EU Commission probes Booking.com over fake listings and phishing under DSA

The European Commission opened an investigation on Wednesday into whether Booking.com is adequately preventing fraud on its platform. The probe falls under the Digital Services Act and targets the travel booking site, which serves more than 45 million users in the European Union. Officials described the company’s fraud defenses as absolutely substandard.

The investigation covers three specific areas of concern regarding the platform’s safety and compliance. First, regulators are examining whether Booking.com fails to stop fraudulent listings where scammers pose as property owners. Second, the probe looks at the platform’s ability to counter phishing, smishing, and social engineering attacks that compromise user accounts. Third, officials are reviewing advertising transparency to ensure boosted listings are clearly distinguished from organic search results.

Regulatory Concerns and Fraud Trends

Commission officials stated that the high volume of reported scams raised significant concerns about the platform’s security posture. The investigation was triggered partly by Booking.com’s own admission in June 2024 that travel scams had jumped between 500 and 900 percent over the preceding 18 months. This drastic increase prompted the Commission to scrutinize how the company handles non-compliant content and user safety.

The probe specifically targets instances where scammers take over property owner accounts to contact potential renters directly. According to an EC spokesperson, these fraudsters often change contact details to send messages demanding additional payments. This form of social engineering allows scammers to portray themselves as property owners while extracting money from victims through deceptive communication channels.

Impact on Users and Businesses

The financial impact of these scams is already evident in specific European markets. In the Netherlands, more than 1,000 fraud notifications were recorded in the first half of 2026. These incidents caused €82,000 in damages, representing a tenfold increase compared to the previous year. Commission officials noted that this figure represents only the Dutch element of a much larger problem affecting users across the EU.

The investigation also considers the protection of consumer and business user data. Regulators suspect that Booking.com is not sufficiently safeguarding this information against exploitation by bad actors. By taking over accounts and altering contact details, scammers disrupt the booking process and potentially expose users to further financial harm through unauthorized transactions or fraudulent requests.

What should you do?

Security professionals and users should monitor official communications from the European Commission regarding the progress of this Digital Services Act investigation. Booking.com users should remain vigilant for unsolicited messages requesting payment outside the platform’s standard booking system. Businesses using the site for listings should secure their accounts with strong authentication methods to prevent takeover attempts.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: Booking.com

• Verify all communication regarding payment requests comes through the official platform interface rather than external links or direct messages.
• Enable multi-factor authentication on travel booking accounts to reduce the risk of unauthorized access and account takeover by scammers.
• Report suspicious listings or communications to the platform immediately to help regulators and the company identify fraudulent patterns.
• Monitor official regulatory updates for any new compliance requirements or safety guidelines issued by the European Commission.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why did the EU open an investigation into Booking.com?

The European Commission opened the probe because it believes Booking.com’s fraud defenses are substandard and failing to stop phishing, fake listings, and social engineering attacks.

What specific types of fraud is the EU investigating?

The investigation covers fraudulent listings by fake owners, account takeover scams involving phishing and smishing, and issues with advertising transparency for boosted listings.

How bad is the scam problem according to recent data?

Booking.com reported a 500-900 percent increase in travel scams over 18 months, while the Netherlands saw a tenfold rise in fraud notifications in early 2026.