EU probes whether Booking.com is doing enough to tackle fake listings and phishing scams

The European Union is investigating Booking.com under the Digital Services Act, or DSA. Officials are concerned that the platform has not done enough to address fake accommodation listings and phishing scams. They are also examining unlicensed properties and the possible misuse of users’ personal information. The investigation matters because Booking.com is a leading booking platform in Europe.

The EU is checking whether Booking.com underestimated fraud’s impact and failed to prevent scammers from exploiting user data. It is also examining whether listings receiving higher search rankings because providers paid were clearly marked as ads. Without that label, users may not understand why a listing appears prominently.

There is no fixed legal deadline for the investigation to finish. Booking.com says it is cooperating fully and lists security, trust, and personal-information protection as priorities. If the EU confirms violations, the company could face a fine of up to 6% of its global annual turnover.

A fake accommodation listing is an online offer for a place to stay that is deceptive in some important way. It may misrepresent the property, its availability, or the person offering it. The source specifically mentions fake listings and unlicensed accommodation, but it does not provide a detailed definition. This explanation uses the ordinary meaning of those terms.

Phishing is a deception technique. A scammer may imitate a trusted booking service, property provider, or message about a reservation. The goal is to persuade a user to share personal or account information. That information can then help the scammer target the user or commit fraud. The EU is concerned that Booking.com users’ data may be exploited in this way.

The investigation will examine whether Booking.com did enough to prevent these risks. EU tech chief Henna Virkkunen said Europeans should be able to book holidays without fear of being scammed. Booking.com says it is cooperating and is committed to combating cybercrime and online fraud.

The EU’s concern is about whether Booking.com’s safeguards matched the risks on its platform. Officials suspect the company underestimated the impact of fraud and unlicensed accommodation. They also question whether it took sufficient steps to prevent users’ data from being exploited by scammers. These concerns matter because people use the platform to make significant travel and payment decisions.

The investigation covers several connected risks. A fake listing can mislead someone about where they will stay. An unlicensed property may not meet the expected requirements for offering accommodation. Stolen or exposed personal information can give scammers another way to target users. The article does not identify a specific incident or explain exactly which protections were missing.

The EU has therefore opened a formal investigation under the DSA. Booking.com says security, trust, and protecting personal information are top priorities. It also says it will work with governments, regulators, law enforcement, and industry partners. There is no fixed legal deadline for the investigation to conclude.

The Digital Services Act is the European Union’s sweeping law regulating online platforms. The article says it covers services including social media and digital marketplaces. Its purpose, as described by EU tech chief Henna Virkkunen, is to set clear responsibilities for platforms. Booking.com is being examined under this law for suspected failures involving fraud, listings, data protection, and advertising labels.

The DSA means large platforms must take their responsibilities seriously when users rely on them. In this case, the EU is testing whether Booking.com addressed fake listings and phishing scams adequately. It is also checking unlicensed accommodation, possible misuse of personal information, and paid listings that may not have been labeled as ads. The article does not list every DSA obligation.

This is the first investigation into Booking.com under the DSA. The company says it is cooperating fully with the inquiry. If violations are confirmed, the DSA allows a possible fine of up to 6% of Booking.com’s global annual turnover. The investigation has no fixed legal completion deadline.

The EU is examining whether Booking.com clearly labeled listings as advertisements when providers paid for higher search rankings. That label matters because users need to know why a property appears prominently. Without it, a person may interpret the result as an ordinary recommendation chosen only for relevance, quality, or suitability.

For example, two accommodations might appear in a search, but one is placed higher because its provider paid. If the result does not clearly say it is an ad, the user may give it extra attention without understanding the commercial reason for its position. The key mechanism is hidden paid placement: money influences visibility, while the user may not be told.

The EU included this issue in its Booking.com investigation under the DSA. The article does not say that every paid listing was unlabeled or describe a specific user’s experience. It says the EU is looking into whether the company breached rules. Booking.com has pledged to cooperate fully with the investigation.

If the EU confirms violations of the Digital Services Act, Booking.com could face a penalty of up to 6% of its global annual turnover. This is the maximum figure stated in the article. It is not a current fine, and the article does not provide Booking.com’s turnover or calculate a cash amount.

The possible penalty is linked to the investigation’s alleged issues. These include fake listings, phishing scams, unlicensed accommodation, possible exploitation of users’ data, and unclear labels for paid search rankings. The EU must first establish whether Booking.com breached the relevant rules before such a consequence could apply.

The investigation has no fixed legal deadline for concluding. Booking.com says it is cooperating fully and that security, trust, and personal-information protection are top priorities. The company may also propose measures to address the European Commission’s concerns. The final outcome and any penalty therefore remain undecided.

Phishing attacks begin with deception. A scammer uses a message, website, or account that appears connected to a booking or accommodation. The aim is to make the traveller trust the contact and reveal personal, account, or payment information. The source does not describe a specific phishing attack, so this explanation uses the established meaning of phishing.

Stolen personal information makes the deception more convincing. A scammer may use booking-related details to pose as a platform or property provider, claim that a reservation needs attention, and direct the traveller toward a false payment or login request. The key mechanism is impersonation backed by information that makes the contact seem genuine. Further details can then enable financial fraud.

The EU is investigating whether Booking.com did enough to prevent users’ data from being exploited by scammers. It is also examining fake listings and phishing scams. Booking.com says it will cooperate with regulators, governments, law enforcement, and industry partners to combat cybercrime and online fraud.