A family arrives at a holiday flat that does not exist. Elsewhere, a guest receives a message from their hotel, sent through the platform’s own chat, asking them to pay again. Brussels suspects that Europe’s biggest booking site has done far too little to stop such scams. Now it wants answers.

Stories like these are multiplying. According to Commission spokesperson Thomas Regnier, Booking.com itself reports a 500 per cent rise in scams between 2022 and 2024. Moreover, fraud reached €4.2bn in 2024 alone, he told journalists at the midday briefing. At the same time, few travellers can avoid the platform. After all, it handles two-thirds of hotel bookings made through online travel agencies in Europe, Mr Regnier noted.

On 21 October, the European Commission opened formal proceedings against the company. It acted under the Digital Services Act (DSA), the EU’s rulebook for large online platforms. The law requires the biggest platforms to assess and limit the risks their services pose to users. EU officials did not mince their words. “We feel that what they have done is absolutely substandard,” one senior official said, speaking on condition of anonymity.

Hotels that do not exist

The first concern is the most basic one. Fraudsters post offers for properties that do not exist or pose as the owners of real ones. One EU official described scammers “portraying themselves as the owner of premises” without actually owning them. Mr Regnier was blunter. “You book a hotel, you show up at the address, the hotel is not there. That’s illegal,” he said.

Brussels also doubts that Booking.com reacts fast enough. According to a second official, the removal of listings after complaints “was not what one would expect in these situations”. In fact, critics have warned about weak checks for some time. For example, British consumer group Which? looked at the platform in 2025. Unlike Airbnb, Booking.com did not require identity checks before a listing went live.

We feel that what they have done is absolutely substandard.
— Senior EU official

The second concern, however, is subtler. Many scams start only after a genuine booking. Criminals take over hotel accounts and write to guests through Booking.com’s own messaging service. Because the message arrives in the official app, guests trust it. As a result, they pay a second time or hand over their card details. According to EU officials, a Dutch consumer report counted 1,072 fraud notifications on Booking.com in the first part of 2026. That is ten times more than in 2025.

“We have concerns that Booking is not sufficiently protecting the data of both business and private users,” Mr Regnier said. That data includes names, phone numbers, and email addresses. In the wrong hands, it makes a fake payment request look entirely genuine. Therefore, the Commission will examine how the platform shares guest data with hotels and how it designed its messaging service.

Ads in disguise

Finally, the third concern sits in plain sight, at the top of the search results. Hotels can pay Booking.com a higher commission to rank higher. “If you pay to have your hotel ranked higher on the platform, that’s simply advertising,” Mr Regnier said. The DSA allows such ‘boosted listings’. However, users must see that they are ads, who paid for them, and why they see them. “While the practice as such is legal, Booking must be transparent towards consumers,” he added.

The investigation did not come out of nowhere. In September 2025, the Commission asked Booking.com how it fights fake listings. Such listings trick people into paying for stays that never happen. A second request followed in May 2026. Brussels also went through the risk reports the company submitted between 2023 and 2026. “We have clear evidence where we find that the risk assessment was not sufficient,” a senior official said.

This is the first DSA case against Booking.com. The Commission designated it a very large online platform in April 2023. If the Commission proves a breach, it can fine the company up to 6 per cent of its global annual turnover. Serious and repeated breaches can even lead to a temporary ban in the EU. Before any decision, however, the Commission can still gather evidence. It can send more questions, conduct interviews, or inspect the company. It can also accept commitments from Booking.com to fix the problems.

Pressure from consumer groups

Consumer advocates welcomed the move. “It is positive to see the European Commission investigating Booking.com for failing to meet EU digital rules. This is a systemic problem,” said Agustín Reyna, Director General of the European Consumer Organisation (BEUC). He also urged companies to “urgently abide by the rules and clean up the financial scams circulating on their platforms”. In May, BEUC and 29 of its members filed complaints against Meta, TikTok, and Google over scam ads. The group now wants Brussels to tackle those cases too.

Europeans should be able to book their holidays without fear of being scammed.
— Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, put it simply. “Europeans should be able to book their holidays without fear of being scammed,” she said. Booking.com said it was “cooperating fully” and called security, trust, and the protection of personal information its top priorities. The company also said it would keep “working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime”.

The outcome may take time. Asked about the slow pace of earlier DSA cases, Mr Regnier stood firm. The goal is “not only to close cases, but to win them in court”, he said. He expects companies to challenge the decisions and noted their right to defend themselves. That, too, takes time.