"We feel that what they have done is absolutely substandard," an EU official said — a blunt opening line to a formal probe that could force Booking.com to change how billions of euros of travel bookings are listed, sold and policed.
European Commission opens formal Digital Services Act probe
The European Commission has opened an investigation under the Digital Services Act (DSA) into whether Booking.com is doing enough to stop scammers from running fraud, phishing and smishing campaigns on its platform. Officials told The Register the probe targets a "very large online platform (one with more than 45 million EU users)" and is structured around three specific strands of concern.
Fraudulent and non-compliant listings: impersonation and fake rentals
The first strand examines whether Booking.com is failing to prevent fraudulent and non‑compliant listings. An EC spokesperson described the problem as “people portraying themselves as the owner of premises and putting it up for rent while they are not the real owner.” The Commission flagged account takeover as a recurring technique: scammers take over a property owner's account and then alter contact details or listings to defraud potential renters.
The probe could require Booking.com to change how property owners are onboarded, check licences, and remove listings more rapidly when fraud is reported — measures the Commission explicitly listed as possible expectations for remediation.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPhishing, smishing and consumer data protection
The second strand focuses on whether Booking.com does enough to counter phishing and smishing (SMS phishing) and other social engineering. The EC spokesperson explained scammers "take over the account of a property owner and… portray themselves as the property owner, but also take over the contact details," then send messages asking victims to pay additional amounts.
The Commission also suspects Booking.com is not sufficiently protecting the data of its consumers and business users — a concern that sits alongside the platform's role in detecting and responding to account takeovers and external reports of abuse.
Advertising transparency and boosted listings
The third strand examines advertising transparency: whether Booking.com clearly distinguishes ads from organic search results and whether it is transparent about boosted listings for which property owners pay for higher ranking. That line of inquiry targets the clarity users receive when choosing between paid prominence and standard search results.
What this means for Booking.com, property owners, and travelers
- Booking.com: The Commission said Booking.com does assess fraud using cases on its platform and external reports and takes internal measures, but an EU official concluded their work is insufficient. The probe signals an expectation for a more diligent risk assessment and "much more solid systems to prevent fraud." Booking.com told The Register it is "cooperating fully with the European Commission and engaging constructively on its questions under the Digital Services Act (DSA)." The company also said "Security, trust and the protection of personal information are top priorities" and that it is committed to working with governments, regulators, law enforcement and industry partners to combat cybercrime and fraud.
- Property owners and business users: The Commission highlighted account takeover and impersonation risks, and suggested stronger onboarding and licence checks. Those operating listings on the platform can expect closer scrutiny of how accounts are verified and how contact details are controlled.
- Travelers and consumers: The probe responds to alarmingly large increases in scam reports. Booking.com itself admitted in June 2024 to a 500–900 percent jump in travel scams over the preceding 18 months. In the Netherlands alone, more than 1,000 fraud notifications were made in the first part of 2026, causing damage of €82,000 — a tenfold increase on the previous year. The Commission said such figures were a key motivator for action.
The Commission framed the inquiry as both targeted and consequential: it is not a general expression of dissatisfaction but a DSA investigation aimed at defined practices on a platform with tens of millions of EU users. Booking.com says it is engaging constructively; the Commission says the company's current mitigations fall short and has outlined concrete areas — reservation system abuse, rapid listing removal, licence checks, onboarding changes and clearer ad labelling — where it expects progress.
Where this goes next is concrete: the DSA investigation will press Booking.com for answers, and the company has signalled cooperation. The factual record already supplied to EU officials — including Booking.com's own acknowledgment of a steep rise in scams and the Netherlands' spike in reported damage — gives Brussels a clear factual baseline from which to judge whether Booking.com can meet the DSA's risk‑management expectations.
