European Commission investigates Booking.com over fraud and phishing risks

Booking.com European Commission Digital Services Act phishing online fraud

The European Commission has launched a formal investigation into Booking.com under the Digital Services Act (DSA) to determine if the platform is doing enough to mitigate systemic risks. The probe, initiated on October 21, focuses on three primary areas: the prevalence of fraudulent accommodation listings, the effectiveness of measures against phishing and social engineering attacks, and the transparency of advertising practices, specifically regarding whether paid rankings are clearly distinguished from organic results.

Security researchers at Norton have identified approximately 350 compromised accommodations across 50 countries, with Germany reporting the highest number of cases at 49. These 'reservation hijacking' attacks involve criminals using legitimate booking data to send convincing messages to guests, requesting additional payments.

The investigation follows reports of a significant rise in tourism-related scams. In the Netherlands, for example, over 1,000 fraud cases were reported in early 2026, resulting in damages of approximately 82,000 euros. The Commission will examine Booking.com’s data-sharing practices with accommodation providers and its internal messaging systems to assess whether they facilitate or prevent such fraudulent activities.

Entities

Booking.com · Digital Services Act · European Commission · Henna Virkkunen · Norton

Claims

What the coverage asserts, and how many sources carry each claim.

[○ 1 SOURCE] Norton researchers identified 350 compromised accommodations in 50 countries. atvbl.rs
[○ 1 SOURCE] Booking.com was designated as a Very Large Online Platform (VLOP) on April 25, 2023. techlaw.pl
[○ 1 SOURCE] Germany had 49 compromised accommodations identified by Norton. atvbl.rs
[DISPUTED] In the Netherlands, over 1,000 fraud cases were reported in early 2026. sdk.mk
[○ 1 SOURCE] The fraud in the Netherlands caused damages of 82,000 euros. sdk.mk
[● 3 SOURCES] The investigation is being conducted under the Digital Services Act (DSA). www.atlanticohoy.com · www.tanea.gr · techlaw.pl
[● 4 SOURCES] The probe examines fraudulent accommodation listings, phishing risks, and advertising transparency. www.atlanticohoy.com · www.tanea.gr · techlaw.pl · sdk.mk
[● 3 SOURCES] The European Commission opened a formal investigation into Booking.com on October 21. www.atlanticohoy.com · www.tanea.gr · techlaw.pl