is at stake. If consumers lose confidence in the safety of platforms like Booking.com, the economic impact could ripple through an industry still recovering from pandemic disruption. For Booking.com, the reputational damage is acute even though the company is itself a victim of impersonation—each defrauded traveler associates their loss with the brand. The phenomenon also raises questions about the liability and responsibility of hosting providers, domain registrars, and search engines that may inadvertently surface fake listings in search results.