The European Commission has opened a formal investigation under the Digital Services Act into whether Booking.com is doing enough to stop scams, phishing and smishing on its platform. The probe, opened on Wednesday, covers a very large online platform with more than 45 million EU users and has three strands.
The first concerns fraudulent and non-compliant listings: people presenting themselves as owners of properties they do not own and renting them out. The second concerns phishing and smishing (SMS phishing) and social engineering, where scammers take over the account of a real owner, impersonate them and ask guests for extra payments. The third strand is advertising transparency: whether the platform clearly separates ads from organic results and makes clear which listings are boosted because owners pay for higher ranking.
Image: fity.club — https://fity.club/lists/suggestions/european-commission/
The Commission was prompted partly by Booking.com's own June 2024 admission of a very high number of fraud cases over the previous 18 months. "What made us concerned is the very high figures," an official said. In the Netherlands alone, more than 1,000 fraud reports were filed in the first part of 2026, causing €82,000 in damage, a tenfold increase on the previous year. The Commission says similar reports come from almost all member states, and that the platform's risk assessment was insufficient.
Booking.com assesses fraud using cases on its own platform and external reports and takes internal measures. But the Commission says this is "absolutely substandard": the company takes measures but could go much further and build more solid systems. It expects a more diligent risk assessment, including tackling abuse of the reservation system, rapidly removing reported listings, checking licences and changing how property owners are onboarded.
Image: Wikipedia — https://en.wikipedia.org/wiki/European_Commission
A Booking.com spokesperson said the company is cooperating fully with the Commission and treats security, trust and personal data protection as top priorities, working with governments, regulators and law enforcement to combat cybercrime and online fraud.
No comments yet. Be the first!