Enlarge (credit: Getty Images)

For almost five years, Booking.com customers have been on the receiving end of a continuous series of scams that clearly demonstrate that criminals have obtained travel plans and other personal information customers provided to the travel site.

One of the more recent shakedowns happened to an Ars reader who asked not to be identified by his real name. A few months ago, Thomas, as I’ll call him, reserved and paid for a two-night stay scheduled for this July in a hotel in Italy. Here’s the legitimate reservation:

The real reservation from Booking.com.

Last week, out of the blue, he received two emails. The headers show that the first message came from the genuine Booking.com domain. It purported to have been sent on behalf of the hotel in Italy and asked that he click a non-existent confirm button for his upcoming stay. It informed him that the hotel would “also transfer all bookings made from that address to your account.” As phishy as that sounds, the email included his full name, the confirmation number of his reservation, the correct name of the hotel, and the dates of his stay.