EU regulators have opened an investigation into Booking.com, alleging that the accommodation website has not done enough to protect consumers from fake listings and scams.
The European Commission, which regulates the world’s biggest tech companies operating in the EU, said Booking.com may have breached the EU’s Digital Services Act (DSA) with its “absolutely substandard” approach to tackling fraudulent listings and phishing scams, where criminals impersonate a third party to trick people to hand over money.
A commission official said Booking.com should be carrying out risk assessments and acting to prevent fraud as required under the DSA. “We feel that what they have done is absolutely substandard,” said the official. “Although they take measures, they could go much further and they could have much more solid systems to prevent fraud.”
EU officials will also investigate whether Booking.com has breached advertising transparency rules, by potentially not making clear to users that some accommodation providers had paid to make their business more visible on the website.
Under the EU’s DSA, which aims to protect people from harmful and illegal internet content, a company could be fined ۶% of its worldwide annual turnover.
The commission said that opening the investigation did not prejudge the outcome.
Booking.com, which is headquartered in Amsterdam and claims to have ۲۸m accommodation listings, said it was engaging constructively with the commission. “Security, trust and the protection of personal information are top priorities at Booking.com,” a company spokesperson said. “We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud, and protect travellers and partners.”
The investigation comes after researchers at the UK consumer group Which? exposed security lapses at Booking.com when they used the site to set up – and accept payment for – a fake offer to stay at ۱۰ Downing Street.
EU officials are investigating similar scams, with less high-profile addresses, where consumers thought they had booked a stay, only to find on arrival at a property that it had been fraudulently listed on Booking.com.
Officials are also assessing a second category of scams, dubbed “reservation hijacks” where scammers use hacked data to impersonate an accommodation provider. Criminals send WhatsApp messages and have even used Booking.com’s own platform to request payments from Booking.com’s customers, supposedly to secure a stay. Cases seen by Guardian Money in ۲۰۲۵ involved the theft of several hundred pounds.
EU officials will examine whether the company has sufficient safeguards to prevent data from being misused.
after newsletter promotion
The Dutch consumer association Consumentenbond said it had received ۲۰۰ reports of scams costing people €۶۵,۰۰۰ that involved Booking.com in ۲۰۲۵, up from ۸۹ reports worth €۲۵,۰۰۰ the previous year. These cases were “just the tip of the iceberg”, it said, as many victims would not report to its fraud helpdesk.
Booking.com told the BBC in ۲۰۲۴ it had seen a ۵۰۰ to ۹۰۰% increase in scams in the previous ۱۸ months, driven by generative AI tools that enable fraudsters to create very realistic-looking fake emails and internet booking links.
Agustín Reyna, director general of the pan-European consumer group BEUC, said: “It is positive to see the European Commission investigating Booking.com for failing to meet EU digital rules. This is a systemic problem.”
Henna Virkkunen, the commission’s lead official on tech policy, said: “Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”
