What the Commission opened

The European Commission opened a formal procedure against Booking.com on Wednesday, 21 October 2026, under the Digital Services Act (DSA). Brussels wants to establish whether the platform failed to assess and mitigate, with due diligence, the risks tied to fraudulent listings and phishing scams. The Commission framed the case as an examination of Booking.com's systems rather than of individual fraud cases. ABC described it as the first investigation into Booking.com under the DSA. Commission vice-president Henna Virkkunen said European travellers should be able to book holidays without fear of being cheated, and that the platform, as the leading booking service in Europe, must take its responsibilities seriously. Booking Holdings, which is listed on the Nasdaq, is the group behind the platform.

Three lines of inquiry

The first strand asks whether Booking.com properly identified and assessed the risks from false listings, including properties that do not exist, identity theft and accommodation offers that do not comply with the rules. It also examines whether the company has taken effective steps to reduce those risks, including removing fraudulent or non-compliant listings. Under Articles 34 and 35 of the DSA, large platforms must identify, assess and mitigate systemic risks linked to their services. The second strand covers phishing. Investigators will look at how reservation and guest data is shared with accommodation providers, how the messaging service is designed and run, and whether safeguards prevent that data from being used to request fraudulent payments. The third strand concerns Article 26, which requires advertising to be clearly recognisable and users to be told who promotes and pays for it. Accommodation providers can pay higher commissions to rank higher in search results, and the Commission wants to know whether users can tell that these listings are adverts, who is behind them, who paid and why they are shown, and whether they can change the settings that decide which ads they see.

The scale of the fraud

Commission officials, as reported by Wirtschafts Woche, said Booking.com itself reported a 500% rise in fraud cases on its platform worldwide. For the first half of 2026 the Commission recorded 1,072 fraud reports that led to damage of 82,000 euros, which it described as a tenfold increase on the previous year. An EU official quoted by RTE described a common scheme in which someone poses as the owner of a property, lists it for rent and collects payment, leaving guests who arrive with no entry and a scam to discover. Phishing works differently: scammers take over the account of a genuine owner and use its contact details to ask for extra payments. El Pais reported a case in Madrid in which hundreds of people booked accommodation through Booking.com that did not exist. ABC reported that the Commission fears the platform has underestimated the impact of fraud and of unlicensed accommodation, and is not protecting user data well enough to stop it being misused for fraud.

Booking's response

Booking said in a short statement that it is cooperating fully with the Commission and wants to address the alleged shortcomings constructively. The company said security, trust and the protection of personal data are fundamental priorities. It also said it is committed to working with governments, regulators, law enforcement and industry partners to fight cybercrime and online fraud, and to protect both travellers and the property owners who list with it. The Commission has not yet reached any finding, and the company has not conceded any breach.

What happens next

The Commission will continue gathering evidence through requests for information, meetings and inspections, and it has said it will treat the case as a top priority. It can adopt interim measures, issue a non-compliance decision, or accept commitments that Booking.com proposes to fix the problems under investigation. Opening the procedure does not prejudge the final outcome. The case concerns the systems Booking.com uses to manage fraud, data and advertising, and any decision will depend on what the investigation finds.