Booking.com and other OTAs often will book the reservation with a virtual card that they fax the details over with the reservation (or otherwise communicate the

Booking.com and other OTAs often will book the reservation with a virtual card that they fax the details over with the reservation (or otherwise communicate the virtual card payment information in the OTA extranet). What could have happened is someone compromised the hotel's side of the extranet and grabbed your (and other) bookings' virtual cards and attempted to start racking charges against them which would then go back on your card you gave for the reservation to Booking. While there's supposed to be fraud controls on the cards, who knows what could have let the extra charges fly.