Brussels opens DSA probe into Booking.com over fake listings and scams
What's the deal? The European Commission has opened a formal investigation into Booking.com over concerns the travel platform has not "effectively mitigated risks" tied to fraudulent listings and phishing scams. The proceedings, under the Digital Services Act (DSA), also examine whether Booking.com breached transparency rules by failing to clearly label paid-for higher rankings as ads.
What's under scrutiny? Investigators will assess how the platform handles fake accommodation listings — non-existent properties, impersonation fraud and non-compliant offers. They will also look at how reservation and guest data is shared with providers, and whether its messaging service has safeguards against phishing and fraudulent payment requests.
Why now? Booking.com connects travellers with more than 30 million accommodation options and has processed about 6.5 billion bookings since 2010, making it a target for criminals. The Amsterdam-based operator disclosed a data breach earlier this year, raising concerns over "reservation hijacking," whereby criminals target people with legitimate bookings.
Booking.com was designated a Very Large Online Platform under the DSA on April 25, 2023.
What happens next? The Commission said it would prioritise an in-depth investigation, gathering evidence through information requests, interviews or inspections. It may impose interim measures or accept commitments from Booking.com to address the concerns.
What could go wrong? If the suspected failures are confirmed, they would breach DSA obligations on systemic risk assessment, risk mitigation and advertising transparency — exposing Booking.com to a fine of up to 6% of global annual turnover. The opening of proceedings does not prejudge the outcome, and Booking.com says it is cooperating.
The signal: This is Booking.com's first formal DSA investigation, and it extends the regime's reach beyond social networks and marketplaces to a major travel-booking service. It follows a shift by the Commission from setting DSA requirements to imposing penalties, including a €120 million fine on X in 2025 and a €200 million fine on TemuDealroom has a profile for this one. Try Dealroom → in 2026.
Read more: European Commission, The Guardian, The Irish Times
Image credit: almathias, CC0, via Wikimedia Commons
