The European Commission has opened a formal Digital Services Act investigation into Booking.com, alleging the platform has failed to protect consumers from fake accommodation listings, phishing scams, and opaque advertising practices. Commission officials described Booking.com's fraud prevention efforts as "absolutely substandard," saying the company could "go much further" with "much more solid systems" to prevent fraud. The probe covers three distinct failure modes: fraudulent property listings, so-called reservation hijacks where criminals use hacked data to impersonate providers and extract payments, and advertising transparency — specifically whether Booking.com adequately discloses when accommodation providers have paid for prominence in search results. The investigation follows a damning demonstration by UK consumer group Which?, which successfully created and accepted payment for a fake listing at 10 Downing Street. EU officials are examining less theatrical but more damaging real-world cases where consumers arrived at properties that had been fraudulently listed. A second category involves criminals using hacked Booking.com data to contact customers via WhatsApp or even through Booking.com's own messaging platform, requesting fraudulent payments to "secure" a stay. The numbers tell a story of rapidly escalating harm. The Dutch consumer association Consumentenbond reported 200 scam complaints worth €65,000 in 2025, more than doubling from 89 reports worth €25,000 the previous year — figures the association calls "just the tip of the iceberg." Booking.com itself told the BBC in 2024 it had observed a 500 to 900% increase in scams over 18 months, attributing the surge to generative AI tools that produce convincing fake emails and booking links. The regulatory architecture here is the DSA, which imposes systemic risk assessment and mitigation obligations on very large online platforms. Booking.com, with 28 million accommodation listings, clearly qualifies. The maximum penalty — 6% of worldwide annual turnover — provides real enforcement teeth. Booking Holdings reported approximately $22 billion in 2024 revenue, putting the theoretical maximum fine at roughly $1.3 billion. Booking.com's response follows the standard playbook: security is a "top priority," the company is "engaging constructively," and it remains "committed to working with" regulators and law enforcement. The gap between this language and the Commission's "absolutely substandard" characterization is the entire story. The company has effectively acknowledged the scale of the problem — a 500-900% scam increase is not a statistic a company volunteers if things are under control — while arguing it is doing enough. The advertising transparency probe adds a structural dimension. If Booking.com has been presenting paid placements as organic search results, the extraction runs deeper than individual scams. Every consumer who books a more expensive or lower-quality accommodation because a paid listing appeared more prominent has been nudged by an undisclosed commercial arrangement. This is the less dramatic but potentially larger extraction channel. The investigation is a test of DSA enforcement credibility. Consumer group BEUC's director general called it a "systemic problem." Commissioner Henna Virkkunen framed it around the basic expectation that Europeans should book holidays "without fear of being scammed." The Commission emphasized that opening the investigation does not prejudge the outcome — but the public language leaves little ambiguity about the direction of travel.
