European Commission Opens Digital Services Act Probe Into Booking.com Over Scams and Fraud

Booking.com now faces formal EU scrutiny over fraud on its platform, a case that could carry fines of up to 6% of global annual turnover and shape how every large OTA handles scams and guest data.

The European Commission has opened formal proceedings to determine whether Booking.com breached the Digital Services Act (DSA) by failing to adequately assess and mitigate risks from fraudulent listings and phishing scams. Booking.com has been designated a very large online platform (VLOP) since April 2023.

What the Commission will examine

The probe follows a preliminary review of Booking.com's risk assessment reports for 2023 through 2026, its transparency reports, and its replies to Commission information requests from September 2025 and May 2026. It will look at:

• Fake listings, including nonexistent properties, impersonation fraud and non-compliant offers.
• Phishing risks, particularly how reservation and guest data is shared with accommodation providers and how Booking.com's messaging services are used.
• Advertising transparency, including whether users can clearly tell when content is an ad and how they can adjust their ad settings.

What happens next

The Commission is still gathering evidence. Opening proceedings allows it to impose interim measures or to find a DSA violation. Booking.com could also settle by offering commitments. Platforms found in breach can be fined up to 6% of global annual turnover.

Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, security and democracy, said Europeans should be able to book holidays without fear of being scammed. A Booking.com spokesperson said the company is cooperating fully and engaging constructively, and that security, trust and personal data protection are top priorities.

Context

In April 2026, Booking.com confirmed that unauthorized parties had accessed guest names, email addresses, phone numbers and booking details; it said it updated PINs for affected reservations and notified guests. The company was also designated a gatekeeper under the Digital Markets Act in May 2024 and said in November 2024 that it had made changes to comply.