EU Opens Booking.com DSA Investigation Over Fake Listings and Phishing Scams
Do Son 
On October 21, the European Commission opened formal proceedings against Booking.com under the Digital Services Act. The Booking.com DSA investigation will test whether the platform did enough to stop fake listings and phishing scams. It will also check whether paid “boosted” listings are clearly labeled as ads.
Three Areas Under Scrutiny
Fraudulent Listings
First, the Commission will look at fake listings, such as offers for non-existent properties and impersonation fraud. It wants to know whether Booking.com assessed these risks and removed fraudulent offers.
Booking.com Phishing Scams
Second, the probe targets Booking.com phishing scams. Regulators will focus on “the way reservation and guest data is shared with accommodation providers, and the design and functioning of Booking.com’s messaging service.” They will also ask whether safeguards stop criminals from using that data “to carry out phishing and solicit fraudulent payments.”
This concern is not new. In 2023, scammers reached Booking.com customers through its official messaging system. Moreover, PhocusWire notes that Booking.com confirmed in April that unauthorized parties accessed guest names, emails, phone numbers and booking details.
Hidden Advertising
Third, the Commission will examine boosted listings. Hotels can pay a higher commission to rank better in search results. However, the DSA says users must know “when, and on whose behalf, an ad is shown to them.”
Why the Stakes Are High
A Commission spokesperson told Dutch news agency ANP that Booking.com handles 66 percent of online accommodation bookings in Europe. The spokesperson also cited the company’s own data showing a 500-fold jump in fraud between 2022 and 2024.
“Europeans should be able to book their holidays without fear of being scammed,” said Executive Vice-President Henna Virkkunen.
If confirmed, the failures would breach Articles 34, 35 and 26(1) of the DSA. Fines can reach 6 percent of global annual turnover. Even so, the Commission stresses that opening proceedings “does not prejudge any final outcome.”
Booking.com Responds
Booking.com says it is “cooperating fully” with the Commission. “Security, trust and the protection of personal information are top priorities at Booking.com,” a spokesperson told PhocusWire.
Next, the Commission will gather more evidence through information requests, interviews or inspections. It can also impose interim measures or accept commitments from the company.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
