EU opens Digital Services Act investigation into Booking.com over scams

The European Commission has opened an investigation into Booking.com over concerns that the platform is not doing enough to protect users from fake listings and phishing scams.

Announced Wednesday, the probe will examine whether the travel booking site meets its obligations under the EU’s Digital Services Act (DSA), which requires large online platforms to tackle illegal content and manage risks to users.

The investigation follows an initial review of Booking.com’s risk assessments, including reports filed this year and in each of the previous three years, Reuters reported . It is the first formal DSA investigation into the company.

The Commission will focus on three areas. The first is fake listings, including properties that don’t exist, scammers posing as legitimate hosts, and accommodations that fail to comply with local rules.

The second is how Booking.com protects reservation and guest data shared with hosts. That information can be exploited in phishing attacks, where scammers use genuine booking details to send messages that appear to come from the platform or a hotel.

In April, Booking.com told some customers that an unauthorised third party had accessed reservation-related information, DutchReview reported.

“Europeans should be able to book their holidays without fear of being scammed,” said Henna Virkkunen, the EU’s tech chief.

An unnamed senior EU official described Booking.com’s risk assessment work since 2023 as “absolutely substandard”, according to AFP.

Booking.com, which is part of Booking Holdings, said it was cooperating fully with the investigation. The company also said it would continue working with governments, regulators, law enforcement and industry partners to combat online fraud.

“Security, trust and the protection of personal information are top priorities,” the company said.

Booking.com has been classified as a very large online platform under the DSA since April 2023. The company reports more than 45 million monthly users in the EU, placing it under the law’s strictest requirements.

If the Commission finds a violation, Booking.com could face a fine of up to 6% of its annual global turnover. The investigation has no fixed deadline, and the company can offer commitments to address the Commission’s concerns.