Full Breakdown
EU Launches Formal Investigation into Booking.com Over Fraudulent Listings, Phishing Scams and Advertising Transparency
By Drooid · · How we work
Investigation Overview
On October 21, the European Commission announced formal proceedings against Booking.com, the Amsterdam-based online travel agency, under the Digital Services Act (DSA). Regulators will assess whether the platform has identified, assessed and mitigated systemic risks linked to *fake or non-compliant accommodation listings*, *phishing schemes that exploit reservation data*, and *paid “boosted” listings that may not be clearly labelled as advertisements*. The DSA permits fines of up to 6 % of a company’s worldwide annual turnover for breaches.
Background & Context
The DSA obliges “very large online platforms” to conduct risk assessments and remove illegal or harmful content promptly. Booking.com, part of Booking Holdings, reports roughly 30 million accommodation options and has processed about 6.5 billion bookings since 2010. Earlier in 2025, researchers at the UK consumer group Which? highlighted a scam involving a fake offer to stay at 10 Downing Street, prompting EU officials to examine similar incidents. A data breach in 2026 revealed unauthorised access to guest details, raising concerns about reservation hijacking.
Data & Statistics
- The Dutch consumer association Consumentenbond recorded 200 scam reports costing €65,000 in 2025, up from 89 reports costing €25,000 the previous year.
- A 2026 Dutch consumer report noted a ten-fold rise in fraud cases, with 1,072 notifications and estimated losses of €82,000.
- Booking.com told the BBC in 2024 that it had seen a 500 % to 900 % increase in scams over the prior 18 months, attributing the surge to generative-AI tools that enable realistic fake emails and booking links.
Official Statements & Responses
Consumer group BEUC director-general Agustín Reyna described the probe as a positive step toward tackling a “systemic problem.”
Conflicting Reports & Gaps
The Consumentenbond’s 2025 figures (200 reports) differ from the 2026 report’s 1,072 notifications, suggesting rapid escalation but also highlighting fragmented data collection across member states. The Commission noted that evidence from national consumer groups is “piecemeal,” indicating a gap in EU-wide reporting mechanisms.
Verbatim Quotes
- “We feel that what they have done is absolutely substandard,” — the official
- “Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.” — Henna Virkkunen, EU tech chief
- “The investigation concerns the suspicion… that Booking.com is not doing enough to prevent online fraud and online scams on its network,” — an EU official
- “We are cooperating fully with the European Commission and engaging constructively on its questions under the Digital Services Act (DSA).” — company spokesperson
What’s Next
The Commission has classified the inquiry as a “matter of priority” and may issue interim measures or non-compliance decisions while gathering additional information. If violations are confirmed, Booking.com could face fines of up to 6 % of its global turnover under the DSA. The investigation remains in its preliminary stage, with further data requests and possible inspections planned.