The European Commission has opened a formal investigation into Booking.com , looking into its protection of travellers from fraudulent listings, phishing scams and misleading payment requests. The procedure, announced on Wednesday 21 October , concerns potential breaches of the Digital Services Act, known as the DSA , and extends to the way in which properties that pay for higher search results are displayed. The focus is on whether the platform adequately assesses the risks and implements effective measures to address them.
The research touches on key stages of an online booking, from choosing the accommodation to communicating with the provider and making the payment. Does the property shown in the listing actually exist? Is the sender of a booking message trustworthy? Is an accommodation displayed higher because it responds to the search or because it has paid for greater visibility? These are the practical issues behind the three main axes of the audit.
The first concerns fraudulent and non-compliant listings . The Commission will examine whether Booking.com has properly identified and assessed the systemic risks associated with the dissemination of illegal content. The cases described include offers for non-existent properties , impersonation scams and accommodation listings that do not comply with applicable requirements.
The audit will extend to the effectiveness of the measures taken by the platform, including the removal of fraudulent listings . The question for Brussels is whether the protection procedures correspond to the extent of the risks that have been identified. For the traveler, the reliability of a listing is a prerequisite for committing money and organizing his travel. A false offer can undermine the entire planning of a trip.
The second pillar concerns phishing scams that exploit booking and guest data . The Commission will investigate the way in which this data is shared with accommodation providers, as well as the design and operation of Booking.com’s messaging service . Particular emphasis is placed on whether there are sufficient safeguards to prevent the data from being used for misleading communications and fraudulent payment requests.
The importance of this check is immediately understandable. A message referring to a real booking can seem convincing to its recipient, even when the request it contains is fraudulent. Knowing details of a trip can create a false sense of authenticity , making it difficult for the user to distinguish a legitimate communication from an attempted fraud. The investigation will assess whether the platform has adequately addressed these risks. Its launch, however, does not constitute a finding of a specific breach of the company’s central systems .
The third pillar focuses on the transparency of paid promotion . Accommodation providers can increase the visibility of their listings in search results by paying a higher commission. The Commission is examining whether these enhanced listings are clearly identifiable as advertisements , so that the user understands that their preferential position is linked to a financial transaction.
Distinction is essential for accommodation selection. The position of an offer on the search page influences which properties the interested party will see first and which ones they will compare. If the paid support is not clearly indicated, the user may attribute the display solely to the relevance of the offer to their preferences. Commercial promotion must be perceived as such , so that the final decision is made with knowledge of the factors influencing the presentation.
The research also covers the information that accompanies each advertisement. It will examine whether users can easily identify on whose behalf it is displayed, who paid for it and according to what key criteria it is displayed to them , as well as what related options for changing the settings are provided. Transparency, therefore, concerns both the labeling of the listing and the understanding of its display process.
According to the announcement, the potential failures are being examined under Articles 34 and 35 of the DSA , which concern the assessment and mitigation of systemic risks, and Article 26(1) of the DSA, which concerns the transparency of advertisements. Booking.com has been classified as a very large online platform since 25 April 2023 , a category that entails increased obligations under European supervision.
The formal procedure follows a preliminary examination. The Commission analysed the risk assessment reports of 2026 and the three previous years , data from the transparency reports, as well as the company’s replies to requests for information sent on 23 September 2025 and 26 May 2026. In the framework of the supervision, it cooperates with the Dutch Consumer and Markets Authority , as Booking.com is established in the Netherlands.
The company said, according to Reuters , that it is cooperating constructively with the Commission. A spokesperson said that security, trust and the protection of personal information are priorities , underlining its commitment to working with governments, regulators, law enforcement agencies and industry partners against cybercrime and online fraud.
The Commission will continue to gather evidence, with the possibility of sending additional requests for information, conducting interviews and conducting inspections. The formal procedure also allows for further enforcement actions, such as interim measures or non-compliance decisions , and may lead to the acceptance of commitments by the company to address the issues under consideration. Booking.com has not yet been found to have breached the DSA , nor does it prejudge the final decision.
For consumers, the crux of the matter lies in security and informed choice. The ability to make a booking requires confidence that the accommodation is genuine, that the communication is not used for deception and that paid promotion is clearly visible. The effectiveness of these guarantees is now under official European scrutiny .
