Summary

• The European Commission has opened formal Digital Services Act proceedings concerning Booking.com's assessment and mitigation of fraudulent listings and phishing scams.
• Investigators are examining risks involving guest and reservation data, alongside whether accommodation providers paying for better search positions are clearly identified as advertisers.
• Opening proceedings does not establish an infringement. The Commission may investigate further, accept commitments, order interim measures or reach a formal decision.

The European Commission has opened a formal investigation into Booking.com’s handling of fraudulent accommodation listings, phishing scams and paid search placements, putting the travel platform’s customer protection and advertising transparency arrangements under scrutiny.

Proceedings launched on 21 October will examine whether the company has adequately assessed risks arising from fraudulent activity and introduced effective measures to reduce them. The investigation also covers the use of reservation information in scams and the way accommodation providers paying for greater search visibility are presented to customers.

The Commission has identified potential breaches of the Digital Services Act (DSA), but it has not established that the platform infringed the law. The inquiry will test whether Booking.com’s risk assessments, safeguards and disclosure arrangements meet its obligations as a designated very large online platform.

Booking.com connects travellers with accommodation providers across numerous markets, enabling customers to compare properties, make reservations and communicate with businesses through its service. Those interactions also create opportunities for criminals to impersonate genuine accommodation providers or exploit information associated with bookings.

Fraudulent listings create platform-wide risks

The first part of the investigation concerns fake and otherwise non-compliant accommodation listings. These may involve properties that do not exist, offers made by people without authority to advertise accommodation or listings that fail to meet applicable legal requirements.

A fraudulent listing can closely resemble a genuine offer, particularly where a customer encounters it alongside legitimate accommodation and uses familiar booking procedures. The customer may make a payment or supply information before discovering that the reservation is not genuine.

Large platforms are required under the DSA to assess certain systemic risks associated with their services and introduce appropriate mitigation measures. Those responsibilities extend beyond removing individual items after a complaint when the design or operation of the service may allow similar activity to recur.

The Commission will therefore examine the measures Booking.com uses to identify fraudulent listings and whether those controls adequately reduce the risks identified through its assessments.

Possible mechanisms include checking information supplied by accommodation providers, examining suspicious listing patterns and responding when legitimate businesses report impersonation. The inquiry has not established that any particular additional measure is legally required or that existing controls are ineffective in every circumstance.

Verification itself involves operational trade-offs. Requiring more evidence from property providers can increase the work involved in joining a marketplace, while insufficient checks may make it easier for criminals to exploit the trust customers place in an established platform.

The Commission has not published a verified overall fraud rate for Booking.com in announcing these proceedings. Nor has it established the proportion of accommodation listings that are fraudulent, so the existence of the investigation should not be used to infer the scale of customer losses.

Reservation details can make phishing convincing

A second strand concerns phishing scams that exploit information associated with accommodation bookings. Fraudulent communications can become more persuasive when they reference a real traveller’s reservation, dates, property details or other information that the recipient recognises.

Accommodation providers need access to relevant reservation information to manage stays, respond to customers and handle changes. However, such information can also be valuable to an attacker who gains unauthorised access to a connected account or impersonates a provider.

The Commission will examine how Booking.com shares reservation and guest data with accommodation businesses and whether appropriate controls protect users against misuse of that information.

It will also assess risks connected with the platform’s messaging service. Messages arriving through a familiar communication channel may appear more trustworthy than unsolicited correspondence from an unknown address, even where a compromised account or impersonation has placed fraudulent instructions in front of a customer.

Payment requests create particular exposure. A traveller may be told that a reservation will be cancelled unless payment details are entered into a separate website, or that an earlier payment has failed and must be repeated.

Where a request is fraudulent, the attacker may be attempting to collect card information, obtain a direct transfer or redirect the customer towards a website under criminal control.

Effective protection requires a combination of account security, controls governing access to reservation information, monitoring of suspicious communications and clear procedures for customers to challenge unexpected payment requests.

Warning messages alone may be insufficient if an attacker can continue issuing convincing requests from an apparently legitimate accommodation account. Conversely, restrictions on messaging must still allow genuine providers to communicate essential information to travellers.

The investigation will examine whether Booking.com’s approach satisfies its legal obligations, rather than assuming that the mere occurrence of a phishing attempt proves the platform has breached the DSA.

Paid ranking receives a transparency test

The third strand concerns the commercial arrangements through which some accommodation providers pay a higher commission to improve their position in search results.

Such placements can influence which properties customers see first when comparing accommodation. Although paid promotion is an established feature of many online marketplaces, the distinction between commercial placement and ordinary ranking must be sufficiently clear where advertising transparency requirements apply.

Under Article 26 of the DSA, users must be able to identify advertising presented on online platforms and obtain information about the party on whose behalf it appears and relevant factors governing its display.

The Commission is examining whether Booking.com clearly identifies boosted accommodation listings as advertisements when providers pay for increased prominence.

A traveller may interpret a high search position as evidence that a property is particularly relevant to the destination, dates and preferences entered. Where commercial payment influences that placement, disclosure helps the customer understand the nature of the recommendation.

The proceedings do not challenge paid ranking merely because it involves a commercial arrangement. The question being examined is whether the presentation of those placements complies with the transparency obligations imposed by the DSA.

European supervision moves into formal proceedings

Booking.com was designated a very large online platform under the DSA in April 2023. That designation brought additional obligations relating to the assessment and mitigation of systemic risks, alongside direct European Commission supervision of the relevant provisions.

The latest proceedings follow earlier requests for information concerning fraud, business verification and other safeguards. The Commission can now seek additional evidence, examine internal assessments and conduct further investigative steps.

Where the legal conditions are satisfied, the Commission may adopt interim measures, accept commitments offered by the company or issue a decision finding non-compliance. None of those outcomes should be treated as predetermined.

Fines under the DSA can reach a statutory maximum of 6% of a provider’s worldwide annual turnover, but that figure describes the possible legal ceiling rather than a proposed penalty in the Booking.com case.

The company has said it will cooperate with the authorities and remains committed to protecting customers against cybercrime. Its position does not resolve the questions under examination, which must be assessed through the Commission’s investigative process.

The proceedings also illustrate the distinction between platform responsibility and the actions of individual criminals. A fraudulent listing or phishing message may be created by a third party, while the DSA places obligations on large platforms to assess relevant systemic risks and implement proportionate safeguards.

For accommodation providers, the eventual outcome may affect verification requirements, the information available through platform messaging and the presentation of commercially promoted listings. Travellers may also encounter changes to warnings, account protection or the way paid search results are labelled.

Those possible changes remain contingent on the investigation. As of 21 October, the established development is the opening of formal proceedings concerning three defined areas of Booking.com’s operations, with the outcome and any remedies still undecided.