The European Commission has opened a formal probe into Booking.com, the world’s largest online accommodation marketplace, over allegations that the platform has failed to protect consumers from a surge of fraudulent listings and phishing scams. The investigation, announced on 21 October, focuses on whether the company has breached the Digital Services Act (DSA) and the EU’s advertising‑transparency rules.
What the Commission says
A senior commission official said Booking.com’s response to fraud is “absolutely substandard” and that the platform should conduct risk assessments and implement stronger preventive measures. The DSA obliges large digital services to act swiftly against harmful content and illegal activity; failure to do so can result in fines of up to 6 % of global turnover.
The probe will also examine whether Booking.com has obscured paid‑placement advertising, potentially misleading users into believing that certain listings are independently recommended.
Company’s response
Booking.com, headquartered in Amsterdam, has said it is working cooperatively with regulators. “Security, trust and the protection of personal information are top priorities,” a spokesperson told the BBC. The company reaffirmed its commitment to collaborate with governments, law‑enforcement agencies and industry partners to fight cybercrime.
Evidence of fraud
The investigation follows a series of high‑profile incidents. In 2024, UK consumer group Which? demonstrated that Booking.com could be used to create a fake offer for a stay at 10 Downing Street, complete with a payment link. Similar scams have appeared in less glamorous locations, with travellers arriving to find that the property they booked was never listed.
A second type of scam, dubbed “reservation hijacks,” involves criminals hacking accommodation‑provider accounts and sending fraudulent WhatsApp messages or using the platform itself to request payments from customers. Guardian Money reported that such attacks in 2025 resulted in losses of several hundred pounds per case.
Scale of the problem
Dutch consumer association Consumentenbond recorded 200 scam reports in 2025, amounting to €65 000 in losses – a sharp rise from 89 reports worth €25 000 the year before. The association warned that many victims do not report incidents, suggesting the real toll may be higher.
Booking.com acknowledged a 500‑900 % rise in scams over the previous 18 months, attributing the surge to generative‑AI tools that enable fraudsters to produce realistic‑looking emails and booking links.
Industry reaction
Agustín Reyna, director‑general of the pan‑European consumer group BEUC, welcomed the investigation, calling the issue “systemic.” Henna Virkkunen, the commission’s executive vice‑president for tech sovereignty, security and democracy, urged that Europeans should be able to book holidays without fear of fraud, emphasising the DSA’s clear responsibilities.
Market analysis
Booking.com’s market dominance – with an estimated 28 million listings – means that any regulatory action will reverberate across the online travel industry. A potential fine of 6 % of global turnover could translate into billions of euros, exerting pressure on the company’s profitability and prompting a reassessment of its risk‑management framework.
Regulators tightening oversight may lead to higher compliance costs, potentially passed on to consumers through modest price increases or reduced promotional offers. Competitors such as Airbnb and Expedia could gain market share if Booking.com’s reputation for safety erodes.
The investigation also highlights the growing threat of AI‑enabled fraud. Companies may need to invest in advanced verification technologies and real‑time monitoring of listings, driving up operational expenses. Investors may view the sector as riskier, affecting valuations of tech‑heavy travel platforms.
In the longer term, the EU’s scrutiny could catalyse industry‑wide reforms, encouraging stronger data‑protection protocols and clearer advertising disclosures. Firms that adapt swiftly may emerge as leaders in a market increasingly prioritising trust and transparency.
What comes next
The European Commission will assess whether Booking.com’s safeguards are adequate and whether it has complied with the DSA’s obligations. The outcome will determine whether the platform faces regulatory penalties, mandatory remediation or further monitoring. Until the investigation concludes, consumers are advised to verify listings independently and report suspicious activity to relevant authorities.