Comment by lol768

The messaging system is full of disclaimers ("The content of the message from Malmaison was not generated by Booking.com") and, looking at a message I've received, it doesn't even support links. Anyone getting phished would have to manually type in a URL in their address bar if this was the vector used.