EU Launches Digital Services Act Probe into Booking.com Over Widespread Travel Scams
The European Commission is investigating Booking.com under the Digital Services Act, citing concerns over rampant fraud, phishing, and smishing on the travel booking platform.
The European Commission has initiated a formal investigation into Booking.com, utilizing the powers granted by the Digital Services Act (DSA), to scrutinize the platform's measures against fraudulent activities. Officials have expressed significant concerns regarding the prevalence of scams, phishing, and smishing attacks targeting users on the popular travel booking site.
The probe is structured around three primary areas of inquiry. Firstly, the Commission is examining whether Booking.com is adequately preventing fraudulent and non-compliant listings from appearing on its platform. This includes instances where individuals falsely represent themselves as property owners to list accommodations they do not control, leading to potential financial losses for unsuspecting travelers.
Secondly, the investigation will assess the effectiveness of Booking.com's efforts to combat phishing and smishing attacks, as well as broader social engineering tactics. Reports indicate that scammers are compromising legitimate property owner accounts to impersonate them, subsequently directing users to pay additional fees through fraudulent channels, thereby exploiting the trust built into the platform.
Thirdly, the European Commission is scrutinizing Booking.com's advertising transparency practices. This involves determining whether the platform clearly distinguishes paid advertisements from organic search results and whether it adequately discloses when listings have been boosted due to payment by property owners, ensuring users are not misled by sponsored content.
These concerns are amplified by Booking.com's own admission in June 2024, which highlighted a staggering 500-900 percent increase in travel scams over the preceding 18 months. The Commission noted that such a significant surge, with over 1,000 fraud notifications and substantial financial damages reported in the Netherlands alone in early 2026, indicates a systemic issue.
While the Commission acknowledges that Booking.com employs internal measures and assesses fraud based on platform cases and external reports, officials have deemed these efforts "substandard." The regulatory body believes that the company could implement more robust systems and take more decisive actions to prevent fraud, emphasizing the need for a more diligent risk assessment process.
Moving forward, the European Commission expects Booking.com to enhance its fraud prevention strategies. This may involve addressing abuses within the reservation system, expediting the removal of fraudulent listings upon reporting, verifying property owner licenses, and improving the onboarding process for new property listings to deter malicious actors.
In response, a Booking.com spokesperson stated that the company is cooperating fully with the European Commission and engaging constructively with its inquiries under the DSA. The company reiterated its commitment to security, trust, and the protection of personal information, pledging to work with regulators and industry partners to combat cybercrime and online fraud.