EU opens DSA case against Booking.com over fake listings and phishing

The European Commission opened formal proceedings against Booking.com under the Digital Services Act on 21 October. Brussels suspects the platform did not properly assess or curb the risks of fake accommodation listings and of phishing scams that exploit guests' reservation data. A third strand concerns boosted listings that hotels pay for but that are not clearly marked as ads.

"Europeans should be able to book their vacations without being scammed," said Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, heise reports. Booking.com has been a very large online platform under the DSA since April 2023, meaning it has more than 45 million monthly users in the EU. If the breaches are confirmed, it faces a fine of up to 6% of global annual turnover.

What Brussels will look at

The first strand is fake listings: non-existent properties, impersonation of real hotels and offers that break local rules. The Commission will check whether Booking.com assessed these risks and removed such listings effectively. Heise notes that Spain has recently seen listings for accommodation that did not exist at all.

The second strand is closest to guests' wallets. The Commission will examine how reservation and guest data is shared with accommodation providers and how Booking.com's messaging service is designed, and whether there are enough safeguards to stop that data being used for phishing and fraudulent payment requests. The third strand is advertising: hotels can pay a higher commission to rank higher in search results, and the DSA requires users to see clearly that such a listing is an ad and who paid for it.

The suspected breaches fall under Articles 34 and 35 of the DSA on systemic risks and Article 26(1) on ad transparency. The case follows formal information requests sent on 23 September 2025 and 26 May 2026. There is no deadline: the Commission can send new requests, interview staff, run inspections, impose interim measures or accept commitments from the company. Booking.com told dpa it is "cooperating fully". The same procedure is already running against other platforms, such as TikTok over minors' accounts.

How the scam reaches guests

In April 2026 Booking.com warned customers that "unauthorized third parties" had accessed reservation data: names, email and postal addresses, phone numbers and booking details. According to Malwarebytes, the criminals got in through hotel partners rather than Booking.com itself. Microsoft has tied attacks on hotel staff to a group it tracks as Storm-1865, which used fake CAPTCHA pages to install remote-access malware.

With a hotel's login, a scammer can message guests through the platform's own chat. Switzerland's Federal Office for Cybersecurity (BACS) described two versions in June. In one, a "Booking.com" or "hotel" WhatsApp message offers a refund or cashback because of an error. In the other, the guest is told the booking will be cancelled unless they verify their card or pay a deposit at once. Both lead to a fake payment page that collects card details.

What helps, according to BACS and Booking.com:

• Do not trust a message just because it names your dates, hotel and room: that is exactly the data that leaked.
• Do not open links from messages about refunds, "verification" or urgent payment, even inside the Booking.com chat.
• Check what you owe and when in the booking confirmation in the app or on the website, which you open yourself.
• If in doubt, call the hotel on a number you look up yourself. A refund never requires your login or a QR code scan.
• If you have already entered card details, call your bank and block the card.