The European Commission has opened formal Digital Services Act proceedings against Booking.com over fake listings, reservation phishing and unlabelled paid-for rankings. The UK sits outside the DSA, but British travellers, hotels and platforms will all feel the effects.
What happened
On 21 October 2026 the European Commission opened formal proceedings to establish whether Booking.com has breached the Digital Services Act (DSA). Booking.com is designated a very large online platform, meaning more than 45 million EU users and the regulation’s heaviest systemic risk obligations.
The Commission has set out three strands. The first concerns fraudulent and non-compliant listings: non-existent properties, people posing as owners of premises they do not control, and accommodation offers that break the rules. The second concerns phishing that exploits reservation and guest data, focusing on how booking information reaches accommodation providers and how the messaging service is designed. The third is advertising transparency, specifically whether “boosted listings”, where a property pays a higher commission to rank better in search results, are clearly labelled as advertisements.
Henna Virkkunen, the Commission’s executive vice president for tech sovereignty, security and democracy, said Europeans “should be able to book their holidays without fear of being scammed”. A Commission official told The Register the company’s anti-fraud efforts were “absolutely substandard”. Booking.com said it was working fully with the Commission and described security, trust and safeguarding personal data as top priorities.
The detail
The decision follows a preliminary investigation in which the Commission reviewed the risk assessment reports Booking.com submitted in 2026 and the three years before, its published transparency reports and its answers to formal requests for information. The DSA treats that risk assessment as the foundation of compliance, so an underestimated risk undermines every mitigation built on it.
Officials pointed to the company’s own figures. In June 2024 Booking.com acknowledged a rise in travel scams of between 500 and 900 per cent over the preceding 18 months. According to a Commission official quoted by The Register, the Netherlands alone logged more than 1,000 fraud notifications in the first part of 2026, with losses of €82,000 and a tenfold rise on the previous year.
The phishing strand describes a pattern many security teams in hospitality will recognise. Criminals compromise a property’s account on the platform, take over its contact details and then message genuine guests asking for extra payments. The Commission is also examining whether Booking.com protects the data of both consumers and its business users well enough to stop this misuse. The Irish Times reports that it emerged earlier this year that the company had suffered a data breach in which “unauthorised parties” reached customer details, adding to worries about reservation hijacking.
Opening formal proceedings does not prejudge the outcome, but it unlocks the Commission’s enforcement toolkit. It can impose interim measures where users face a risk of serious harm, accept binding commitments from the company or issue a non-compliance decision. Under the DSA, fines for breaches can reach 6 per cent of global annual turnover, and periodic penalties of up to 5 per cent of average daily worldwide turnover can apply for each day a provider fails to comply with remedies. The official quoted by The Register suggested faster removal of reported listings, licence checks and tighter onboarding of property owners.
Why it matters for UK organisations
Since Brexit the DSA has not applied in the UK, and UK users do not count towards the EU thresholds that triggered Booking.com’s designation. Yet platforms seldom run separate fraud controls for each jurisdiction. If Booking.com strengthens owner verification, messaging safeguards or ad labelling to satisfy Brussels, British users are likely to inherit those changes.
The problem is already well documented here. Action Fraud warned Booking.com users in January 2025 after receiving 532 reports between June 2023 and September 2024, with £370,000 lost. It described the same model: hotel accounts taken over, most likely through targeted phishing of the property rather than a breach of Booking.com, then used to message guests in-app, by email and on WhatsApp.
The UK’s own regime is taking shape through the Online Safety Act. Ofcom published its register of categorised services on 10 July 2026, and services in Category 1 and Category 2A carry specific duties to protect users from fraudulent advertising under sections 38 and 39 of the Act. Ofcom’s consultation on the fraudulent advertising codes of practice closed on 2 October 2026, with a final statement expected by mid-2027 at the latest. Those duties cover paid-for advertising only, so they are narrower than the DSA’s systemic risk obligations, and I have not seen anything confirming whether a travel marketplace such as Booking.com sits in any OSA category. UK platform operators should still treat the Commission’s case as a preview of Ofcom’s questions: how did you assess fraud risk, and do your controls match the scale of the problem?
For UK hotels and holiday lets, the immediate point is that they are the weak link. A compromised extranet login exposes guest names, dates and contact details, and the property will typically be a data controller for that data under UK GDPR.
Expert view
This is a governance case wearing a cyber security jacket. The Commission is not primarily alleging that Booking.com was hacked; it is questioning whether the company’s risk assessment honestly reflected a known, growing threat and whether its mitigations kept pace. The same logic underpins NIS, DORA and the Cyber Security and Resilience Bill. A risk register that a regulator can show was out of step with your own incident data is a liability, not a defence.
In my experience, reservation-hijack fraud succeeds because of a familiar mix of weaknesses: shared extranet credentials at small properties, weak or absent multi-factor authentication, staff who open “guest complaint” attachments as part of their job, and customers trained to trust any message that knows their booking reference. When we test hospitality environments, front-desk machines that double as email workstations are a recurring finding. This is exactly the basic hygiene Cyber Essentials addresses.
What to do now
- Hotels and short-let operators: enforce multi-factor authentication on every booking platform extranet and give each member of staff a named account. This maps to the Cyber Essentials user access control requirements.
- Separate roles: keep the machine used for reservations away from general email and web browsing where you can, and keep it patched with anti-malware enabled, in line with the security update management and malware protection controls.
- Tell guests what you will never ask for: state plainly in confirmations that you will not request card details by message, and that payment changes must be verified through the official app or website.
- Platform operators: revisit your fraud risk assessment against your own incident and complaint data, and document how each mitigation addresses an identified risk. Ofcom’s codes are coming.
- Security awareness teams: brief staff and travelling employees on reservation-themed phishing, and on reporting through report@phishing.gov.uk, 7726 for texts and Action Fraud.
Bottom line
The UK is outside the DSA, but not outside its consequences. Booking.com’s response to Brussels will probably reach British users, and the scrutiny of risk assessments is where UK regulators are heading. Hotels should close the account-takeover gap now, and platforms should make sure their paperwork reflects reality.
Sources
- European Commission: Commission to investigate how Booking.com combats scams and fraud under the Digital Services Act
- European Commission: Enforcement of the Digital Services Act
- The Register: EU wants Booking.com to check out of its scam problem
- The Irish Times: Booking.com under investigation over fraudulent listings concerns
- PYMNTS: Booking.com anti-fraud practices face scrutiny in Europe
- Travel Weekly: Action Fraud issues Booking.com phishing alert
- Ofcom: Consultation: Fraudulent Advertising Codes of Practice
- RPC: Ofcom publishes Register of Categorised Services
