The European Union has opened proceedings against online travel giant Booking.com, demanding answers over how the platform is responding to a reported spike in scams targeting holidaymakers.
The European Commission said it suspects the reservations website has failed to properly address the risks posed by fraudulent property listings and phishing attacks.
- Advertisement -
Brussels is also examining whether Booking.com clearly identifies listings that receive higher placement in search results because accommodation providers have paid to improve their visibility.
The commission described the platform’s anti-fraud efforts as “absolutely substandard”.
“The investigation concerns the suspicion… that Booking.com is not doing enough to prevent online fraud and online scams on its network,” said an EU official.
The suspected activity includes listings for properties that do not exist, as well as schemes in which fraudsters pose as legitimate property owners.
Under the Digital Services Act, major online platforms must remove fraudulent or illegal material and introduce safeguards to reduce the risk of scams.
According to one EU official, a common form of fraud involves “people portraying themselves as the owner of premises and putting it up for rent while they are not the real owner.”
Travellers may arrive at their destination after paying for a rental, only to find that they cannot gain entry and are told by neighbours that “this is a scam’”.
Another tactic involves phishing, in which criminals seize control of a property owner’s account, impersonate the owner and misuse the contact information associated with the listing.
“They start sending messages that people need to pay additional amounts, for instance, and then you get a message that the property is not yet available and you need to pay an additional amount. If you do, it turns out to be the wrong person, so you have lost money,” said the official.
We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences
The commission will assess whether Booking.com has adequate controls to stop personal data being abused and to protect users from fraudulent activity.
“We have clear evidence where we find that the risk assessment was not sufficient. What we want to see is that they clearly analyse the cases that happen on their own platform, that they analyse external reports, that they have a serious assessment of how serious the cases of fraud are.
“We feel that what they have done is absolutely substandard,” said the official.
The commission believes Booking.com has failed to appreciate the scale of the threat posed by fake listings and accommodation operating without the required licences.
“In the future we expect Booking.com to do a more diligent risk assessment,” said a second EU official.
“But we also suspect that they have not taken these risk factors – the fraudulent and non-compliant offers – into account and that they haven’t mitigated this properly.
“We can already see that the removal of listings after getting [complaints] was not what one would expect in these situations,” said the official.
Regulators are separately scrutinising a system that allows hotels and other accommodation providers to pay for a higher position in Booking.com search results without the listing being clearly marked as an advertisement.
“Accommodation providers can make their listings more visible in Booking.com’s search results by paying a higher commission,” said the statement. “Users should be able to clearly recognise that these ‘boosted listings’ are in fact advertisements,” said the statement.
“The commission will also examine whether, for each advertisement shown on Booking.com, users can easily see who is behind, who paid for it, why they are seeing it and how they can change the settings that determine which ads they see.”
Under the DSA, the commission said, consumers have the right to know when an advertisement is being shown and on whose behalf it appears.
“Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility,” it said.
The European Commission has been coordinating closely with the Dutch regulator because Booking.com is headquartered in the Netherlands.
Officials said a report from Dutch consumer authorities showed a “tenfold” rise in fraud cases this year compared with 2025. It recorded 1,072 notifications involving fraud on Booking.com during the first part of 2026, with losses estimated at about €82,000.
Although the Dutch data provided strong evidence for the inquiry, officials acknowledged that information from elsewhere in the EU remained “piecemeal”, based largely on reports submitted by national consumer organisations.
“This is a Europe-wide investigation,” said one official.
Officials said the commission would pursue an “in-depth investigation as a matter of priority”, including through further information requests, interviews and inspections.
The commission said BEUC, the umbrella organisation representing 44 consumer protection agencies across Europe, had reported a rise in fraudulent activity on a range of services used directly by consumers.
Banks and online payment companies have also indicated that 70% of scams begin on internet platforms, according to an EU official. European Central Bank figures for 2024 put total losses linked to online fraud at €4.2 billion, with cases rising by 17% each year.
The commission said discussions with Booking.com were continuing and stressed that the investigation remained at a preliminary stage. An official said investigators would initially focus on how quickly and how consistently the company removes fraudulent listings.
In a statement, a Booking.com spokesperson said: “We are cooperating fully with the European Commission and engaging constructively on its questions under the Digital Services Act (DSA).
“Security, trust and the protection of personal information are top priorities at Booking.com.
“We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud, and protect travellers and partners.”
Fine Gael MEP Regina Doherty said she welcomed the investigation, but warned that Booking.com customers “need protection now”.
“How many more people have to lose their holiday money before Booking.com gets a grip on this?
“I called out these scams last year and demanded action. It’s shocking that customers are still being targeted while we’re still asking the same questions.
“This company has already been fined for reporting a previous data breach too late. It’s ludicrous that customers handing over their hard-earned money should have to play detective to work out whether their accommodation actually exists.
“I welcome this investigation, but customers need protection now. Booking.com is quick enough to take its commission. It needs to show the same urgency in protecting the people who keep it in business.”
