EU opens Booking.com fraud probe over substandard defenses

According to The Register, officials said the probe has three strands. One is whether Booking.com is failing to prevent fraudulent and non-compliant listings, including cases where someone presents themselves as the owner of a property and offers it for rent when they are not. Another is whether the company is doing enough to counter phishing, smishing and other social-engineering scams, including account takeovers in which criminals contact travelers as if they were legitimate hosts. The third examines advertising transparency: whether ads are clearly separated from organic results, and whether boosted listings are plainly identified.

The Commission also suspects Booking.com is not sufficiently protecting the data of consumers and business users.

That bureaucratic phrasing covers a familiar kind of panic. A room that does not exist. A host who turns out not to be the host. A message asking for another payment after the booking already felt settled. Travel platforms trade on compressed trust, and when that trust is abused the damage is rarely confined to inconvenience.

Officials cited Booking.com’s own admission in June 2024 of a 500 to 900 percent jump in travel scams over the previous 18 months. In the Netherlands alone, The Register reported, more than 1,000 fraud notifications were made in the first part of 2026, with losses of €82,000, a tenfold increase on the previous year. An official said the Commission has reports like that from almost all member states.

The most revealing part of the Commission’s case is its bluntness. An official told The Register that Booking.com’s anti-fraud work was “absolutely substandard.” That goes beyond saying criminals use a large platform. The Commission says Booking.com does assess fraud risks using cases on its own platform and external reports, and does take internal measures. Its complaint is that those measures did not go nearly far enough.

Officials said they expect a more diligent risk assessment in future. The Register reported that could include tackling abuse of the reservation system, removing listings quickly when fraud is reported, checking licenses and changing how property owners are onboarded.

Booking.com said it is “cooperating fully with the European Commission and engaging constructively on its questions” under the DSA. The company added that security, trust and the protection of personal information are top priorities, and that it remains committed to working with governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud.