Booking.com faces EU investigation over fake listings and phishing scams

Booking.com is facing a formal European Union investigation over fake accommodation listings, phishing scams and paid search rankings that may not be clearly identified as advertisements. Brussels wants to establish whether the popular travel platform is doing enough to protect customers from fraud and comply with European rules on online transparency.

The European Commission announced the investigation on Wednesday, October 21, under the Digital Services Act (DSA). It will examine how Booking.com handles fraudulent accommodation listings, protects reservation information from being exploited by scammers and identifies properties that pay for greater visibility in search results.

Booking.com has not been found to have breached EU law. However, if violations are established, the company could face substantial fines and be required to change certain aspects of its platform.

For travellers booking hotels and holiday apartments in Spain and across Europe, the investigation raises questions about the safeguards behind accommodation listings and payment communications.

Why Brussels has launched a formal investigation into Booking.com

The Commission suspects that Booking.com may not have adequately assessed or mitigated the risks associated with fraudulent listings and phishing scams.

The first concern involves listings for properties that do not exist, accommodation offers involving impersonation and listings that fail to comply with applicable requirements.

The Commission will examine whether Booking.com has properly identified these risks and introduced effective measures to address them, including detecting and removing fraudulent listings.

The investigation into these issues comes as concerns about fake accommodation advertisements continue to attract attention in Spain.

Earlier this month, hundreds of tourists were left without accommodation after they booked a holiday apartment in Madrid that didn’t exist. The listing appeared on Booking.com with hundreds of reviews before it was removed.

The case of Madrid is an example of the kind of consumer risk under consideration here, although the Commission has not indicated this case as a particular basis for its investigation.

The second concern involves phishing attacks exploiting reservation and guest data

The Commission will investigate how Booking.com shares customer data with accommodation operators, and whether its message system provides sufficient safeguards against misuse of that data.

Fraudsters can use genuine reservation data to create a credible appearance for their fraudulent messages, sometimes asking travellers to give them their credit card details or transfer money.

Earlier this year, Booking.com customers were warned that their travel details could be in the wrong hands following unauthorised access to reservation information.

But the latest EU proceedings go well beyond individual incidents. The authorities are examining whether the platform has adequately assessed these risks and whether its protections are adequate to the standards imposed on major Internet companies.

Henna Virkkunen, Executive Vice-President of the European Commission for Tech Sovereignty, Security and Democracy, said that holidaymakers in Europe should be able to book a trip without fear of being scammed.

She pointed out that the new law on digital services places the responsibility of avoiding such risks on the platforms and that the big intermediaries must take this obligation seriously.

Paid accommodation rankings are also under investigation

The third part of the investigation concerns something travellers may not immediately associate with online fraud: how accommodation appears in Booking.com’s search results.

If a hotel or other place to stay wants to promote its entry, it can pay a higher commission.

The European Commission is examining whether these commercially promoted services are clearly identifiable as advertisements, as is required by the new Digital Services Act.

A property appearing near the top of search results may have achieved that position through a commercial arrangement rather than solely because it is the most relevant option for a traveller.

Under the Digital Services Act, users must be able to recognise advertisements and understand who paid for them and why they are being shown.

The Commission will also examine whether Booking.com [booking.com] gives the users enough information about the settings which determine which ads they see.

Paying for greater visibility is not, by itself, a suspected irregularity. It is a question of whether the transparency requirements pertaining to the placing of advertisements on Internet platforms are fulfilled.

The proceedings relate to possible breaches of Articles 34 and 35 of the Digital Services Act – which require very large online platforms to assess and mitigate systemic risks – and Article 26(1), which establishes the transparency obligations in advertising.

It should be pointed out that Booking.com was designated a Very Large Online Platform under the DSA in April 2023, bringing it within the EU’s stricter regulatory framework for major digital services.

The Commission based its decision on a preliminary study of the Company’s risk assessment reports for 2023 to 2026, on information published in its reports on transparency, and on the answers to its information requests of September 2025 and May 2026.

The announcement of 21 October was therefore not the beginning of Brussels’ interest in the platform, but rather the opening of formal proceedings following an earlier examination.

What happens next and could Booking.com face a fine?

The European Commission has opened a detailed investigation, gathering further evidence through information requests, interviews and potentially inspections

Having begun a procedure against a company also enables authorities to take further steps, such as issuing an interim order or making a finding of non-compliance with the Digital Services Act.

The Commission may also accept commitments proposed by Booking.com to address the concerns raised during the investigation.

There is no deadline set for the completion of the proceedings, and it remains unknown when the authorities will arrive at a decision.

Under the Digital Services Act, the European Commission can impose fines of up to 6 per cent of a company’s worldwide annual turnover if violations are established.

Booking.com has said it is engaging constructively with the European Commission.

The company, as reported in a Reuters article of October 21 said that security, trust and protection of personal data were a priority.

The immediate implications for travellers are therefore limited. Anyone receiving an unexpected payment request is nevertheless advised to check independently before providing card details or sending money, but the measures do not introduce new booking requirements for travellers.

Depending on the outcome of the investigation, Booking.com could be required to strengthen measures against fraudulent accommodation listings, improve safeguards around reservation information or make paid accommodation promotions more transparent.

The fundamental question for Brussels is whether one of Europe’s largest accommodation platforms does enough to protect its users from fraud, and whether it offers a clear picture of how accommodation listings are ranked and promoted.