Is Expedia a Scam?

If you’re thinking of using Expedia, you need to know whether it’s safe. Is Expedia a scam? 

Below, we explain whether Expedia is a scam and discuss some steps you can take to improve your safety while using this travel booking platform. 

What Is Expedia?

Expedia is an online service that lets you search for and book travel-related services, like flights, stays, cars, packages, cruises, and things to do. 

The platform pulls different options from different travel providers, acting as a middleman and making it easier for you to compare prices and book everything in one single place. 

The company was founded in 1996. It is headquartered in Seattle, Washington.

Is Expedia a Scam?

No, Expedia is not a scam. It’s a legitimate online travel booking platform. 

Several third-party publications have reviewed Expedia, including NerdWallet, New York Post, CNBC, and Which? (the latter looks at Expedia car hire specifically).    

The consensus seems to be that the platform provides a straightforward, user-friendly booking experience as well as good deals through bundling and last-minute sales, but booking directly with hotels or airlines often provides better prices, clearer cancellation policies, and more rewarding loyalty programs. 

User reviews of Expedia are mixed as of this writing, but lean more negative:

• 1.2 out of 5.0 stars (from over 10,000 reviews) on Trustpilot. 
• 1.1 out of 5.0 stars (from over 6,000 reviews) on Consumer Affairs.
• 1.04 out of 5.0 stars (from over 1,500 reviews) on Better Business Bureau.

Individuals complain about unhelpful customer support and long wait times, refund problems, and booking errors. 

On online forums like Reddit, people describe mixed experiences with Expedia.

Several users report using Expedia for a decade plus without any issues. 

Others say Expedia’s customer service is a nightmare to deal with when something goes wrong. A number of users also report reservations that never actually made it to the hotel or airline, leaving them stranded. Refund delays likewise seem to be a recurring issue. 

Expedia is a Better Business Bureau-accredited business and holds an “A+” rating at the time of writing. BBB ratings reflect how the BBB thinks a business interacts with its customers. 

As of this writing, Expedia has received a total of 7,320 complaints on the BBB website in the last three years, 2,848 of which have been resolved in the past 12 months. 

Complaints include difficulty getting help, customers feeling like they’re caught between hotels and Expedia not wanting to take the blame, and feeling abandoned. 

Expedia impersonation scams

Though Expedia is not a scam itself, scammers like to impersonate it.

At the moment, there is an alert on Expedia’s BBB profile, warning consumers that scammers pretending to be Expedia customer service representatives are placing fake phone numbers in search engine ads, then using Expedia’s itinerary lookup tool to gain victims’ trust before tricking them into purchasing gift cards as fraudulent payment for trip changes or refunds. 

Though the alert is from 2019, the scam is still ongoing, as evidenced by internet user warnings. 

One user writes:

“i went on google and searched up expedia for one of my flights because i wanted to buy an extra bag (not knowing you do NOT do this with expedia but rather the airline themselves, so please dont fall for this!!!). Turns out they said something along the lines of “oh your flight wasnt confirmed and you need to pay an extra $220 PER person”. And the weird part is you have two options either: zelle them the money or give them your bank details. So very huge red flag for me, thankfully i called expedias real number on time and they told me it was a scam but because of this i realized something huge that i think everyone can take away from this.”

Expedia lawsuits

Over the years, Expedia has faced several lawsuits. 

In 2020, a class action in California alleged that a cloud misconfiguration exposed tens of millions of personal records from Expedia and affiliated booking sites, including names, contact details, national ID numbers, and full payment card data, allegedly stored without proper security controls or PCI-DSS compliance.

The lawsuit also claims that affected customers learned of the breach from media reports rather than timely notices from Expedia or its partners, and that the exposure implicated rights under the California Consumer Privacy Act and related laws.

In 2025, a class action lawsuit accused Expedia of failing to issue refunds for canceled flights as promised.

Expedia security 

The below section looks at Expedia’s security measures and security incidents. 

Expedia’s security measures 

In its privacy policy, Expedia briefly describes its security measures. 

It states that it is committed to protecting your personal data through industry-standard security measures, including encryption, access controls, multi-factor authentication, and certifications like PCI-DSS.

It also says that it trains employees and holds its partners to high standards. 

If a security incident occurs that affects your data, Expedia will notify you and the relevant authorities as required by law.

Expedia security incidents

Expedia has suffered several security incidents throughout the years. 

In 2018, Orbitz (acquired by Expedia in 2015) suffered a breach exposing up to 880,000 payment cards and personal data like names, emails, phones, and addresses from 2016-2017 transactions. 

A few years later, in 2020, an unsecured AWS S3 bucket linked to Expedia and affiliates exposed millions of records, including credit cards, passports, and addresses dating back to 2013, sparking class actions.

Expedia privacy  

Expedia explains in its privacy policy the kind of personal data it collects, why, and with whom it shares it. 

It may collect the following information:

• Government IDs: Passport, driver’s license, and tax ID. 
• Contact and identification information: Name, email address, phone number, and address. 
• Payment data: Card numbers, bank accounts, and billing address. 
• Travel preferences: Destinations, dietary needs, and accessibility requirements. 
• Loyalty program data. 
• Geolocation: IP-based and, with consent, precise location. 
• Images, videos, and voice recordings.
• Device data and browsing behavior. 
• Communications with customer service: Including AI chatbots. 

The platform collects this data directly from you when you book or create an account, automatically via cookies and tracking technology, from other Expedia Group companies, and from third-party partners and data providers. 

Expedia may use this data for bookings and payments processing, customer service and communications, marketing, targeted advertising, loyalty program administration, fraud detection, security, market research, analytics, training AI systems, and improving services.

The platform may share your data with other Expedia Group brands, travel suppliers (e.g., hotels, airlines, and car rentals), third-party service providers, marketing and advertising partners, social media platforms, law enforcement (when legally required), and parties involved in corporate transactions. 

Expedia states that your data may be processed in the US and other countries. The platform uses safeguards like Standard Contractual Clauses, Data Privacy Framework certifications, and Global Cross-Border Privacy Rules (Global-CBPR) certification.

Depending on where you live, you may have certain rights, such as the right to:

• Access, correct, or delete your data.
• Opt out of marketing emails.
• Withdraw consent.
• Control cookie preferences.
• Object to certain processing.
• Opt out of data sales (for some US residents).
• Request portable copies of your data.
• File complaints with data protection authorities. 

The platform notes that it uses AI/ML for pricing and price alerts, fraud detection, chatbots and virtual assistants, search ranking and recommendations, content moderation and generation, and insurance offerings. 

It says that it doesn’t make fully automated decisions with legal or major effects unless required by law, needed for a contract, or you consent.

You can request a manual review of automated decisions in certain cases.

Expedia states that it keeps your data for as long as needed for bookings, accounts, or legal requirements, and longer only if required for legal, tax, or security reasons. It may also keep your data if it deidentifies, aggregates, or otherwise anonymizes it. 

Expedia’s privacy policy has been evaluated by the Common Sense Privacy Program, which has given it a “Warning” rating. This means the “Does not meet our recommendations for privacy and security practices.”

The Common Sense Privacy Program has given Expedia this rating because it says it shares data for third-party marketing, displays personalized advertising, and allows third parties to collect data for their own purposes. 

It also says that Expedia uses users’ information to track and target ads on other third-party websites and creates and uses data profiles for personalized ads. 

So, Should You Use Expedia?

Depends.

Expedia works fine when everything goes smoothly. The risk is that if something goes wrong, you may have a frustrating experience trying to get it resolved. 

How to Use Expedia Safely and Privately 

• Only contact Expedia through verified official channels. Do not trust phone numbers from Google ads or search results. Instead, always go directly to Expedia’s official website or app and use the Contact Us section there. Also, remember that Expedia will never ask for gift cards, Zelle, wire transfers, or your bank login details.
• Confirm your booking with the hotel, airline, etc. Some users report reservations never reaching the provider, leaving them stranded with Expedia and the hotel blaming each other. To avoid this from happening, after booking through Expedia, immediately confirm the reservation directly with the hotel or airline. 
• Document everything. Save screenshots of booking confirmations, cancellation terms, refund timelines, and customer support chats. That way, if refunds are delayed or disputed, you have evidence that can help with chargebacks, complaints, or legal escalation.
• Unsubscribe from marketing. Use the “Unsubscribe” link in any promotional email from Expedia or via your account settings.
• Opt out of targeted advertising where available. Expedia explicitly shares data with ad and social media partners for targeting. Limit cookies by using the controls in Expedia’s Cookie Statement and your browser settings.
• Be intentional with what you put in your profile. Only add travel preferences, profile photos, or personal details if you actually want personalization. Skip optional fields unless they’re required for a booking.
• Protect your Expedia account. Turn on multi-factor authentication (they already use one-time passcodes in some cases), use a unique password you don’t use anywhere else, and regularly review account activity, bookings, and saved payment methods.
• Limit payment data exposure. Avoid saving payment cards unless you frequently make bookings through Expedia.
• Manage location tracking. If you use the Expedia mobile app, review location permissions and turn off precise location unless needed. Use browser location permissions carefully on desktop.
• Exercise your data rights. You can request access to your data, ask for corrections or deletion, withdraw consent, and object to certain processing (including automated decisions where applicable).
• Limit long-term data exposure. Consider deleting your account if you stop using Expedia.