EU investigates Booking.com over phishing scams - Bitdefender

The European Commission announced the investigation on Oct. 21, focusing on whether Booking.com has adequately addressed fraudulent accommodation listings, phishing scams, and other consumer risks. The probe follows concerns that scammers are exploiting the popular travel platform to steal money and personal information from unsuspecting holidaymakers.

Regulators are examining how Booking.com shares reservation and guest information with accommodation providers, how its messaging system operates, and whether sufficient safeguards exist to prevent criminals from exploiting these features. One major concern is that scammers can hijack legitimate hotel accounts and use real booking information to make their messages appear trustworthy.

Fake hotels and fraudulent listings

European regulators are also investigating accommodation listings that advertise properties that don't exist or are posted by individuals with no authority to rent them. In some cases, fraudsters impersonate legitimate property owners and collect payments for accommodation they cannot provide, leaving travelers discovering the deception only after arriving at their destination.

Officials suggested that Booking.com could improve property-owner verification, check accommodation licenses, and remove suspicious listings more quickly after receiving fraud reports. The problem extends beyond the Netherlands, with similar reports emerging from other European countries.

Surge in fraud reports

The investigation follows mounting concerns about the scale of fraud affecting online travel bookings. According to Booking.com's own acknowledgment in June 2024, travel scams had increased by between 500% and 900% in the preceding 18 months.

In the Netherlands alone, authorities received more than 1,000 fraud notifications in early 2026, with reported losses totaling approximately €82,000. That represented a 10-fold increase from the same period a year earlier. One official described the company's efforts as 'absolutely substandard,' arguing that stronger systems could help prevent fraudulent activity before travelers lose money.

Paid rankings under scrutiny

European regulators are also examining whether Booking.com clearly identifies properties that appear higher in search results because their owners pay the platform larger commissions. Under the EU's Digital Services Act, online platforms must ensure users can recognize ads and understand why they are seeing them.

The Commission wants to know if travelers can distinguish between accommodation listings that rank prominently because they match search criteria and those receiving preferential placement through commercial arrangements. If violations are established, Booking.com could face fines of up to 6% of its worldwide annual turnover under the DSA.

Booking.com's response

Booking.com says it is cooperating fully with European regulators and maintains that protecting travelers, accommodation partners, and personal information remains a priority. The platform advises travelers to be cautious when receiving unexpected messages about reservations, even when those messages appear to come from legitimate hotels.

Criminals increasingly exploit familiar services and real customer information to make fraudulent requests look authentic. Travelers are advised to verify unexpected payment requests independently, avoid clicking payment links in messages, check listings carefully before booking, and protect their accounts with strong passwords and two-factor authentication.