European regulators are investigating whether the travel booking giant is doing enough to protect customers from fraudulent accommodation listings, phishing scams and misleading search rankings.
The European Commission has launched a formal investigation into Booking.com over concerns that travellers could be exposed to fraudulent accommodation listings, fake payment requests and scams involving their personal booking information.
Announced on 21 October, the investigation will examine whether the world’s leading online accommodation booking platform has failed to meet its obligations under the European Union’s Digital Services Act (DSA), which requires major online platforms to identify and address risks to consumers.
At the centre of the investigation is a growing concern about how criminals exploit the trust travellers place in established booking platforms. Fraudulent listings can advertise properties that do not exist, while phishing scams can use genuine reservation details to convince customers that an additional payment is required to secure their accommodation.
The latter is particularly concerning because fraudulent requests can appear to come from legitimate accommodation providers. Messages may reference actual booking dates, property names and reservation information, making them considerably harder to distinguish from genuine correspondence.
European regulators are examining how Booking.com shares guest information with accommodation providers and whether sufficient safeguards exist within its messaging system to prevent criminals from exploiting those details.
“Europeans should be able to book their holidays without fear of being scammed,” said Henna Virkkunen, European Commission Executive Vice-President for Tech Sovereignty, Security and Democracy.
“The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”
The investigation follows a separate security incident earlier this year. In April, Booking.com notified some customers that unauthorised third parties may have accessed personal information associated with their reservations, including names, contact details and booking information.
The company said it had taken steps to contain the incident, changed affected reservation PINs and informed customers. It also maintained that financial information had not been accessed. The incident attracted attention in Australia, where travellers were warned to be vigilant about suspicious messages requesting payment details.
Beyond fraudulent accommodation and phishing, the European Commission is also questioning how Booking.com determines which properties appear most prominently in its search results.
Accommodation providers can increase their visibility by paying higher commissions to the platform. European regulators want to establish whether these promoted listings are sufficiently identified as advertisements, allowing travellers to distinguish between properties appearing because of their relevance and those receiving preferential placement through commercial arrangements.
The distinction matters in a market where Booking.com holds considerable influence over how travellers discover and select accommodation.
According to the European Hotel Distribution Study 2026, published by hospitality industry association HOTREC, Booking.com accounted for 66.1 per cent of European online travel agency bookings in 2025. Its parent company, Booking Holdings, and rival Expedia Group together controlled 85.4 per cent of that market.
The figures illustrate the extent to which European hotels and travellers rely on a relatively small number of booking platforms, placing questions of transparency, security and consumer protection under greater scrutiny.
The Commission’s investigation follows an earlier assessment of Booking.com’s risk reports covering 2023 to 2026, alongside formal requests for information issued in September 2025 and May 2026.
Under the Digital Services Act, major platforms found to have breached their obligations can face fines of up to six per cent of their worldwide annual turnover.
Booking.com has said it is cooperating fully with the investigation.
“Security, trust and the protection of personal information are top priorities at Booking.com,” a company spokesperson said.
The company also reaffirmed its commitment to working with regulators, law enforcement agencies and industry partners to combat online fraud and protect travellers.
For customers, the investigation highlights the importance of verifying unexpected payment requests, even when they appear to relate to an existing reservation. Booking.com advises travellers to be suspicious of requests for bank transfers or payments outside its official platform and to verify unusual messages independently.
The European Commission will continue gathering evidence and could require changes to the platform’s practices or impose penalties if violations are established. No findings of wrongdoing have been made, and the opening of formal proceedings does not determine the outcome.
For millions of travellers who routinely book accommodation online, the investigation raises a fundamental question about how effectively booking platforms protect the people who depend on them.
Read also Eminem’s Former Employee Pleads Guilty to Selling Unreleased Music for $50,000