The European Commission opened formal proceedings against Booking.com on October 21, 2026, over suspected failures to control fake accommodation listings, reservation-linked phishing attacks and search placements that may not clearly disclose when hotels have paid for better visibility.
The investigation under the Digital Services Act (DSA) creates a potential regulatory problem for Booking Holdings, the U.S.-listed parent of Booking.com, but no violation has yet been established and no penalty has been imposed. The central issue is whether one of Europe’s largest travel platforms has adequately assessed and reduced the ways criminals can exploit its marketplace and communications tools.
The probe is particularly important because a phishing message that contains authentic booking details may appear far more credible than an ordinary spam email. Regulators are asking not only whether fraudulent listings are removed, but whether the platform’s design, partner relationships and paid-ranking features give scammers opportunities that the operator should have anticipated.
What Exactly Is the European Commission Investigating?
In its October 21 announcement, the Commission identified three distinct areas of potential non-compliance: fraudulent or otherwise unlawful accommodation listings; phishing that exploits reservation and guest information; and paid-for boosted listings that users may not recognize as advertisements.
The first category includes properties that may not exist, people falsely posing as the owners of real accommodation, and offers that do not comply with relevant requirements. An apparently bookable property could result in a customer paying for a stay that cannot actually be provided.
The second category concerns scams exploiting information shared between Booking.com and accommodation providers, including the way the platform’s messaging functions operate. The Commission will examine whether the company appropriately identified the dangers and established effective defenses.
The third category is a transparency question. Accommodation providers may pay more to gain visibility in search results, but consumers must be able to distinguish advertising from ordinary search rankings. The Commission suspects some boosted listings may not be sufficiently recognizable as paid promotions.
These are allegations requiring investigation, not three established breaches. The Commission’s action does not amount to a conclusion that every promoted listing is deceptive, every accommodation partner is vulnerable, or that Booking.com’s central customer database was compromised.
Why Are Genuine Reservation Details Valuable to Phishing Criminals?
Traditional phishing commonly relies on a generic request to reset an account password or verify a payment. Travel-booking scams can be more convincing because a hotel or its service provider may have legitimate access to reservation dates, a guest’s name and contact information, and other booking-related details.
If an attacker gains access to a property partner’s account or communication channel, they may be able to impersonate the accommodation provider and reference a genuine reservation. A request for an additional deposit, card verification or urgent confirmation can therefore look like an ordinary continuation of a transaction the guest actually initiated.
Such attacks can combine authentic context with a fraudulent payment destination. The critical risk is not necessarily a false booking at the outset: a real customer may have reserved a real hotel and only later receive a deceptive instruction from someone impersonating the property.
The Commission is examining whether the platform’s procedures adequately address these risks, including how reservation information is used and how messages appear to travelers. It has not publicly concluded that a specific technical flaw in Booking.com’s own systems caused the incidents under review.
The distinction parallels the exposure of historical customer data held by brokerage infrastructure provider DriveWealth. In both settings, customers deal with a recognizable front-end brand while other businesses may legitimately handle sensitive information. The DriveWealth incident was separate, but illustrates why security responsibilities extend beyond the most visible application.
Why Is the DSA Case More Than an Ordinary Consumer Complaint?
Booking.com was designated a Very Large Online Platform under the DSA in April 2023, placing it under additional EU requirements to assess systemic risks and adopt proportionate mitigation measures. The EU framework does not only require platforms to respond after receiving an individual complaint about illegal content; it also expects operators to examine how their services create risks at scale.
The Commission’s decision followed a preliminary review of Booking.com’s risk assessments for 2026 and the preceding three years, transparency reports and responses to formal requests for information. This was therefore not the regulator’s first contact with the company over fraud concerns.
In September 2025, the Commission specifically asked Booking.com how it identifies fake accommodation listings and verifies businesses using its service, alongside inquiries directed at several major search and app platforms.
The latest formal proceedings allow the Commission to seek further documents, question the company and investigate potential failures in risk assessment, risk mitigation and advertising disclosure. It may ultimately accept commitments, pursue interim measures or issue a non-compliance decision, subject to the applicable legal process.
There is no automatic deadline for completing the investigation. Opening proceedings also does not prejudge the outcome or replace enforcement under other EU laws, including privacy and consumer-protection rules.
The distinction between exposing private data and deceiving a user is useful here. An earlier Mitsubishi UFJ eSmart Securities phishing warning showed that criminals can capture authentication details through imitation interfaces without proving that a firm’s central systems were hacked. Booking.com’s case similarly calls for examination of where an attack starts, who controls the communication channel and what safeguards the platform provides.
What Is the Financial Risk for Booking Holdings?
The DSA allows penalties of up to 6% of worldwide annual turnover for qualifying infringements. That ceiling establishes the possible scale of enforcement; it is not the fine Booking.com faces today, and applying 6% mechanically to Booking Holdings’ market value or a quarterly revenue number would not produce a reliable forecast of a penalty.
Any final consequence would depend on which obligations, if any, the Commission finds were breached, the legal entity involved, the seriousness and duration of violations and other relevant factors. The company could also face costs from changes to merchant verification, messaging security, listing reviews and advertising disclosures, even without a maximum fine.
For the business model, the paid-ranking question has a different potential effect from phishing prevention. Better identification of sponsored placements may change how customers respond to listings, while tighter controls on accommodation providers could increase onboarding costs or slow the acceptance of new properties.
There is no basis at this point to quantify lost bookings, forecast reductions in conversion rates or estimate a financial reserve. The Commission has not published an audited total of bookings lost to fraud on the platform or an associated damages award.
Booking.com said it is cooperating with the investigation and considers security, trust and personal-information protection priorities. It also emphasized cooperation with authorities and other industry participants in combating online fraud. Its response is a statement of position, not proof that the Commission’s concerns have been resolved.
What Would Meaningful Anti-Fraud Improvements Look Like?
The most useful evidence for regulators will be whether Booking.com’s controls reliably prevent suspect properties from going live, identify compromised accommodation accounts and detect payment requests that redirect guests away from legitimate transaction channels.
Measures might include stronger validation of property operators, more robust authentication for partner accounts, warnings around unusual payment changes and faster review of reported listings or messages. Those are potential areas for technical assessment, not a claim that the Commission has formally ordered a particular product design.
Advertising disclosure also requires its own audit trail: travelers should be able to understand when paid commercial arrangements influence listing prominence, without mistaking promotional ranking for independent quality or safety verification.
The Commission’s October 20 study of online financial scams identifies business-customer verification, effective detection and removal, user reporting tools and cooperation as broad defensive approaches. The study does not assess Booking.com’s individual legal compliance, so it should not be treated as an additional finding against the company.
Until the investigation provides more evidence, travelers should independently verify unexpected payment requests, avoid supplying card credentials through unfamiliar links and contact an accommodation through an established channel if a message suddenly changes payment instructions. A genuine booking number alone does not authenticate the person asking for money.
Comparable risks have emerged in paid online promotion. DaveFinances previously examined a fraudulent sponsored search result impersonating the Safe crypto wallet. That separate case shows why advertising presentation and the identity of the advertiser can matter for fraud prevention, even when the advertised service itself is legitimate.
The October 21 proceedings leave Booking.com facing three specific regulatory questions: how it keeps fake accommodation offers off the marketplace, how it protects reservation-based communications against impersonation and how clearly it identifies commercial promotion. Whether those concerns produce commitments, operational changes or a fine remains undecided.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574