Booking.com Under EU Lens Over ‘Substandard’ Anti-Fraud Measures and Fake Listings
Summarized by AI; it may make mistakes. Check important info
Summarized by AI; it may make mistakes. Check important info
The European Commission has launched a formal investigation into Booking.com to determine whether the travel giant breached the Digital Services Act (DSA) by failing to curb fraudulent listings, phishing scams, and hidden paid promotions.
Regulators are scrutinising whether the platform did enough to protect travelers from fake property listings, impersonation fraud, and security vulnerabilities within its guest messaging systems. The probe also targets the site's search rankings, assessing whether accommodation options boosted by higher commission payments were improperly disguised as organic search results.
Fake Listings and Data Breaches Under the Scanner
The Commission is assessing whether Booking.com fulfilled its obligations to identify, analyse, and mitigate systemic risks on its platform. Officials are looking into how easily non-compliant or non-existent properties are published, alongside the steps taken to remove fraudulent accounts once detected.
Security protocols around customer information form another key angle of the probe. Investigators are reviewing how reservation details are shared with accommodation providers and whether design flaws in the platform's internal messaging service allowed cybercriminals to execute phishing attempts and extract unauthorised payments from unsuspecting users.
Unmasked Advertisements and Next Steps
Under Article 26(1) of the DSA, users must be able to clearly identify when a listing is an advertisement. The Commission is examining whether Booking.com users are given clear visibility over who paid for boosted search positions, why specific ads are shown, and how parameter settings can be modified.
Without clear labelling, travelers cannot distinguish between properties ranked higher due to customer relevance and those elevated simply because the hotel paid a higher commission rate.
This action follows a preliminary review of risk assessment reports submitted by Booking.com between 2023 and 2026, alongside formal requests for information issued in September 2025 and May 2026. The European Commission is coordinating its oversight with the Dutch Authority for Consumers and Markets, the local regulator where the company is headquartered.
While the opening of formal proceedings grants powers to issue interim measures or accept binding commitments from Booking.com, it does not prejudge the final outcome of the inquiry.
