The European Commission has launched a formal investigation into Booking.com, alleging the travel platform failed to adequately protect users from fraudulent listings and phishing scams. The probe centers on whether the Amsterdam-based company breached the EU’s Digital Services Act (DSA) by maintaining what officials described as an “absolutely substandard” approach to online safety.
Regulators argue that the website, which hosts approximately 28 million accommodation listings, has not implemented sufficient risk assessments or fraud prevention systems. A commission official stated that while the company takes some measures, its current safeguards are insufficient to stop criminals from impersonating third parties to trick travelers into handing over money.
DSA Compliance and Advertising Transparency
Under the Digital Services Act, large tech platforms face fines of up to 6% of their worldwide annual turnover if found in violation. The commission’s inquiry will also examine whether Booking.com has breached advertising transparency rules. Officials are investigating whether the site clearly discloses to users when accommodation providers have paid to boost their visibility in search results.
Henna Virkkunen, the commission’s lead official on tech policy, emphasized that the DSA sets clear responsibilities for platforms to address these risks. “Europeans should be able to book their holidays without fear of being scammed,” she said. “We must ensure that the leading booking platform in Europe takes those responsibilities seriously.”
The commission clarified that opening the investigation does not prejudge the final outcome. Booking.com responded by stating it is engaging constructively with regulators. A company spokesperson said security and trust remain top priorities and affirmed their commitment to working with law enforcement to combat cybercrime.
Rising Scam Reports and AI Threats
The regulatory action follows a surge in reported fraud cases. The Dutch consumer association Consumentenbond reported 200 scam complaints involving Booking.com in 2025, totaling €65,000 in losses. This represents a sharp increase from 89 reports worth €25,000 the previous year. The association warned that these figures likely represent only a fraction of actual incidents, as many victims do not report fraud.
Booking.com previously told the BBC that it had seen a 500 to 900% increase in scams over an 18-month period. The company attributed this rise to generative AI tools, which allow fraudsters to create highly realistic fake emails and booking links.
EU officials are scrutinizing two main categories of fraud. The first involves fake listings where consumers book properties that do not exist or are fraudulently advertised. The second, known as “reservation hijacks,” occurs when criminals use stolen data to impersonate accommodation providers. In these cases, scammers send WhatsApp messages or use the platform to request additional payments from customers to secure their stay.
High-profile cases have drawn attention to these vulnerabilities. Researchers from the UK consumer group Which? recently demonstrated security lapses by setting up and accepting payment for a fake offer to stay at 10 Downing Street. Similar scams involving less prominent addresses have left travelers stranded upon arrival at fraudulent properties.
Agustín Reyna, director general of the pan-European consumer group BEUC, welcomed the commission’s move. “It is positive to see the European Commission investigating Booking.com for failing to meet EU digital rules,” he said. “This is a systemic problem.” The investigation will assess whether the company has adequate safeguards to prevent the misuse of user and provider data.
Source: The Guardian
