Online travel platform Booking.com has come under formal regulatory scrutiny after the European Union opened an investigation into allegations concerning fake accommodation listings, deceptive phishing schemes, and the mishandling of consumer data. The European Commission announced the inquiry on Wednesday, focusing on whether the company failed to implement sufficient safeguards to protect travellers from digital fraud and unlicensed holiday properties. Regulators suspect that the platform may have underestimated the reach and severity of fraudulent operations conducted across its ecosystem, while failing to stop bad actors from using customer details to orchestrate deceptive booking communications.
Scrutiny Grows Over Consumer Risks Under Digital Services Act
The action marks the first formal proceeding against Booking.com under the European Union’s landmark Digital Services Act, a regulatory framework crafted to hold digital platforms accountable for illegal content, consumer harms, and unsafe online practices. European authorities are probing whether the company allowed fraudulent property advertisements and uncertified rentals to proliferate unchecked. Such listings risk luring holidaymakers into paying for non-existent or unauthorised lodgings, resulting in direct financial harm while exposing user records to illicit operators.
European officials are evaluating the platform’s internal mechanisms for flagging suspicious properties, managing user complaints, and defending personal data against cyberattacks. The inquiry also covers deceptive phishing techniques where fraudulent operators target customers with bogus payment requests or messages designed to steal sensitive account credentials. European Commission Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen affirmed that Europeans must be able to book travel arrangements without fear of falling prey to scams, noting that the Digital Services Act sets explicit obligations that the continent’s dominant travel portal must take seriously.
Probe Focuses on Unlabelled Commercial Search Placements
In addition to fraud prevention, European investigators are reviewing the platform’s handling of commercial search rankings to determine whether properties that pay for higher prominence are properly identified to consumers. The Commission is examining whether Booking.com failed to disclose paid placements clearly as commercial advertisements. Because elevated positions in search results significantly boost property visibility and booking rates, undisclosed commercial arrangements can impede a user’s ability to distinguish between organic search relevance and paid positioning.
The investigation will examine whether the platform’s ranking disclosures comply with transparency obligations mandated under European digital rules. A finding against Booking.com on this matter could set a wider precedent for commercial disclosure standards across the broader online hospitality sector. European regulators noted that no definitive determination of wrongdoing has been established on the labelling of paid search results, and investigators are continuing to review internal algorithmic and interface practices.
Booking Pledges Cooperation as Regulators Weigh Financial Penalties
Booking.com has stated that it is cooperating fully with the European Commission’s inquiries, maintaining that security, user trust, and personal data protection remain core commitments across its services. The company affirmed that it works alongside governments, regulatory bodies, and law enforcement agencies to counter fraud and safeguard travellers as well as hotel partners. The platform retains the ability to propose corrective operational commitments during the investigation to resolve regulatory concerns and demonstrate compliance with statutory standards.
Should the European Commission conclude that Booking.com violated the Digital Services Act, the company could face financial penalties of up to 6% of its total global annual turnover. The legislation provides European authorities with substantial punitive powers against non-compliant technology firms, though no statutory deadline governs the duration of the probe. The ongoing investigation is set to determine whether the travel giant fulfilled its legal duties to weed out fraudulent listings, protect consumer data, and provide complete clarity on commercial search listings.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
