The EU is investigating Booking.com

The European Commission has launched a formal investigation into the travel platform Booking.com over suspected violations of consumer protection regulations. Brussels alleges that the Dutch-headquartered company has failed to take sufficient measures to shield users from fraudulent schemes, including fake hotel listings and phishing attacks. The probe focuses on whether Booking.com adequately identifies, assesses, and mitigates systemic risks associated with illegal content on its site. According to Commission officials, the number of fraud cases reported on the platform surged by 500 percent globally. In the first half of 2026 alone, the platform received 1,072 reports of fraud, resulting in damages totaling 82,000 euros. This represents a tenfold increase compared to the previous year. The investigation stems from the Digital Services Act, or DSA, which came into force in February 2024. The legislation imposes strict obligations on large online platforms to manage illegal and harmful content. Under the DSA, companies face the threat of fines amounting to up to six percent of their global annual turnover for non-compliance. The Commission stated that it opened the case following a preliminary review and an analysis of risk assessment reports submitted by Booking.com during the current year and the preceding three years. While the initiation of proceedings does not imply that Booking.com has violated EU rules, it signals that regulators believe further scrutiny is necessary. Central to the inquiry is the prevalence of deceptive practices on the platform. Regulators are examining why fraudulent offers, such as accommodations for properties that do not exist, were not removed promptly. The probe also covers impersonation fraud and other non-compliant accommodation offers. A specific area of concern involves phishing attempts that exploit the platform’s internal messaging system. Cybercriminals reportedly hijack this communication channel to trick travelers into revealing sensitive information, including passwords and bank details. The Commission is scrutinizing how Booking.com handles the sharing of reservation and guest data with accommodation providers, as well as the overall security architecture of its messaging service. Another pillar of the investigation concerns advertising transparency. The Commission is reviewing how the platform labels paid placements. Accommodation providers can pay higher commissions to secure prominent positions in search results. Regulators want to ensure that users can clearly distinguish these boosted listings from organic search results. The authorities argue that consumers must be able to identify these highlighted offers as advertisements. Furthermore, users should have adequate information on how to adjust their settings regarding such promotional content. EU Digital Commissioner Henna Virkkunen emphasized the importance of consumer safety in her statement. She noted that Europeans should be able to book their holidays without fear of falling victim to scams. Virkkunen asserted that the Digital Services Act establishes clear responsibilities for platforms to address these risks. She stressed the need to ensure that the leading booking platform in Europe takes these duties seriously. The Commission has previously utilized the DSA to open investigations against major social media networks, including TikTok, Facebook, Instagram, and Snapchat. It has also imposed multi-million euro fines on Elon Musk’s social network X, as well as the online retailers Temu and AliExpress, citing failures to adhere to regulatory requirements despite prior warnings. Booking.com responded to the announcement by stating that it is cooperating fully with the European Commission. A company spokesperson described the engagement as constructive, particularly regarding questions raised under the Digital Services Act. The firm declared that security, trust, and the protection of personal information are top priorities. It reaffirmed its commitment to collaborating with governments, regulators, law enforcement agencies, and industry partners to combat cybercrime and online fraud while protecting both travelers and business partners. The timing of the investigation coincides with broader warnings from consumer advocates regarding a rising tide of online fraud. The dramatic spike in reported incidents on Booking.com highlights the challenges platforms face in moderating user-generated content at scale. The Commission’s approach targets not just individual bad actors, but the systemic mechanisms that allow such content to persist. By focusing on the platform’s duty of care, the regulator aims to enforce standards that go beyond simple takedown requests. The outcome of this process could set a precedent for how digital marketplaces handle complex security threats involving financial data and identity theft. The legal basis for the action rests firmly on the DSA, which seeks to create a safer digital environment for consumers. The act requires very large online platforms to conduct regular risk assessments and implement effective mitigation strategies. The Commission’s decision to move from a preliminary probe to formal proceedings indicates that initial findings warrant deeper examination. The specific metrics cited, such as the tenfold rise in damage claims and the 500 percent increase in fraud cases, provide quantitative evidence for the necessity of the intervention. These figures suggest a failure in the existing moderation frameworks employed by the platform. As the investigation proceeds, attention will turn to the technical safeguards implemented by Booking.com. The handling of guest data and the integrity of the messaging interface are key operational areas under review. The distinction between organic visibility and paid promotion remains a critical point of contention. Consumers expect clarity when browsing options, and regulators insist that commercial interests must not obscure the nature of the information presented. The potential penalties underscore the seriousness with which Brussels views compliance with digital service standards. The case joins a growing list of high-profile enforcement actions aimed at reshaping the behavior of dominant technology firms operating within the European Union.