Booking.com is facing a formal European Commission investigation into concerns about fraudulent accommodation listings, phishing scams and the transparency of paid search placement. The proceedings, opened under the Digital Services Act, could lead to further enforcement action if regulators find the platform failed to manage systemic risks affecting consumers.
What is happening with Booking.com?
The European Commission said it will carry out an in-depth investigation as a priority. The inquiry will examine whether Booking.com properly identified and reduced risks linked to illegal or misleading content on its platform.
The investigation does not establish that Booking.com has breached EU law. The Commission stressed that opening formal proceedings does not prejudge the final outcome. However, it gives regulators wider powers to request information, impose interim measures, issue non-compliance decisions or accept commitments from the company to address concerns.
- The investigation is being conducted under the EU Digital Services Act.
- It will examine fake listings, impersonation fraud and phishing risks.
- Regulators will assess how reservation and guest data is shared.
- The transparency of paid or “boosted” listings is also under review.
Why fraudulent listings are a concern
Booking.com connects travellers with more than 30 million accommodation options worldwide and has processed billions of bookings since 2010. Its scale makes the platform useful to consumers, but it also creates an attractive target for criminals.
The Commission’s investigation will focus on several forms of suspected abuse, including non-existent properties, impersonation of legitimate accommodation providers and offers that do not comply with consumer protection requirements.
Fake listings can cause significant financial and practical harm. A traveller may pay for a property that does not exist, arrive to find that a reservation is invalid or be redirected to a fraudulent payment process. The risks can become more serious when criminals use genuine booking information to make their messages appear credible.
Phishing and reservation hijacking risks
Another central part of the inquiry concerns phishing scams linked to reservation and guest data. The Commission will assess whether Booking.com has taken sufficient steps to prevent information being misused to solicit fraudulent payments.
Regulators will examine the platform’s data-sharing arrangements with accommodation providers, as well as the design and operation of its internal messaging service. These systems can be important for legitimate communication, but compromised accounts or deceptive messages may allow criminals to impersonate hotels, hosts or platform representatives.
Earlier in 2026, concerns were also raised after unauthorised parties gained access to customer details in a data breach. That incident heightened fears about “reservation hijacking”, where criminals target people who have real bookings and use knowledge of those reservations to make scams seem authentic.
Paid listings and advertising transparency
The investigation will also consider whether Booking.com clearly identifies accommodation listings that receive greater visibility because providers pay higher commissions.
Under the Digital Services Act, users should be able to recognise when content is an advertisement and understand who is responsible for it. The Commission said travellers should be able to see:
- who is behind an advertisement;
- who paid for the increased visibility;
- why the listing is being shown prominently; and
- how advertising preferences can be changed.
This distinction matters because a listing may appear near the top of search results either because it best matches a traveller’s criteria or because the provider paid for additional prominence. Clear labelling allows users to make more informed comparisons.
What the Digital Services Act requires
The Digital Services Act places additional responsibilities on very large online platforms and search engines. These companies must identify, analyse and mitigate systemic risks connected with their services, including risks involving illegal content, consumer harm and deceptive practices.
Platforms must also provide greater transparency around online advertising and explain how their systems operate. The rules are designed to make digital services safer while giving users more information about the content and commercial messages they encounter.
Booking.com’s size and role in the travel market mean that the case could have implications beyond one company. Any regulatory findings may influence how online travel platforms verify accommodation, handle customer communications and label sponsored results.
What happens next?
The European Commission will now conduct its detailed assessment using information gathered from Booking.com, including risk reports submitted during 2026 and the previous three years, transparency reports and responses to formal requests for information.
The timing and final outcome remain uncertain. The Commission may take additional enforcement steps during the process, and Booking.com may offer commitments intended to resolve the concerns. A formal investigation alone does not mean penalties will follow.
For travellers, the immediate priority is caution when receiving payment requests or unexpected messages about an existing reservation.
Practical steps for travellers
- Keep payments and communications within the official Booking.com system where possible.
- Check the web address carefully before entering login or card details.
- Be cautious about urgent requests to pay through a separate link or bank account.
- Contact the accommodation and Booking.com through verified channels if a message seems unusual.
- Save booking confirmations and report suspected fraud promptly.
Frequently asked questions
Has Booking.com been found guilty of breaking EU law?
No. The Commission has opened formal proceedings, but it has made clear that the investigation does not prejudge the final decision.
What issues are being investigated?
The inquiry covers fraudulent listings, impersonation, non-compliant accommodation offers, phishing risks, data-sharing practices, the messaging system and advertising transparency.
Could Booking.com face penalties?
Further enforcement action is possible if the Commission identifies non-compliance. Regulators may also accept commitments designed to correct the issues.
Why this matters for consumers
The case puts online travel safety and advertising transparency at the centre of the latest Ireland News agenda. Travellers depend on booking platforms to provide accurate information, protect personal details and make clear when commercial payments influence search results.
The investigation will test whether Booking.com’s safeguards are strong enough for a platform operating at global scale. Until the Commission reaches a conclusion, users should treat unexpected payment requests and reservation messages with care.
Booking.com remains under investigation, not formally found in breach. The key takeaway for consumers is simple: verify listings, protect booking information and use official communication channels whenever a payment request appears suspicious.