European Union Launches Major Booking.com Investigation as Fake Hotels, Payment Scams and Hidden Ads Spark Travel Safety Fears

Image generated with Ai

The European Union has launched a major investigation into Booking.com, placing one of Europe’s leading accommodation booking platforms under formal regulatory scrutiny over fake hotel listings, fraudulent payment requests and potentially misleading advertising practices. On 21 October 2026, the European Commission opened proceedings under the Digital Services Act (DSA) to determine whether Booking.com had adequately identified and reduced risks affecting travellers across the bloc. The investigation covers fraudulent accommodation offers, phishing attacks involving reservation information and search results that may promote hotels paying higher commissions without clearly identifying those placements as advertisements. The action comes at a time when travellers increasingly depend on online platforms to book hotels, apartments and other accommodation. Its findings could influence future hotel distribution, digital payment protection and consumer confidence across the European tourism industry.

European Union Tightens Its Grip on Online Travel Platforms as Booking.com Faces Formal Investigation

Europe’s online accommodation market is facing closer examination after the European Commission escalated its scrutiny of Booking.com from preliminary information gathering to formal proceedings. The investigation centres on whether the platform’s existing protections are effective enough to address the risks that travellers encounter when booking accommodation online. The proceedings are being conducted under the Digital Services Act, a European regulation designed to make online services safer and more accountable. It places additional responsibilities on platforms with a particularly large number of users, requiring them to assess risks arising from their services and introduce appropriate safeguards.

Booking.com has been designated a Very Large Online Platform since 25 April 2023. This classification applies to platforms reaching at least 45 million average monthly active users in the European Union. The Commission’s official register identifies Booking.com as having more than 45 million monthly active EU users, making its approach to fraud prevention an issue of considerable scale. The investigation follows an extended period of regulatory examination rather than a sudden enforcement decision. The Commission reviewed Booking.com’s 2026 risk assessment and reports from the preceding three years. It also assessed transparency reports and responses to official information requests issued on 23 September 2025 and 26 May 2026.

Fake Hotel Listings and Non Existent Properties Put Travellers at Risk Across Europe

Fake accommodation offers are among the most serious concerns being examined. Fraudsters may advertise properties that do not exist, impersonate genuine accommodation owners or publish hotel listings without proper authorisation. For a traveller, such deception can create problems long before a holiday begins. A customer may discover an attractive apartment or hotel, complete a reservation and make a payment, believing the accommodation is genuine. The problem may only become clear when the customer arrives and discovers that the property cannot honour the booking.

The consequences can extend beyond the initial financial loss. Travellers may need replacement accommodation at short notice, potentially at a higher price. Families arriving late at night or visitors unfamiliar with their destination may face particular difficulties. The Commission is examining whether Booking.com has adequately identified the systemic risks associated with fraudulent and non-compliant accommodation listings.

It will also assess whether measures intended to remove fraudulent offers are effective enough to protect customers. A related regulatory question concerns the identity of accommodation providers. In September 2025, the Commission specifically requested information about how Booking.com verifies businesses using its platform under the DSA’s Know Your Business Customer requirements. These rules help platforms identify potentially suspicious traders before they can offer services to consumers.

Phishing Attacks and Hijacked Booking Messages Trigger New Payment Security Concerns

The second major area concerns scams that exploit genuine reservations and traveller information. Unlike fake accommodation listings, these fraud attempts may begin after a customer has already made a legitimate booking. Criminals can attempt to compromise accommodation accounts or exploit weaknesses in connected systems. They may then send messages that appear to come from an actual hotel or an established booking channel.

A fraudulent message might claim that a card verification has failed, that an urgent payment is required or that the reservation will be cancelled unless the traveller follows a payment link. The Commission is investigating how Booking.com shares reservation and guest information with accommodation providers, alongside the design and operation of its messaging service. The proceedings do not establish that every reported phishing attack originated from a breach of Booking.com’s own systems. Security failures can arise at different points in the wider accommodation technology network, including connected hotel accounts and external property-management services.

Paid Hotel Rankings Face Major EU Scrutiny as Travellers Seek Greater Advertising Transparency

Advertising transparency is the third focus of the investigation. Booking.com allows accommodation providers to improve their prominence in search results by paying higher commissions. These arrangements can give participating properties additional visibility when travellers compare available rooms. The European Commission is assessing whether such boosted listings are clearly presented as advertising, rather than appearing to be ordinary results based entirely on search relevance.

This distinction matters because travellers often rely on the first results they see. A prominent listing may receive greater attention, even when other accommodation options offer a closer match to a customer’s budget, preferred location or facilities. Under Article 26(1) of the Digital Services Act, users must be able to identify advertisements and access meaningful information about them. The Commission will examine whether travellers can easily understand who is behind an advertisement, who paid for it, why they are seeing it and how relevant advertising settings can be changed.

What the EU Investigation Means for European Tourism and the Hotel Industry

The Booking.com investigation extends beyond the question of whether individual travellers have encountered fraud. It raises broader questions about the responsibilities of online platforms that connect accommodation providers with customers across Europe. Hotels, holiday apartments and smaller accommodation businesses depend on digital distribution channels to reach domestic and international customers. A secure booking environment is therefore important for both consumer confidence and commercial performance.

The following table summarises the confirmed scope of the investigation and its potential implications.

These implications are potential outcomes rather than confirmed new requirements. The Commission must establish whether violations occurred before deciding on appropriate enforcement measures.

New EU Research Highlights the Growing Threat of Online Financial Scams

The regulatory action also comes alongside fresh European research into online financial fraud. On 20 October 2026, one day before the Booking.com proceedings were announced, the European Commission published a study examining how financial scams operate across digital platforms.

The research identified several features that criminals may exploit, including advertising systems, private messaging, false identities, manipulated accounts and deceptive commercial content. It also examined how generative artificial intelligence can feature in evolving scam techniques. The report found that organised criminal networks increasingly provide tools and services that make online fraud easier to conduct. This provides wider context for the Booking.com investigation, particularly its emphasis on fraudulent accommodation offers and payment-related messages.

The study identified four broad categories of countermeasures that can help digital platforms address financial scams:

• Identity verification: Checking the legitimacy of businesses and accounts before they can operate.
• Detection and removal: Identifying suspicious content and removing fraudulent offers through automated systems and human review.
• Consumer safeguards: Providing reporting tools and information about available remedies.
• Platform cooperation: Improving internal policies and coordination with external organisations.

The study did not assess Booking.com’s individual compliance with the DSA. Claims supplied about a 500% to 900% increase in travel-related scams cannot currently be presented as verified EU statistics. The Commission’s formal announcement does not establish that range, identify a comparable measurement period or attribute such an increase specifically to Booking.com.

Booking.com Could Face Fines of Up to Six Per Cent of Worldwide Annual Turnover

The Digital Services Act gives the European Commission significant enforcement powers when designated very large online platforms fail to meet applicable obligations.

The Booking.com investigation examines potential infringements of three important provisions:

The maximum potential fine is substantial, but it should not be confused with a penalty already imposed. If violations are established, the Commission must consider the relevant legal criteria before determining enforcement action. These include the nature and seriousness of the infringement.

The proceedings could also result in commitments that require Booking.com to address specific regulatory concerns. The Commission may take interim measures when the applicable legal conditions are satisfied. No final infringement decision, mandatory platform redesign or financial penalty was announced when the formal proceedings opened on 21 October 2026.

What Travellers and Accommodation Providers Should Do as the Investigation Continues

The investigation does not prevent travellers from making reservations through Booking.com. It also does not introduce new border restrictions, passport requirements or visa procedures for visiting European countries. However, the regulatory concerns highlight practical precautions that can help protect accommodation bookings.

Customers should also examine accommodation details carefully and preserve payment confirmations and reservation records. These precautions are particularly relevant where multiple staff members or external technology providers can access reservation information. The investigation also draws attention to the commercial relationship between accommodation businesses and digital booking platforms.

What Happens Next as Europe’s Major Online Booking Investigation Moves Forward?

The European Commission will now continue its evidence-gathering process, with particular attention to Booking.com’s fraud prevention systems, reservation data safeguards and advertising disclosures. The next phase may include further requests for information, interviews with relevant stakeholders and inspections. The Commission is working with the Dutch Authority for Consumers and Markets, which serves as the Digital Services Coordinator for the Netherlands, where Booking.com is established.

For Europe’s wider tourism sector, the proceedings demonstrate how digital regulation increasingly intersects with hotel reservations, online distribution and traveller protection. The central issue is whether a large accommodation marketplace has taken effective and proportionate steps to prevent predictable risks arising from its services. The investigation could therefore become an important test of how Europe’s digital safety legislation applies to online travel booking platforms.