EU Opens Investigation into Booking.com Over Phishing and Fake Listing Risks

The European Commission has opened a formal investigation into Booking.com over possible security failings that have led to fraudulent listings and phishing scams. The probe will test whether the online travel agency has breached the security and transparency rules in the EU's Digital Services Act (DSA), which applies to Very Large Online Platforms and Very Large Online Search Engines.

Regulators will look at several areas. They will assess whether Booking.com has properly identified and reduced phishing risks to customers, including how reservation and guest data is shared with accommodation providers and what safeguards stop that data being misused to solicit fraudulent payments. The Commission will also examine whether the platform's messaging service could be abused by malicious actors, and whether the company has addressed risks from illegal content such as impersonation fraud and non-compliant accommodation. Its advertising practices will be checked against the DSA's transparency obligations.

If a breach is found, Booking.com could face a fine of up to 6% of its global annual turnover and be required to take corrective measures. The proceedings were announced on October 21 after a preliminary investigation. The Commission stressed that opening them does not prejudge the outcome, and it can accept commitments from Booking.com to fix the issues. Executive vice-president Henna Virkkunen said Europeans should be able to book holidays without fear of being scammed.