EU Opens Probe into Booking.com Over Fake Listings and Scams

By Olivia Hart

Booking.com faces a potential fine of up to 6% of its worldwide annual turnover after the European Commission opened a formal investigation into its handling of fake listings and scams. The penalty ceiling comes from the EU's Digital Services Act (DSA), which the Commission says the Amsterdam-based company may have breached.

The Commission, which regulates the world's biggest tech companies operating in the EU, accuses Booking.com of an "absolutely substandard" approach to tackling fraudulent listings and phishing scams, where criminals impersonate a third party to trick people into handing over money.

"We feel that what they have done is absolutely substandard," a Commission official said. "Although they take measures, they could go much further and they could have much more solid systems to prevent fraud."

The official said Booking.com should be carrying out risk assessments and acting to prevent fraud as the DSA requires. The Commission stressed that opening the investigation does not prejudge the outcome — a caveat worth holding onto before assuming a penalty is coming.

The stakes are concrete. A 6% fine applied to a company of Booking.com's scale would run into hundreds of millions of euros, enough to concentrate any boardroom's attention.

What does the investigation cover?

Regulators will examine three main areas:

• Fraudulent listings, where consumers believed they had booked a stay only to discover on arrival that the property was fraudulently listed.
• "Reservation hijacks," where scammers use hacked data to impersonate accommodation providers, sending WhatsApp messages — and in some cases using Booking.com's own platform — to request payments supposedly to secure a stay.
• Advertising transparency, specifically whether the company failed to make clear that some accommodation providers had paid to appear more prominently on the site.

Officials will also assess whether Booking.com has sufficient safeguards to prevent customer data from being misused. Cases seen by Guardian Money in 2025 involved the theft of several hundred pounds from individual victims of reservation hijacks.

The takeaway: regulators are targeting both fraud itself and the opacity of how visibility is sold on the platform.

How bad is the scam problem?

The Dutch consumer association Consumentenbond reported 200 scam cases involving Booking.com in 2025, costing victims €65,000 — roughly €325 per report. That is up from 89 reports worth €25,000 the previous year, more than doubling in volume and nearly tripling in losses.

Those figures are likely understated. The association called its cases "just the tip of the iceberg," noting many victims never contact its fraud helpdesk.

Booking.com itself acknowledged the scale of the problem. The company told the BBC in 2024 it had seen a 500 to 900% increase in scams over the previous 18 months, driven by generative AI tools that let fraudsters create realistic fake emails and booking links. A company admitting to that growth rate while regulators call its defenses substandard is the tension at the center of this case.

The trigger for the probe was pointed. Researchers at the UK consumer group Which? used the site to set up — and accept payment for — a fake offer to stay at 10 Downing Street, exposing security lapses at the heart of the platform.

The plain conclusion: scam volume is rising sharply, self-reported losses are only a floor, and one fake listing at the UK Prime Minister's residence proved the system could be beaten.

What have the parties said?

Booking.com, which claims 28 million accommodation listings, said it is engaging constructively with the Commission. "Security, trust and the protection of personal information are top priorities at Booking.com," a company spokesperson said. "We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud, and protect travellers and partners."

That statement is a commitment to cooperation, not an explanation of why the Commission found its systems wanting — a gap the investigation will have to fill.

Agustín Reyna, director general of the pan-European consumer group BEUC, framed the case in systemic terms: "It is positive to see the European Commission investigating Booking.com for failing to meet EU digital rules. This is a systemic problem."

Henna Virkkunen, the Commission's lead official on tech policy, set out the political bottom line: "Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."

In plain words: the EU's most powerful tech enforcer has put Europe's largest booking platform on notice, and the outcome will signal how hard the DSA bites on fraud — not just on content.

What happens next?

The Commission will now gather evidence on fraud prevention, data safeguards and advertising transparency. Booking.com's defense will rest on demonstrating that its measures meet the DSA's risk-assessment requirements. Until the Commission rules, the 6% fine remains a ceiling, not a verdict.