European Union regulators have opened a formal probe into Booking.com, accusing the online travel giant of falling short in the fight against scams as reported fraud linked to the platform rises sharply this year.
The European Commission said it is concerned the reservations site is not doing enough to reduce the risk of fraudulent listings and so-called phishing scams.
Brussels is also examining whether Booking.com is failing to clearly mark as advertising those listings that rise higher in search results because accommodation providers paid to boost their visibility.
One EU official described the company’s anti-fraud performance as “absolutely substandard”.
In launching the investigation under the Digital Services Act (DSA), the commission said it will assess whether Booking.com has “properly identified and assessed the systemic risks linked to the dissemination of illegal content”.
“The investigation concerns the suspicion… that Booking.com is not doing enough to prevent online fraud and online scams on its network,” said an EU official.
Authorities say the suspected problems could include listings for properties that do not exist, as well as impersonation fraud.
Under the DSA, very large online platforms must ensure illegal or fraudulent content is removed and must have systems designed to reduce the risk of scams.
According to one EU official, a common pattern involves “people portraying themselves as the owner of premises and putting it up for rent while they are not the real owner.”
The official said holidaymakers can reach their destination after paying for accommodation, only to find they cannot get in “and the neighbours are telling them, ‘this is a scam’”.
Another threat highlighted by officials is phishing, in which criminals take control of a legitimate host’s account, pose as the owner and exploit the contact details of guests.
“They start sending messages that people need to pay additional amounts, for instance, and then you get a message that the property is not yet available and you need to pay an additional amount. If you do, it turns out to be the wrong person, so you have lost money,” said the official.
The commission said it will scrutinise whether Booking.com has adequate safeguards to stop data being misused and to curb fraud.
“We have clear evidence where we find that the risk assessment was not sufficient. What we want to see is that they clearly analyse the cases that happen on their own platform, that they analyse external reports, that they have a serious assessment of how serious the cases of fraud are.
“We feel that what they have done is absolutely substandard,” said the official.
Commission officials also believe Booking.com has downplayed the consequences of fraudulent listings and unlicensed accommodation.
“In the future we expect Booking.com to do a more diligent risk assessment,” said a second EU official.
“But we also suspect that they have not taken these risk factors – the fraudulent and non-compliant offers – into account and that they haven’t mitigated this properly.
“We can already see that the removal of listings after getting [complaints] was not what one would expect in these situations,” said the official.
Regulators will additionally look at the system that allows hotels and other accommodation providers to pay for improved placement on Booking.com, and whether such paid boosts are sufficiently labelled.
“Accommodation providers can make their listings more visible in Booking.com’s search results by paying a higher commission,” said the statement. “Users should be able to clearly recognise that these ‘boosted listings’ are in fact advertisements,” said the statement.
“The commission will also examine whether, for each advertisement shown on Booking.com, users can easily see who is behind, who paid for it, why they are seeing it and how they can change the settings that determine which ads they see.”
The commission said the DSA gives users the right to know when advertising is being shown to them, and in whose interest.
“Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility,” it said.
The European Commission said it has been working closely with the Dutch regulator because Booking.com is headquartered in the Netherlands.
Officials said a Dutch consumers report found a “tenfold” jump in fraud cases this year compared with 2025. In the first part of 2026, 1,072 notifications of fraud connected to Booking.com were registered, with losses estimated at around €82,000.
While the Dutch data has provided what officials called solid evidence, they acknowledged that information from across the EU remains “piecemeal” because the commission is drawing on reports supplied by national consumer organisations.
“This is a Europe-wide investigation,” said one official.
Officials said the commission will move quickly with an “in-depth investigation as a matter of priority”, including further requests for information and, where necessary, interviews or inspections.
The commission linked the Booking.com inquiry to a broader rise in fraud across consumer platforms, citing notifications from BEUC, the umbrella organisation representing 44 consumer protection agencies across Europe.
Banks and online payments operators also report that 70% of scams originate on internet platforms, according to an EU official. European Central Bank figures from 2024 put overall damages from online fraud at €4.2 billion, with incidents rising by 17% a year.
The commission said it remains in dialogue with Booking.com and stressed that the case is still at an early stage. An official said the immediate focus is to determine how quickly and how consistently the company removes fraudulent listings.
In a statement, a Booking.com spokesperson said: “We are cooperating fully with the European Commission and engaging constructively on its questions under the Digital Services Act (DSA).
“Security, trust and the protection of personal information are top priorities at Booking.com.
“We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud, and protect travellers and partners.”
Fine Gael MEP Regina Doherty welcomed the inquiry, but argued that Booking.com customers “need protection now”.
“How many more people have to lose their holiday money before Booking.com gets a grip on this?
“I called out these scams last year and demanded action. It’s shocking that customers are still being targeted while we’re still asking the same questions.
“This company has already been fined for reporting a previous data breach too late. It’s ludicrous that customers handing over their hard-earned money should have to play detective to work out whether their accommodation actually exists.
“I welcome this investigation, but customers need protection now. Booking.com is quick enough to take its commission. It needs to show the same urgency in protecting the people who keep it in business.”
