What regulators are examining

The European Commission announced on 21 October 2026 that it is investigating Booking.com, the Amsterdam-headquartered company that claims 28 million accommodation listings, over whether it failed to do enough to shield consumers from fraud. The inquiry will test whether the platform breached the EU's Digital Services Act through its handling of fraudulent listings and phishing scams, in which criminals pose as a third party to trick people into handing over money.

Officials are examining several distinct lines of concern:

• Cases where consumers believed they had booked a stay, only to arrive and discover the property had been fraudulently listed.
• "Reservation hijacks", a second category of scams in which criminals use hacked data to impersonate an accommodation provider, sending WhatsApp messages and even using Booking.com's own platform to request payments supposedly to secure a stay.
• Whether the site broke advertising transparency rules by failing to make clear that some accommodation providers had paid to make their business more visible.
• Whether the company has sufficient safeguards to prevent data from being misused.

An unnamed commission official said Booking.com is required under the DSA to carry out risk assessments and act to prevent fraud. "We feel that what they have done is absolutely substandard," the official said, adding that although the company takes measures, "they could go much further and they could have much more solid systems to prevent fraud."

Scam reports rising

The probe follows a stream of complaints from consumer groups. The Dutch association Consumentenbond received 200 scam reports totalling €65,000 involving Booking.com in 2025, up from 89 reports worth €25,000 the previous year. It described the figures as "just the tip of the iceberg", noting that many victims never contact its fraud helpdesk.

Other reported cases point to the scale of online travel fraud:

• Cases seen by Guardian Money in 2025 involved the theft of several hundred pounds.
• Booking.com itself told the BBC in 2024 it had recorded a 500 to 900% increase in scams over the previous 18 months, driven by generative AI tools that make fake emails and booking links look realistic.
• Researchers at the UK consumer group Which? exposed security lapses after using the site to set up, and accept payment for, a fake offer to stay at 10 Downing Street.

Booking.com's response

A company spokesperson said Booking.com was engaging constructively with the commission. "Security, trust and the protection of personal information are top priorities at Booking.com," the spokesperson said, adding: "We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud."

What happens next

The commission stressed that opening the Booking.com EU investigation does not prejudge its outcome. Under the Digital Services Act, the company could ultimately be fined 6% of its worldwide annual turnover.

On tech policy, Henna Virkkunen serves as the commission's lead official, and she framed the stakes for travellers: "Europeans should be able to book their holidays without fear of being scammed."

Agustín Reyna, director general of the consumer group BEUC, welcomed the move: "It is positive to see the European Commission investigating Booking.com for failing to meet EU digital rules. This is a systemic problem."