The European Commission has launched an investigation into how Booking.com combats scams and fraud.
The investigation will determine whether the online travel giant has breached the EU's Digital Services Act (DSA) "by not having diligently assessed or effectively mitigated risks related to fraudulent listings and phishing scams."
The decision follows a preliminary investigation, where the commission looked at risk assessment reports submitted by Booking.com in 2026, 2025, 2024 and 2023, information from transparency reports and responses to the commission's request for information in September 2025 and May 2026.
The DSA sets rules for how online platforms in the EU address illegal content, manipulative tactics and other risks, applying stricter obligations for very large online platforms, or VLOPs, a designation Booking.com received in April 2023. Large platforms found in violation of the DSA can face fines of up to 6% of their global annual turnover.
In a statement to PhocusWire, a company spokesperson said Booking.com is "cooperating fully" with the commission and "engaging constructively on its questions under the DSA."
"Security, trust and the protection of personal information are top priorities at Booking.com. We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud and protect travelers and partners," the spokesperson said.
The regulator's investigation will specifically look at fake listings, including those for nonexistent properties, impersonation fraud and noncompliant accommodation offers and assess whether Booking.com has "effective measures" in place to mitigate the associated risk for consumers.
The commission will also look at Booking.com's efforts to reduce the risk of phishing scams, focusing on the way reservation and guest data is shared with accommodation providers and Booking.com's messaging services.
The investigation will further examine whether Booking.com is in line with the DSA's advertising transparency obligations, which require that users can "clearly recognize" an advertisement.
"Under the DSA, users are entitled to understand when, and on whose behalf, an ad is shown to them. Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility," the commission said.
The regulator will evaluate advertisements on Booking.com to see how easy it is for users to determine if something is an ad and how they can change their settings regarding which ads they see.
The commission said it is currently gathering evidence, and the opening of formal proceedings allows it to issue interim measures before the investigation is finished and/or rule that Booking.com violated the DSA.
Booking.com can also settle without the commission making a ruling by making commitments to address problems.
"Europeans should be able to book their holidays without fear of being scammed," said Henna Virkkunen, European Commission EVP for tech sovereignty, security and democracy. "The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."
In April, Booking.com confirmed that unauthorized parties accessed information such as names, email addresses, phone numbers and booking details. The company said it took action to contain the breach when it was discovered, updating PINs for affected reservations and informing guests.
Booking.com has faced larger regulatory pressure in Europe. In May 2024, the online travel agency was deemed a gatekeeper under the separate Digital Markets Act. That November, it said it had enacted changes to comply with the regulation requirements.