European Regulators Launch Formal Investigation Into Booking.com Over Rising Customer Scams

2026-10-28 data

Amsterdam, Wednesday, 28 October 2026.
With scams surging 500-fold, EU regulators are investigating Booking.com—which commands 66% of Europe’s hotel bookings—over alleged failures to protect travelers from fake listings and phishing under digital market rules.

Formal Scrutiny Under the Digital Services Act

On Wednesday, 21 October 2026, the European Commission initiated formal infringement proceedings against Booking.com under the Digital Services Act (DSA) [2][3][5]. Regulators are scrutinizing whether the Amsterdam-headquartered platform has failed to diligently assess and mitigate systemic risks stemming from fraudulent accommodation listings and sophisticated phishing scams [1][3][5][7]. Classified as a Very Large Online Platform (VLOP) because its user base exceeds 45 million individuals, Booking.com is held to the highest tier of mandatory compliance and risk supervision enforced across the European Union [3][6][7].

The Mechanics of Data Exploitation and Account Compromise

The probe targets the technical mechanisms through which bad actors manipulate the platform’s infrastructure [1][3]. Attackers compromise legitimate hotel partner accounts or post non-existent listings crafted from stolen images, and then exploit reservation channels to harvest guest details including names, booking dates, and transaction amounts [2][4]. Using this captured guest data, cybercriminals issue deceptive payment requests directly inside Booking.com’s native messaging interface or via WhatsApp, directing consumers to fraudulent payment portals [2][4]. The European Commission is reviewing whether customer data sharing policies between the platform and lodging providers lack the necessary protective guardrails required to thwart systematic identity abuse [3][6].

Escalating Financial Losses and Phishing Surge

The regulatory intervention follows an alarming surge in fraudulent activities: Booking.com itself reported a 500-fold increase in scam practices between 2022 and 2024 [2][3][7]. By the first half of 2026, Dutch consumer protection figures from the Fraudehelpdesk revealed that nearly ten times as many individuals fell victim to fraud via accommodation portals compared to the previous year, with phishing schemes tied to Booking.com accounting for over 0.9 of the 1,072 reported incidents [2]. Furthermore, documented financial damages in the Netherlands rose from more than €75,000 across the entire previous year to over €82,000 in just the first six months of 2026 [2].

Search Ranking Transparency and Regulatory Mandates

Beyond cybersecurity lapses, the Commission is evaluating algorithmic transparency on the portal [1][4]. The DSA mandates that platforms must explicitly identify any commercial advertising to consumers [1][5]; investigators allege Booking.com failed to clearly label paid-for boosted placements where hospitality providers paid fees—running up to 20% commission per booking—to secure elevated rankings in standard search results [1][2][4]. Henna Virkkunen, European Commissioner for Technological Sovereignty, Security and Democracy, reiterated that European vacationers must be shielded from deception, underscoring that platforms dominating the market must uphold rigorous safety obligations [2][3][5]. In response, Booking.com stated it is cooperating fully with the Commission, insisting that user safety and personal data protection remain core platform priorities [3][5][7].

Bronnen

Digital Services Act Platform compliance