The European Commission has opened an investigation into Booking.com over concerns that the platform is not doing enough to protect users from fake listings and phishing scams.
Announced Wednesday, the probe will examine whether the travel booking site meets its obligations under the EU’s Digital Services Act (DSA), which requires large online platforms to tackle illegal content and manage risks to users.
The investigation follows an initial review of Booking.com’s risk assessments, including reports filed this year and in each of the previous three years, Reuters reported. It is the first formal DSA investigation into the company.
The Commission will focus on three areas. The first is fake listings, including properties that don’t exist, scammers posing as legitimate hosts, and accommodations that fail to comply with local rules.
The second is how Booking.com protects reservation and guest data shared with hosts. That information can be exploited in phishing attacks, where scammers use genuine booking details to send messages that appear to come from the platform or a hotel.
In April, Booking.com told some customers that an unauthorised third party had accessed reservation-related information, DutchReview reported.
The third concern is advertising, and the Commission wants to establish whether properties that pay to appear higher in search results are clearly labelled as sponsored listings.
“Europeans should be able to book their holidays without fear of being scammed,” said Henna Virkkunen, the EU’s tech chief.
An unnamed senior EU official described Booking.com’s risk assessment work since 2023 as “absolutely substandard”, according to AFP.
Booking.com, which is part of Booking Holdings, said it was cooperating fully with the investigation. The company also said it would continue working with governments, regulators, law enforcement and industry partners to combat online fraud.
“Security, trust and the protection of personal information are top priorities,” the company said.
Booking.com has been classified as a very large online platform under the DSA since April 2023. The company reports more than 45 million monthly users in the EU, placing it under the law’s strictest requirements.
If the Commission finds a violation, Booking.com could face a fine of up to 6% of its annual global turnover. The investigation has no fixed deadline, and the company can offer commitments to address the Commission’s concerns.
The case adds to a wider EU effort to tackle online scams. Meta has faced a DSA investigation since 2024 over suspected scam advertising, while Poland has asked the Commission to fine the company €250 million over scam ads. Last year, the Commission fined X €120 million in the first penalty imposed under the DSA.