.jpg)
The European Commission has opened an investigation Booking.com for possible security failings that have resulted in fraudulent listings and phishing scams.
The investigation will ascertain whether the online travel agency has breached security and transparency provisions contained in the EU’s Digital Services Act (DSA).
Among the focus areas of the investigation, the Commission will assess whether Booking.com has diligently assessed and mitigated phishing risks to customers. This includes looking at how the firm shares reservation and guest data is shared with accommodation providers, and the safeguards it has in place to prevent such data being misused to carry out phishing and solicit fraudulent payments.
In addition, the Commission will focus on the design and functioning of Booking.com's messaging service, and its potential to be abused by malicious actors for phishing attacks.
Another focus is whether the provider of Booking.com has properly assessed and mitigated the systemic risks linked to the dissemination of illegal content, such as impersonation fraud and non-compliant accommodation.
The firm’s advertising practices will also be assessed to determine whether it meets the DSA's advertising transparency obligations.
If it is determined that the company failed to comply with the DSA in these areas, Booking.com could face a fine of up to 6% of their global annual turnover and be required to take corrective measures.
The DSA came into force in November 2022 and applies to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs).
The decision to launch formal proceedings against Booking.com, announced on October 21, follows a preliminary investigation carried out by the Commission.
Commenting on the decision, Henna Virkkunen, the Commissions’ executive vice-president for tech sovereignty, security and democracy, said: “Europeans should be able to book their holidays without fear of being scammed. The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”
The Commission emphasized that the opening of formal proceedings does not prejudge any final outcome or decision and is empowered to accept commitments offered by Booking.com to remedy the matters subject to the proceedings.
Booking.com Customers a Frequent Target for Phishing Attacks
Numerous phishing campaigns targeting Booking.com customers and partners have been observed by cybersecurity researchers in recent years. These campaigns have included threat actors accessing the personal details of Booking.com customers and spoofing the company’s email domains to send malicious messages.
In 2023, Secureworks, now part of Sophos, reported how cybercriminals deployed the Vidar infostealer to gain access partner hotels’ Booking.com credentials. This information was then used to send phishing emails to Booking.com customers and trick them into handing over their payment details, in many cases leading to money being stolen.
Microsoft reported a ClickFix campaign that impersonated Booking.com in March 2025. This began with the threat actor sending malicious email impersonating Booking.com to targeted individuals in North America, Oceania, South and Southeast Asia and Europe. The attack attempted to lure these individuals into downloading infostealer malware.
In June 2026, TrendAI Research identified a phishing campaign targeting Booking.com partner accommodations in Japan. These emails impersonated guest complaints and review requests to trick hotel staff into executing malicious files.
Image credit: PixelBiss / Shutterstock.com
.jpeg)
