European Commission Opens Formal Probe Into Booking.com Over Fraud, Phishing, And DSA Violations

BRUSSELS, Oct 21 – The European Commission launched formal proceedings against Booking.com on Wednesday, October 21, 2026, to investigate potential breaches of the European Union’s Digital Services Act (DSA) regarding fraudulent listings and phishing risks.

According to an official EU executive statement, the probe will assess whether the online accommodation platform failed to properly identify, assess, and mitigate systemic risks on its platform.

Key areas under scrutiny include fake accommodation listings, impersonation fraud, non-existent rental properties, and non-compliant consumer offers.

European Union regulators will determine whether Booking.com implemented sufficient preventative safeguards to stop fraudulent operators from advertising on its service and protect travel consumers from monetary scams.

Focus on Phishing Attacks and Data Safety Safeguards

Key aspects of the European Commission’s investigation into Booking.com’s system design and data practices include:

• Reservation Data Misuse: Regulators will evaluate risks connected to sharing sensitive guest reservation data with third-party accommodation providers via the platform’s messaging infrastructure.
• Messaging Service Security: The EU will examine whether the design and operation of Booking.com’s internal chat systems adequately shield users from phishing messages and fraudulent payment requests.
• Prioritized Enforcement: The European Commission stated it will conduct an in-depth inquiry as a priority matter using requests for information (RFIs), executive interviews, and on-site inspections.
• Potential Regulatory Sanctions: Under the DSA framework, the Commission retains authority to enforce interim measures, adopt non-compliance decisions incurring heavy penalties, or accept binding operational commitments from Booking.com.

EU regulators will collect evidence before determining whether to issue a formal non-compliance finding.

–NMT