"Europeans should be able to book their holidays without fear of being scammed. The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously," Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, security and democracy, said.
European Commission opens formal investigation
The European Commission has opened a formal investigation into Booking.com for possible security failings that have produced fraudulent listings and phishing scams. The probe will determine whether the online travel agency breached security and transparency provisions of the EU's Digital Services Act (DSA). The decision to launch formal proceedings was announced on October 21, following a preliminary investigation carried out by the Commission.
The Commission emphasized that opening proceedings does not prejudge any final outcome and that it is empowered to accept commitments offered by Booking.com to remedy the matters under review.
Focus: phishing risks and how reservation data is shared
A central pillar of the Commission's inquiry is whether Booking.com has diligently assessed and mitigated phishing risks to customers. That assessment will include how reservation and guest data are shared with accommodation providers, and what safeguards are in place to prevent that data from being misused to carry out phishing and solicit fraudulent payments.
If the Commission finds that Booking.com failed to comply with DSA requirements in these areas, the company could face fines of up to 6% of its global annual turnover and be required to take corrective measures.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadFocus: messaging service design and impersonation fraud
The Commission will also examine the design and functioning of Booking.com's messaging service and whether it can be abused by malicious actors for phishing attacks. Alongside this, investigators will look at whether the provider has properly assessed and mitigated systemic risks linked to the dissemination of illegal content—specifically impersonation fraud and non-compliant accommodation listings.
Advertising transparency under the DSA
Booking.com's advertising practices are a further subject of scrutiny. The Commission will assess whether those practices meet the DSA's advertising transparency obligations, part of the law that took effect in November 2022 and applies to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs).
Documented phishing campaigns targeting Booking.com customers and partners
Cybersecurity researchers have observed numerous phishing campaigns targeting Booking.com customers and partners in recent years. Those campaigns, the Commission noted, have included threat actors accessing personal details of Booking.com customers and spoofing the company's email domains to send malicious messages.
- In 2023, Secureworks—now part of Sophos—reported that cybercriminals deployed the Vidar infostealer to gain access to partner hotels' Booking.com credentials. Attackers then used that information to send phishing emails to Booking.com customers and trick them into surrendering payment details, in many cases leading to money being stolen.
- Microsoft reported a "ClickFix" campaign in March 2025 that impersonated Booking.com. The campaign began with malicious emails impersonating Booking.com sent to targets in North America, Oceania, South and Southeast Asia, and Europe; the attack attempted to lure recipients into downloading infostealer malware.
- In June 2026, TrendAI Research identified a phishing campaign targeting Booking.com partner accommodations in Japan. Those emails impersonated guest complaints and review requests to trick hotel staff into executing malicious files.
What this means for technologists, policymakers, and customers
- Technologists and security teams: will likely be expected to review and document safeguards around reservation and guest data sharing, and to evaluate the messaging system's resistance to impersonation and malware delivery.
- Policymakers and regulators: the Commission's move demonstrates an active enforcement posture under the DSA and underscores that the regulator can impose fines up to 6% of global turnover or accept remedial commitments from a platform.
- Customers and accommodation partners: the record of observed campaigns shows a sustained risk of phishing that can originate from compromised partner credentials or spoofed Booking.com domains, and that such attacks have in past incidents led to stolen funds or malware infections.
The European Commission's investigation centers on concrete technical and procedural questions: how Booking.com shares and protects reservation data, how its messaging features can be misused, whether systems detect and limit impersonation fraud and non-compliant listings, and whether advertising practices meet DSA transparency rules. The next steps will hinge on the Commission's findings and whether Booking.com offers commitments to remediate the issues under scrutiny.
