The European Commission has placed Booking.com, one of the world’s leading travel booking platforms, under investigation for its response to the scams and fraud affecting its users. Brussels wants to determine whether the company has adopted sufficient measures to detect nonexistent accommodations, prevent the spread of fraudulent listings, and protect travelers’ personal data against identity theft attempts. The procedure also extends to the transparency of search results, especially when certain establishments pay to gain greater visibility.
The formal investigation, announced last October 21, 2026 and later reported by the European Consumer Centre in Spain, is being carried out under the Digital Services Regulation (DSA), the European regulation that obliges large internet platforms to identify and reduce certain risks for their users. The Commission suspects that Booking may not have adequately assessed some of these dangers or adopted sufficiently effective mechanisms to prevent them, although there is still no ruling confirming a breach.
The importance of the case is related to the company’s weight in the European tourism market. According to the data cited by Brussels, Booking accounts for around 66% of hotel reservations made online in the European Union, so any deficiency in its security systems can affect a considerable number of consumers. The investigation also comes in a context of growth in scams related to tourist accommodations and of computer attacks that exploit real bookings to request money or banking information from travelers.
Nonexistent accommodations and fake listings: the first problem Brussels is investigating
One of the European Commission’s main concerns is the presence of fraudulent listings on Booking.com, including accommodations that do not exist, establishments published by people who are not their owners, and offers that fail to comply with applicable regulations. Brussels will examine whether the platform has correctly identified the risks associated with these practices and whether it has effective procedures to detect and remove suspicious listings before they cause harm to consumers.
This type of fraud can develop through the publication of a house or tourist apartment that apparently meets all the conditions to be booked. The ad may include photographs, an address and an attractive price, but the traveler later discovers that the accommodation does not exist or that the person who requested the payment was not authorized to rent it. The investigation is not limited to checking the existence of fake ads, but rather seeks to determine whether Booking does enough to prevent their publication and reduce the risks they represent.
The Commission will also analyze the identification mechanisms of accommodation providers and the platform’s response when it receives complaints about fraudulent offers. European legislation imposes certain obligations on large platforms regarding risk assessment and the adoption of preventive measures, although it does not automatically make the company responsible for any individual fraud committed by third parties. For this reason, the file must examine Booking’s actions and determine whether they comply with legal requirements.
Fake messages and payment requests: how the scams that worry the EU work
The second major block of the investigation is related to phishing, a form of scam that uses fraudulent messages to obtain personal data, passwords or banking information. Brussels wants to check whether Booking has adopted sufficient safeguards to prevent criminals from using booking data and the platform’s communication systems to deceive travelers.
One of the most delicate situations occurs when the consumer receives a message that appears to come from the hotel or apartment they have booked. Scammers may include real information about the stay dates, the name of the accommodation or the booking amount, which increases the credibility of the communication. They then ask the customer to confirm their bank details, make a new payment or access a link to avoid a supposed last-minute cancellation.
The risk is especially relevant because these messages can arrive by email, WhatsApp or even through communication channels linked to a genuine reservation when an account has been compromised. In fact, Booking itself acknowledges in its security recommendations that criminals can use information obtained through computer attacks to craft convincing messages. That a communication includes real reservation data does not therefore guarantee that it is legitimate.
The European Commission will examine how Booking shares its customers’ information with establishments and what protection measures it applies to its messaging service. The aim is to determine whether there are sufficient safeguards to prevent these data from being used in identity spoofing attacks or to demand fraudulent payments. The investigation, however, does not mean that a widespread leak of data from all users has been proven.
Booking is also under investigation for the hotels that pay to appear first
The third line of investigation focuses on a different issue, but equally relevant for consumers: the possibility that certain accommodations appear in prominent positions in search results because they have paid a higher commission, without that circumstance being sufficiently clear to the user.
Booking allows some providers to increase the visibility of their establishments through certain commercial modalities. This practice is not illegal in itself, but the Digital Services Act establishes transparency obligations when content is advertising in nature. Users must be able to distinguish between the results that appear because of their relevance to the search performed and those that receive a preferential position as a consequence of a payment.
Brussels will analyze whether the platform identifies these contents appropriately and whether it offers information about who is behind each ad, who has paid for its dissemination, why it is shown to the consumer and how advertising preferences can be modified. The issue directly affects the way travelers compare establishments, prices and features before choosing where to stay.
In practice, appearing among the first Booking results does not necessarily mean that a hotel is the cheapest, the best rated, or the one that best suits the customer’s needs. The investigation aims to verify whether the information presented allows decisions to be made knowing when a commercial promotion exists.
What Booking says about the European Commission’s investigation
After the opening of the case became known, Booking.com said that it is cooperating with the European authorities and defended its commitment to traveler safety and the protection of personal data. The company maintains that it continues working with administrations, regulators, security forces, and companies in the tourism sector to combat scams and cybercrime.
The platform also acknowledges that computer attacks and digital fraud constitute a growing problem that affects numerous companies in the tourism sector, from large intermediaries to independent establishments. In its official recommendations it especially warns of the increase in fraudulent messages sent via WhatsApp and other channels, in which criminals pose as hotels or as the platform itself.
Booking states that it has procedures to detect fake listings and combat fraudulent activities. However, the European Commission wants to verify whether those measures are sufficient to comply with the specific obligations that the legislation imposes on large platforms, especially in relation to the prevention of systematic risks and the protection of consumers.
What Booking users must do to avoid a scam
The opening of the investigation does not imply that travelers should stop using Booking or that all reservations made through the platform present security problems. Nevertheless, there are certain signs that should be identified before making a payment or providing personal information, especially when the accommodation asks to carry out procedures that were not foreseen in the initial conditions.
The company itself recommends always checking the payment policies included in the reservation confirmation and being wary of messages that demand an urgent transfer to avoid cancellation. It also warns that it never asks its customers to provide the full details of their bank card by email, telephone, SMS or WhatsApp, nor to make transfers different from those contemplated in the contracting conditions.
Among the main precautions consumers should take are:
-
Check the payment conditions: review the amount, deadlines and collection method established in the original confirmation.
-
Be wary of urgent messages: especially if they warn that the reservation will be canceled in a few hours if the card is not entered again.
-
Do not access suspicious links: open the Booking app or official page directly instead of using links received through unexpected messages.
-
Verify accommodations: check reviews, compare prices with similar establishments and pay attention to extraordinarily cheap offers.
-
Do not provide passwords or complete banking details: the customer service does not need to know the account password.
-
Activate two-step verification: this measure adds an additional layer of protection against unauthorized access.
It is also important to remember that a suspicious request must be verified even when it arrives through the platform's messaging system. If in doubt, the recommendation is to contact the official customer service and not make additional payments until confirming that the request really corresponds to the accommodation and the contracted conditions.
What to do if you have already paid a fake reservation or have provided your banking details
Consumers who suspect they have been victims of a scam should act quickly. The first step is to contact the bank or payment provider to report what happened, request the blocking of the card if its details have been compromised and consult the possibility of recovering the amount through the corresponding complaint mechanisms. The refund will depend on the type of operation, the circumstances of the fraud and the applicable rules, so it cannot be assumed to be guaranteed.
It is also advisable to change the Booking password, activate two-step authentication and report the incident to the official customer service. The platform has a specific channel for receiving reports about possible scams and forwarding cases to its security teams. If the fraud has occurred through a message that apparently comes from an accommodation, it is advisable to keep screenshots, proof of payment and all communications received.
In Spain, those affected can also file a complaint with the Policía Nacional or the Guardia Civil and seek guidance from consumer agencies. Having the booking confirmation, bank transactions and exchanged messages can be especially useful for documenting the facts and processing a claim.
Booking faces fines of up to 6% of its global turnover
The Brussels investigation can have significant economic consequences for Booking if a breach of the Digital Services Act is ultimately proven. European regulations provide for sanctions of up to 6% of the annual global turnover of large platforms, although that percentage represents the maximum limit and not an automatic fine.
The Commission may request new documents, conduct interviews, carry out inspections and examine the technical mechanisms the company uses to identify risks. It also has the capacity to adopt interim measures when the legal requirements are met, require changes to correct breaches or accept commitments proposed by Booking.
The procedure is being carried out in collaboration with the Netherlands Authority for Consumers and Markets (ACM), given that the company has its headquarters in the Netherlands. The investigation comes after Brussels analyzed the risk assessment reports submitted by Booking and the company’s responses to formal requests for information. The platform was designated as a very large online service in April 2023, a category that entails enhanced supervisory obligations.
For the moment, there is no announced sanction or definitive deadline for the conclusion of the case. The opening of the investigation also does not mean that Booking has committed the infringements being examined, since the company will be able to present its arguments and documentation during the procedure.
What changes for those who have a pending reservation on Booking
For users, the main immediate consequence is greater attention from the European authorities to the platform's security measures. The investigation does not cancel existing reservations, does not prevent new bookings from being made, and does not automatically establish a right to receive financial compensation for the mere fact of having used Booking.com.
Those who have a planned trip can keep their reservations, although it is advisable to review the payment conditions, check that the messages received come from legitimate channels, and avoid transactions that do not appear in the original confirmation. In the event of receiving an unexpected request for money, the most prudent course is to verify it with the platform before making any transfer.
The decision by Brussels puts the focus on an issue that affects a large part of European travelers: to what extent a booking platform should be responsible for preventing the scams that may occur through its services. The European Commission must determine whether Booking has complied with the assessment, prevention and transparency obligations set out in the legislation, while consumers remain the main recipients of the protection measures that may arise from the procedure.