EU Launches Probe Into Booking.com Over Surge in Phishing Scams

The European Commission has officially launched an investigation into Booking.com to determine if the platform has breached the Digital Services Act (DSA). The DSA is a landmark piece of European legislation designed to force online platforms to take greater responsibility for illegal content and security flaws. Given that Booking.com accounts for approximately 66 percent of all hotel bookings in Europe, regulators are concerned that systemic failures on the site pose a widespread threat to millions of travelers.

Regulators are particularly troubled by a staggering 500-fold increase in reported scam activity on the platform between 2022 and 2024. As the digital landscape for travel expands, so too does the sophistication of criminals who use these platforms to harvest sensitive financial data. The Commission intends to scrutinize whether Booking.com has sufficiently identified these risks and whether they are implementing effective, rapid measures to remove deceptive content before it ensnares unsuspecting victims.

Protecting the Digital Traveler

At the heart of the inquiry is the safety of the average tourist. EU Commissioner Henna Virkkunen, who oversees technological sovereignty and security, emphasized that consumers deserve peace of mind when planning their trips. She noted that platforms must be held accountable for the environments they host, stating:

Europeans should be able to book their holidays without being afraid of falling victim to scams.

One specific concern involves the practice of paid rankings. Platforms often allow accommodation providers to pay for higher visibility in search results, which is permissible only if those listings are clearly marked as advertisements. The Commission is investigating whether Booking.com is maintaining sufficient transparency regarding these paid placements to ensure users are not being misled about the nature of the listings they see.

The Anatomy of the Fraud

Criminals have become increasingly adept at compromising legitimate property owner accounts to post fake listings, often lifting high-quality photos from other platforms to appear credible. Once a traveler is hooked, these scammers frequently pivot to phishing tactics, sending professional-looking payment requests that lead to fraudulent websites. These attacks are designed to steal credit card information or direct transfers from victims who believe they are completing a standard booking process.

Data from the Dutch Fraud Helpdesk confirms that the scale of the issue is significant. In the first half of 2026 alone, reported scams via booking platforms saw a tenfold increase compared to the previous year, with over 90 percent of those cases specifically tied to Booking.com. The financial impact is climbing steadily, with losses already exceeding 82,000 euros in just six months, a sharp rise from the previous year.

For expats and international residents in the Netherlands, this investigation serves as a critical reminder to exercise caution during your next vacation search. While the EU pushes for stronger platform accountability, you remain the first line of defense. Always double-check payment links, avoid making payments outside of the official Booking.com interface, and treat suspiciously low prices for luxury properties with extreme skepticism. For more updates on local regulations and consumer rights, check out more tech news.

Moving forward, Booking.com will need to provide detailed evidence of how they manage these risks to satisfy EU regulators. Failure to comply with the DSA could lead to significant fines and mandated changes to the platform's internal security protocols. While the investigation continues, travelers should remain vigilant, as the fight against sophisticated online fraud remains a cat and mouse game that will likely persist for some time.