Skip to content

Comment on Mysterious leak of Booking.com reservation data is being used to scam customers

Comments

People rarely realize that making a hotel booking at an OTA (mostly reduced to Expedia Brands and Priceline Brands these days) is a combination of their systems that then call the hotel systems to make the actual booking (or sometimes just a fax or email if the hotel has no IT). So information that Booking collects is mostly sent to the hotel system; there isn't any other way. Booking could add something to their side which is passed only to the customer (such as an ID of some kind) to ensure anything coming from them is legit since a leak of a hotel system would not have that. That would not help emails purporting to come from the hotel however and is likely doubtful to help much. I doubt most hotel brands would accept an email relay, they are already discounting the price to provide the OTA profit margin so not getting the actual email would be a sticking point.

Having worked at an OTA (before Expedia got us) I refuse to book at anything other than a legit hotel system. OTA's are fine for price discovery but you often get a better deal (and better service) from the hotel/brand directly. The front desk knows you booked via an OTA instead of the hotel directly.

OTA's are fine for price discovery but you often get a better deal (and better service) from the hotel/brand directly. The front desk knows you booked via an OTA instead of the hotel directly.

I know anecdotes aren't data, but I've had the opposite experience.

Front Desk: "Hey, I see you booked with Expedia. You know if you booked directly with us, you'd get a better rate!"

Me: "Oh really? Thanks! Can I book tomorrow night at the same rate as tonight?"

Front Desk: "No, sorry, tomorrow night's rate is twice as the rate you have from Expedia."

Me: "Ok, I guess I'll book at Expedia for tomorrow night as well, since they have the same rate that's half of what you're offering me."

I've had this happen so many times!

It's absurd - the flexibility to even match Expedia's rates is a slog and they act like you're asking for the world when they readily accept Expedia giving even less. Really don't understand why hotels don't bake in the flexibility to actually compete with the OTAs.

Contract from OTA (at least did when I worked) does not allow the chain/brand to undercut the OTA, in exchange for traffic. Given its mostly a duopoly (Expedia/Priceline), I guess they feel they have to give in or get cut out of business.

Reminds me of my travels in Iceland.. arrive around 10PM (it was still daylight in summer), ask if they have a room with a discount; they'd rather have a guest paying less rather than an empty room. At one place the guy configuring the room for me told his colleague he's giving me the room with the OTA rate, i.e. what they would've earned if I had booked with an OTA..

Me too, always cheaper on Booking.com.

When asked directly, they just tell me to book on Booking.com.

I've had this same experience multiple times with US hotel chains.

OTA's are fine for price discovery but you often get a better deal (and better service) from the hotel/brand directly. The front desk knows you booked via an OTA instead of the hotel directly.

That used to be more true in the past, but recently OTA's are beginning to offer better rewards programs, as well as making your trip more 'interconnected' (having one place to get flight, hotel, cars, events, activities, etc.), so now I'd say "it depends". Lately though, the bigger hotel chains themselves are also starting to introduce their own rewards, so we'll see what happens

My experience is from when I worked at the now defunct (but still a brand) OTA. Likely the two remaining OTA systems have evolved to stay relevant. Hotel chains will then evolve again themselves, it's like a war.

For some reason my experience has been the opposite: higher prices when going through the hotels directly. My thoughts were that clients booking directly are not really comparing so less price sensitive and thus the hotel charges them more. The difference has often been around 10%.

The UI of hotels website is also often terrible and I absolutely do not trust them with my credit card info (nor do I wish to send them a SEPA deposit which I have seen at more than one place).

For flights on the other hand I take the airline website any day.

For flights on the other hand I take the airline website any day.

Sometimes identifying “the airline” isn’t straightforward.

Found a great routing+price: Toronto-Philadelphia-Paris on an OTA, all on AA metal.

But the fare wasn’t available on AA.com, you had to find it on Iberian’s website which booked some of the legs through a Finnair codeshare.

Currently travelling in India. Tried booking hotels and domestic flights with mastercard/visa, but nothing worked. Called my bank and they said their system show no rejected transactions so the block must be on Indian side.

So had to book on booking.com and other multinational sites.

They are not even necessarily connecting to the hotel-systems themselves. Often they connect to a middleman, which connects to the global middleman, which connects to the hotel (or maybe has a middleman on this side too). OTA-Business is a whole nest of snakes biting snakes, sometimes you are the first in the line, sometimes, you are the last in the line.

The biggest reason for me to use an OTA is the free cancellation policy, I've never found any hotel site that has the kind of flexibility I'm looking for.

Do the OTAs also transmit the credit card number (and CVC?) in plain text to the hotels?

One time I had a not so nice experience with a hotel. They promised a partial refund, but also a threat that they'll re-charge my CC the full amount if I wrote a bad review. No such refund came, I wrote a bad review, then they talked to me and did actually refund me. But how could they re-charge my CC without the CC info? I smell a violation of PCI DSS there.

That smells like a card-not-present transaction, for which a chargeback is much harder to defend against.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.