European Commission Opens Digital Services Act Case Against Booking.com Over Fraud Risks and Ad Transparency

The European Commission has initiated formal regulatory proceedings against Booking.com to investigate whether the digital lodging intermediary breached statutory duties under the Digital Services Act.¹³ The European Union formally designated the enterprise as a Very Large Online Platform under the legislative framework on 25 April 2023, subjecting it to the strictest tier of supervisory obligations.³ If European authorities establish non-compliance with these rules, the business faces potential statutory fines reaching up to 6% of its total global annual turnover.² Evidence supports that the company could incur massive financial liabilities tied to its international revenue should the Commission conclude that it infringed requirements on systemic fraud prevention and search advertising transparency.² The enforcement action centers on whether the platform breached Articles 34 and 35 regarding the governance of systemic risks, alongside Article 26(1) concerning advertising transparency.³

European officials have focused their inquiry directly on the internal architecture through which Booking.com conveys reservation data and guest personal details to accommodation providers.¹ Regulators are also dissecting the functional operation of the company's proprietary communication channels that connect travelers with listing operators.¹ The investigation specifically examines whether the company enforces sufficient safeguards to prevent user credentials and private booking information from being compromised for deceptive phishing attacks or unauthorized payment demands.³ Beyond communications security, European investigators are evaluating the marketplace mechanisms that permit property operators to obtain enhanced visibility within user search results by committing to higher commission percentages.³ This practice raises compliance questions under transparency requirements designed to ensure consumers clearly understand when paid commercial arrangements influence listing rankings.³

The launch of formal proceedings reshapes the administrative division of power across the European single market.³ By opening the case, the Commission directly relieves national Digital Services Coordinators and other individual Member State authorities of their enforcement and supervisory competencies regarding Article 26(1) for the targeted actions.³ European Union officials nevertheless maintain an active cooperative relationship with the Dutch Authority for Consumers and Markets to coordinate oversight of the platform under the statutory framework.³ To substantiate its ongoing case, the Commission intends to execute an exhaustive evidentiary process utilizing formal requests for information, extensive witness interviews, and direct on-site inspections.³

The enforcement decision was preceded by a prolonged preliminary examination of the company's operational records.³ Regulators systematically analyzed statutory risk assessments submitted for 2026 as well as documentation covering the three preceding annual cycles.³ The Commission also scrutinized periodic transparency filings alongside detailed corporate replies to regulatory demands sent on 23 September 2025 and 26 May 2026.³ In response to the public action, Booking.com stated to Reuters that it continues to cooperate with European regulators while identifying privacy, trust, and platform security as foundational corporate priorities.¹

Booking.com manages its widespread global network from its corporate headquarters located in Amsterdam.² The platform publicizes a lodging inventory encompassing 28 million places to stay worldwide, presenting a vast operational surface for regulatory scrutiny.² External research has revealed material flaws in the platform's vetting protocols for new listings.² Independent consumer researchers from Which? successfully exposed listing verification vulnerabilities by registering a counterfeit property for 10 Downing Street and obtaining financial payments from the fake entry.²

Vulnerabilities on the platform have enabled sophisticated criminal techniques that exploit customer expectations of safety.² Deceptive actors have harnessed compromised administrative account data to dispatch fraudulent demands for money directly through WhatsApp or via Booking.com's native messaging infrastructure in schemes described as reservation hijacks.² An official from the European Union indicated that although Booking.com currently maintains fraud mitigation protocols, the company's current measures are insufficient to counter ongoing abuses.² The official emphasized that the enterprise requires substantially stronger preventative systems to shield travelers from systemic harm.²

The real-world fallout of reservation scams has been documented through independent consumer advocacy records.² The Dutch consumer organisation Consumentenbond registered 200 formal fraud complaints related to Booking.com in 2025, which accounted for €65,000 in total financial losses.² Those tallies represent a marked surge compared with 2024, when the group tracked 89 complaints amounting to €25,000 in reported consumer losses.² Broader industry measurements point to persistent underreporting across the sector, with data collected by PYMNTS Intelligence showing that 11% of fraud victims chose not to report their experiences, marking a 26% year-over-year increase in unrecorded victimhood.¹

The proliferation of digital deception across online travel portals has accelerated alongside advancing technology.² In 2024, Booking.com acknowledged to the BBC that fraud occurrences on its network jumped between 500% and 900% across the prior 18 months.² The company attributed this steep climb to bad actors adopting generative artificial intelligence software to engineer convincing deceptive links and phishing emails.² European Union authorities contend that such rapid escalations require robust, systemic institutional barriers rather than piecemeal technical interventions.²³

The enforcement proceedings against Booking.com unfold alongside a series of broader European administrative and economic programs.³ In separate fiscal actions, the European Commission granted approval for Germany's final disbursement request worth €6 billion out of the Recovery and Resilience Facility.³ At the same time, the Commission initiated three competitive funding invitations under Creative Europe allocating €20.5 million to advance independent journalism, media pluralism, institutional resilience, and digital literacy.³ These concurrent initiatives underscore the Commission's dual strategy of financing public infrastructure while exerting strict regulatory control over global technology intermediaries.³

The formal inquiry into Booking.com will test the European Union's statutory mechanisms for enforcing accountability on digital market leaders.³ Regulators will scrutinize whether the company fulfilled its legal obligations under Articles 34 and 35 to evaluate and mitigate systemic fraud and information misuse.³ The Commission will simultaneously verify whether promoting properties in search results for higher commission payments satisfies the advertising disclosure rules established by Article 26(1).³ With maximum penalties reaching 6% of worldwide turnover, the outcome of the Commission's formal inquiries and inspections will establish critical boundaries for how platform operators handle consumer data and paid search rankings.²³