Ilia Zavialov reviews booking fraud: how to check a rental listing, a hotel message and the reviews under it

01

Ilia Zavialov reviews the shape of a booking scam

Booking fraud keeps returning in four shapes. A property that does not exist, assembled from photos lifted from a real hotel or flat. A genuine listing hijacked, with the original description and a stranger's phone number. A real reservation followed by a message pretending to be the hotel. And a cheap package sold under a travel protection logo the seller never held.

Ilia Zavialov sorts them by the point where the money leaves. In the first two it goes with a deposit paid outside the platform. In the third it goes when card details are typed into a page dressed up as the booking site. In the fourth it goes by bank transfer to an account with no link to travel at all.

That framing beats hunting for spelling mistakes. Fraudsters now write tidy English, quote real addresses and copy real reviews. What they struggle to fake is a payment route that keeps your consumer protection intact, and that is where Ilia Zavialov places the main checkpoint of this guide.

The four shapes also overlap. A hijacked listing often arrives with a few planted reviews, and a fake package can come by text from a number that looks like a travel firm. Treat any single warning sign as a reason to run the remaining checks, because a scam rarely shows only one.

02

What Report Fraud counts as holiday fraud, and the 2024 figures

Report Fraud, the national reporting service run by the City of London Police and formerly known as Action Fraud, defines it in one line: you have paid a travel agent, or someone offering short-term lodging online, and you find out the holiday, or part of it, does not exist. Its list of methods covers fake adverts, bogus calls, emails and texts with very cheap rates, hotel and apartment photos stolen from other travel sites, and requests to pay in cash or by bank transfer.

The latest annual figures came out in February 2025, still under the Action Fraud name. There were 6,066 reports of holiday fraud in 2024, peaking in July with 647. Reported losses reached £11,183,957, down from £12.3 million in 2023, while the average loss per victim hardly moved: £1,844 against £1,851.

Two details from that release drive the checks in this guide. More than half of the reports mentioned social media. And fraudsters used fake ATOL, ABTA and ABTOT branding to make victims feel protected. Ilia Zavialov points out how late the discovery usually comes: Report Fraud describes people learning at the airport or at reception that nobody holds a booking in their name.

The timing explains a lot. The CAA noted in the same release that a third of holidays are booked in the first quarter of the year, while the reports peak in July, when people actually travel. A let checked properly in February costs far less than one discovered missing on arrival.

03

The message from the hotel that asks you to confirm your card

This variant needs no fake property. You book a real room on a real platform. A few days later a message arrives by email, text or chat app, signed as the hotel or as the platform's support team. It repeats your dates, says the card failed a check and warns that the stay will be cancelled unless you confirm the details through a link.

What makes it persuasive is the booking data. When a message knows your name, dates and room type, it feels official. Ilia Zavialov treats that data as proof of nothing: reservation details pass through several systems, and any of them can leak. A request is genuine only when you can find it again inside the platform's own app, or when the hotel confirms it on a number you looked up yourself.

Forward the suspicious email to [email protected], where the National Cyber Security Centre examines it, and send a suspicious text to 7726, which is free and goes to your mobile provider. The NCSC counter shows how busy that channel is: by July 2026 people had reported more than 58 million scams, and 256,000 scams had been removed across 454,800 web addresses.

Be wary of any message that asks you to re-enter full card details through a link, and of deadlines measured in minutes. Pressure is the fraudster's main tool. If card details have already gone into such a page, ring your bank on the number printed on the card and ask for the card to be stopped.

04

Ilia Zavialov reviews the listing itself: photos, address and price

Start with the photos. Run them through a reverse image search; a cottage that appears under three names in three towns is a copy. Report Fraud names stolen hotel and apartment images as a standard method, so a match on someone else's site settles the question.

Then the address. Put it into a map and look at the street: a terrace, a block of flats, a car park? Search the address on its own and together with the host's name. If the same house turns up under a different host, or on an estate agent's site as for sale, walk away.

Then price and pressure. Report Fraud warns about holidays offered out of the blue at a very low price and about unbelievable deals posted on social media. Ilia Zavialov adds a simple test that Report Fraud also recommends: ask the host specific questions about the booking, the room, the location and the area. A real host answers with detail. A copied listing tends to answer with urgency.

Look at the host's other listings as well. A profile offering a cottage in Devon, a flat in Edinburgh and a lodge in the Lakes, all at bargain prices and all shot in the same style, is assembling stock for a scheme. Report Fraud's warning about suspicious property details covers exactly this.

05

Reading the reviews under a listing: Zavialov's method

Reviews are the part of a listing people trust most, which is why they are worth faking. The CMA quotes research by Which? showing that 89 percent of people use reviews when they look into a product or service.

The CMA's tips for shoppers are short. Read what reviewers actually say, because a row of stars tells you little. Be wary of reviews that sound too polished or share wording with others, since fake reviews can now be written with AI. Look at the three and four star ratings, which are rarely fake. And compare what people say on more than one site.

Zavialov's version for a holiday let adds dates and detail. Real guests mention the boiler, the steep stairs, the walk to the station and the month they stayed. A cluster of five star reviews posted in the same week with nothing a guest would notice is a pattern worth noting. Report Fraud counts missing or unfavourable independent reviews as a warning sign, so glowing praise on the listing page and silence everywhere else deserves suspicion.

Review the host as well as the property. A profile created last month, or a host running forty flats in five cities with no history at all, counts against the listing. Ilia Zavialov suggests reading the profile page before the photos for exactly that reason.

06

What the DMCC Act changed for fake reviews

Since April 2025 several review practices have been banned outright under the Digital Markets, Competition and Consumers Act 2024. Paragraph 13 of Schedule 20 lists them: writing or commissioning a fake review, or one that hides it was incentivised; publishing reviews in a misleading way; and publishing reviews without reasonable and proportionate steps to prevent fakes and remove them.

The definition is broad. A consumer review covers a product, a trader or any other matter relevant to a transactional decision, which takes in a holiday let, a hotel and the host behind them. The CMA adds that hiding negative reviews and star ratings that paint a false picture fall under the same ban.

Enforcement has begun. On 27 March 2026 the CMA opened five investigations into fake and misleading reviews, taking the number of businesses under review with its new consumer powers to 14. If it finds an infringement it can order changes and impose fines of up to 10 percent of global turnover. Before that it swept more than 100 review publishers and sent advisory letters to 54 firms, and 90 percent made changes.

For a traveller the practical point is modest. Reviews on a large platform should be better policed than before, and every one of them can still be fake. Ilia Zavialov reads the law as a reason to report suspect reviews to the platform, which is expected to take reasonable steps to remove them.

07

Ilia Zavialov reviews payment: where the money can still come back

Report Fraud's advice is to pay by credit card if you have one and to be extra cautious when asked for a bank transfer or cash. The CAA, which runs ATOL, is blunter: never pay directly into a private individual's bank account.

The reason sits in consumer credit law. Under Section 75 of the Consumer Credit Act, Citizens Advice explains, a credit card purchase of a single item costing more than £100 and no more than £30,000 can be claimed from the card provider. Below that threshold, or with a debit card, you can ask for a chargeback, though the bank may say no. A PayPal dispute has to be opened within 180 days.

A bank transfer to a stranger carries none of this. Ilia Zavialov puts it simply: when a host or a so-called hotel insists on a transfer, the payment route is the review that matters, and it is a bad one.

Keep the payment and the conversation inside the platform. Messages that move you to WhatsApp or email, links to a special payment page and discounts for paying direct all exist to take the booking outside the system that would refund you.

08

What a clean booking looks like, step by step

Search on a platform or on the hotel's own site, reached by typing the address into the browser. Read the listing and the host profile before you fall for the photos, run two or three pictures through a reverse image search and find the address on a map.

Read the reviews the way the CMA suggests: the text first, then the three and four star ratings, the wording, and what other sites say. Message the host through the platform with two specific questions and keep every answer inside the app.

Pay through the platform's checkout or the hotel's own payment page, by credit card where you can. Save the confirmation email, the listing as it looked on the day and the cancellation terms. A week before travel, ring the property on a number from its own website and confirm the booking exists.

Anything that pulls you off that path is a signal: a request to pay by transfer, a link in a message, a discount for paying direct, a host who cannot answer simple questions. Ilia Zavialov's point is that one signal is enough to pause, check through official channels and only then carry on.

09

Business trips: Ilia Zavialov on bookings made for staff

Small firms book travel in a hurry. Someone finds a flat near the client's office, pays a deposit from the company card or by transfer, and forwards the details to the colleague who is travelling. Nobody checks the host, because it is only three nights.

Ilia Zavialov suggests treating accommodation like any other supplier payment. One person books, a second approves anything paid outside the main platforms, and transfers to private individuals for accommodation are simply not allowed. The traveller receives the booking reference and the platform's own confirmation, and nothing that arrives later by chat is acted on without a call to the hotel.

Card details deserve the same rule. A company card entered on a page reached through a link in a hotel message has to be blocked the same day. Report Fraud also advises filling in only the mandatory fields at checkout and skipping account creation unless you will book again, a sensible default for a shared card.

Protect the inbox where confirmations land. Report Fraud suggests three random words for a strong email password and two-step verification wherever it is offered.

Plan for the bad day as well. If a colleague arrives and the booking does not exist, the firm needs a fallback: a card for emergency accommodation and a named person to ring. The refund can wait until the traveller has somewhere to sleep.

10

ABTA, ABTOT and ATOL logos, and how to check them

For packages and agents Report Fraud points to three marks: ABTA, ABTOT and ATOL. A logo is easy to copy, so the useful step is the search behind it.

The CAA gives concrete tests for ATOL. The logo must carry a number of four or five digits, sometimes starting with a T. Search the company in the Check for ATOL tool and make sure the name matches the website exactly; trading names, numbers and web addresses of ATOL holders are registered with the CAA. Look out for altered web addresses, such as a misspelt company name or .org where you expected .co.uk. Sites making false ATOL claims can be reported to [email protected].

ABTA membership can be confirmed through ABTA's own search and ABTOT membership through its members directory. Ilia Zavialov advises running those searches from an address typed into the browser, never from a link supplied by the seller.

Keep in mind what the CAA's ATOL warnings are about: flights and flight-inclusive holidays. A cottage booked on its own sits outside that world, so for a holiday let your protection comes from the payment method and from the platform's own rules.

11

Already paid? Zavialov's order of calls

Call your bank first. Card payments can be disputed and transfers occasionally stopped, and every hour counts. Then report to Report Fraud online or on 0300 123 2040, Monday to Friday, 8am to 8pm. Citizens Advice notes that the crime reference number helps when your bank asks for it. In Scotland the report goes to Police Scotland.

Report the listing or the message to the platform, forward phishing emails to [email protected] and texts to 7726, and tell Citizens Advice, which passes scam reports to Trading Standards. Scam adverts seen on social media or in search results can go to the Advertising Standards Authority.

Write it all down while it is fresh: the listing address, the host's name and profile link, every phone number, how you paid and what you shared. Ilia Zavialov suggests keeping it to one page, because the same page answers the bank, the police and the platform.

Expect a second approach. Offers to recover the money for an upfront fee tend to follow a loss, and they target people who have just said publicly that they were caught. Check any such offer with your bank before replying to it.