EU investigating Booking.com over action on fraud cases

The EU is taking action against online travel agency Booking.com over how the reservations platform combats scams amid evidence of a surge in alleged fraud cases this year.

The European Commission said the site is not tackling the risk of fraudulent listings and so-called phishing scams.

Brussels is also investigating if the company is not clearly labelling as ads those listings which secure a higher ranking in online search results because their providers have paid to have the entry boosted.

The commission said that Booking.com's efforts in preventing fraud and scams have been "absolutely substandard".

Announcing the investigation under the Digital Services Act (DSA), the commission said it will explore if Booking.com has "properly identified and assessed the systemic risks linked to the dissemination of illegal content".

"The investigation concerns the suspicion… that Booking.com is not doing enough to prevent online fraud and online scams on its network," said an EU official.

These potentially include Booking.com entries for non-existent properties and impersonation fraud.

Under the DSA, large platforms are legally obliged to ensure fraudulent or illegal content is taken down and that there are measures in place to mitigate the risk of fraud.

According to one EU official, the fraud often amounts to "people portraying themselves as the owner of premises and putting it up for rent while they are not the real owner."

The official said that users can arrive at a holiday location having paid for a period of rental, only to discover that they do not have entry "and the neighbours are telling them, 'this is a scam’".

The fraud can also include phishing, whereby scammers take over the account of a property owner, portraying themselves as the owner and then abusing the contact details.

"They start sending messages that people need to pay additional amounts, for instance, and then you get a message that the property is not yet available and you need to pay an additional amount. If you do, it turns out to be the wrong person, so you have lost money," said the official.

The commission will examine if Booking.com has put in place sufficient safeguards to prevent data from being misused and to prevent fraud.

"We have clear evidence where we find that the risk assessment was not sufficient. What we want to see is that they clearly analyse the cases that happen on their own platform, that they analyse external reports, that they have a serious assessment of how serious the cases of fraud are.

"We feel that what they have done is absolutely substandard," said the official.

The commission says that Booking.com has underestimated the impact of fraudulent listings and unlicensed accommodation.

"In the future we expect Booking.com to do a more diligent risk assessment," said a second EU official.

"But we also suspect that they have not taken these risk factors - the fraudulent and non-compliant offers - into account and that they haven't mitigated this properly.

"We can already see that the removal of listings after getting [complaints] was not what one would expect in these situations," said the official.

Regulators are also investigating the practice whereby hotels can boost their rankings on the Booking.com website through payment, where the listing is not clearly identified as an advertisement.

"Accommodation providers can make their listings more visible in Booking.com's search results by paying a higher commission," said the statement. "Users should be able to clearly recognise that these ‘boosted listings' are in fact advertisements," said the statement.

"The commission will also examine whether, for each advertisement shown on Booking.com, users can easily see who is behind, who paid for it, why they are seeing it and how they can change the settings that determine which ads they see."

The commission said that under the DSA, users are entitled to understand when, and on whose behalf, an ad is shown to them.

"Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility," it said.

The European Commission has been in close contact with the Dutch regulator as Booking.com is headquartered in the Netherlands.

Officials say a Dutch consumers report has recorded a "tenfold" increase in fraud cases this year compared to 2025, with 1,072 notifications of fraud on Booking.com registered in the first part of 2026, with losses in the region of €82,000.

While the commission has received solid evidence from the Dutch experience, officials admit that evidence from across the EU is "piecemeal" as they are relying on reports from national consumer groups.

"This is a Europe-wide investigation," said one official.

Officials say the commission will carry out an "in-depth investigation as a matter of priority" by sending additional requests for information, conducting interviews or inspections.

The commission says there has been increased fraudulent activity across a range of consumer-facing platforms as notified by BEUC, the umbrella body bringing together 44 Europe-wide consumer protection agencies.

Banks and online payments operators also report that 70% of scams start on internet platforms, according to an EU official. ECB figures from 2024 indicate €4.2 billion in overall damages relating to online fraud, with cases increasing by 17% per year.

The commission said dialogue with Booking.com was continuing and that the investigation was in its preliminary stage. An official said the first priority was to check how quickly and how often the company takes down fraudulent entries.

In a statement, a Booking.com spokesperson said: "We are cooperating fully with the European Commission and engaging constructively on its questions under the Digital Services Act (DSA).

"Security, trust and the protection of personal information are top priorities at Booking.com.

"We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud, and protect travellers and partners."

Fine Gael MEP Regina Doherty welcomed the investigation, but said Booking.com's customers "need protection now".

"How many more people have to lose their holiday money before Booking.com gets a grip on this?

"I called out these scams last year and demanded action. It's shocking that customers are still being targeted while we’re still asking the same questions.

"This company has already been fined for reporting a previous data breach too late. It’s ludicrous that customers handing over their hard-earned money should have to play detective to work out whether their accommodation actually exists.

"I welcome this investigation, but customers need protection now. Booking.com is quick enough to take its commission. It needs to show the same urgency in protecting the people who keep it in business."