EU opens Digital Services Act case against Booking.com over scams

EU opens Digital Services Act case against Booking.com over scams

21 October 2026: The European Commission has opened formal proceedings to decide whether Booking.com broke the Digital Services Act by failing to assess and curb the risk of fake listings and phishing scams, and by not labelling as adverts the listings whose owners pay a higher commission to rank higher. If the suspicions are proven, they would breach Articles 34 and 35, which oblige very large platforms to assess and mitigate systemic risks, and Article 26(1) on identifying advertisements.

Three lines of inquiry

The Commission will look at:

• fraudulent and non-compliant listings, including properties that do not exist, impersonation fraud and accommodation offers that break local rules, and whether Booking.com removes them effectively
• phishing that exploits reservation and guest data, in particular how that data is shared with accommodation providers and how Booking.com's messaging service is designed, and whether safeguards stop it being used to solicit fraudulent payments
• boosted listings, where providers pay a higher commission for visibility, and whether users can tell those placements are adverts and see who paid, why they are being shown the ad and how to change the settings behind it

Why the hotel side is in the frame

The phishing strand is the one that reaches past consumers. The scams the Commission describes run through the channel between platform and property: a guest receives a message that appears to come from the hotel inside the booking flow and is asked to pay again. That puts the security of the accounts hotels and short-let managers use to reach the platform, and of the channel managers and property systems connected to it, inside the question of whether Booking.com's safeguards are adequate. The advertising strand touches revenue: if paid visibility has to be labelled more clearly, providers that buy higher placement may find it works differently once guests can see it is paid for.

Our hotel channel management software category lists 12 products and our hospitality property management category 10, the tools through which most properties connect to the platform.

How the case got here

The decision follows a preliminary investigation that read Booking.com's risk assessment reports for 2026 and the three years before, its transparency reports, and its answers to formal requests for information sent on 23 September 2025 and 26 May 2026. Booking.com was designated a very large online platform on 25 April 2023. The Commission works on the case with the Dutch Authority for Consumers and Markets, the digital services coordinator for the Netherlands, where Booking.com is established; on the advertising question, opening proceedings takes that power away from national authorities for the conduct covered.

What can happen next

The Commission says it will investigate "as a matter of priority", through further requests for information, interviews or inspections. Opening proceedings lets it impose interim measures, adopt a non-compliance decision or accept commitments from Booking.com, and it stresses that the step does not prejudge the outcome. The press release sets no deadline for the investigation.

Sources

• European Commission: Commission to investigate how Booking.com combats scams and fraud under the Digital Services Act (IP/26/2223), 21 October 2026
• European Commission, Shaping Europe's digital future: Commission to investigate how Booking.com combats scams and fraud, 21 October 2026