European Union investigates Booking.com over fake listings and phishing scams

The European Commission opened formal proceedings on Wednesday, October 21, 2026, to determine whether Booking.com complied with its obligations under the Digital Services Act (DSA) when addressing fraudulent listings, phishing scams and advertising within search results. The move is an investigation, not a finding of wrongdoing: the Commission says it will assess possible infringements and stresses that opening the proceedings does not prejudge the final outcome.

The case follows a preliminary review of risk assessments submitted by Booking.com in 2026 and the previous three years, transparency reports and the company’s replies to formal requests for information. The Commission says it will pursue the in-depth investigation as a priority, but there is no fixed legal deadline for completing it.

Three areas under investigation

The first area concerns fake or non-compliant listings. The Commission wants to establish whether the platform properly identified, assessed and reduced systemic risks involving nonexistent properties, impersonation fraud and accommodation offers that fail to comply with applicable rules. The issue goes beyond removing an individual listing after a complaint: the DSA requires large platforms to examine how the design and operation of their services may enable harm at scale.

The second area focuses on phishing. Regulators will examine risks linked to the sharing of reservation and guest data with accommodation providers, as well as the design and operation of Booking.com’s messaging system. The central question is whether adequate safeguards prevent criminals from exploiting legitimate data and communication channels while posing as hotels, other accommodation providers or the platform itself to request payments.

The third area is advertising transparency. Accommodation providers can pay higher commissions to obtain greater visibility in search results. The Commission will investigate whether these boosted results are clearly presented as advertisements and whether users can identify who is behind an ad, who paid for it and why it was shown.

What the case means for travelers and the platform

For travelers, the investigation brings together three risks that can appear unrelated: booking a property that does not exist, receiving a fraudulent payment request connected to a genuine reservation, and reading a paid position as if it were based solely on search relevance. That combined view is the case’s practical significance. The safety of a travel marketplace depends on listing verification, protection of data flows and clear explanations of commercial ranking mechanisms.

Booking.com said it is cooperating with the Commission and that security, trust and the protection of personal information are priorities. The company also said it remains committed to working with governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud. That is the company’s stated position; the proceedings will now test, through evidence, whether its measures satisfy the DSA.

The Commission may request more information, impose interim measures, accept commitments offered by the company or ultimately issue a non-compliance decision. If an infringement is established, the DSA allows fines of up to 6% of worldwide annual turnover. That ceiling is not a fine already imposed, nor does it indicate the amount of any eventual penalty.

Why the investigation reaches beyond travel

From an editorial perspective, the proceedings illustrate how European regulation is moving from visible content moderation to the architecture of digital services. The inquiry covers how data moves between a platform and its partners, how messaging systems can be abused and how sponsored placement is explained to users. A decision against Booking.com could create practical benchmarks for other marketplaces that combine intermediation, personal data, direct communication and advertising.

Until the case is concluded, the confirmed facts are limited to the formal opening of proceedings, the scope announced by the Commission and Booking.com’s public commitment to cooperate. There has been no finding of liability, no fine and no order to suspend the service.