EU Opens Booking.com DSA Investigation Over Fake Listings and Phishing Scams

The European Commission has opened a formal Booking.com DSA investigation to examine whether the platform does enough to remove fraudulent listings and stop phishing scams that exploit traveller data. Announced on 21 October 2026, this is the first Digital Services Act probe into Booking.com since it was designated a very large online platform in April 2023. That designation brought stricter obligations to assess and mitigate systemic risks under Articles 34 and 35 of the DSA.

The investigation follows a preliminary examination of Booking.com’s risk assessment reports from 2023 to 2026, its transparency reports, and replies to formal requests for information sent in September 2025 and May 2026. Senior Commission officials described the company’s risk assessments as “absolutely substandard.” Booking.com itself has reported a sharp rise in attempted fraud, with some accounts citing a 500 percent increase. The company has said it is cooperating fully and that security, trust, and the protection of personal information remain top priorities. No infringement has been established yet. If the Commission finds a breach, fines can reach up to 6 percent of global annual turnover.

What Triggered the Booking.com DSA Investigation

The European Commission, which enforces the Digital Services Act for very large platforms, opened proceedings after reviewing how Booking.com identifies and reduces risks linked to illegal content. The DSA requires platforms to tackle the spread of illegal material and protect consumers. Officials noted a clear uptick in suspected fraud over the last three years. Scammers advertise non-existent properties, impersonate legitimate hosts, and use messaging or email channels to demand extra payments.

The probe also covers advertising transparency. Accommodation providers can pay higher commissions for better placement in search results. The Commission is checking whether these boosted listings are clearly labelled as advertisements so users can see who paid and why a listing ranks higher. Henna Virkkunen, European Commission Executive Vice-President for Tech Sovereignty, Security and Democracy, stated that Europeans should be able to book holidays without fear of being scammed and that the leading booking platform must take its DSA responsibilities seriously.

Issues Identified in the Investigation

The investigation focuses on three main areas.

First, fake listings and impersonation fraud. This includes properties that do not exist, non-compliant accommodation offers, and cases where fraudsters pretend to own a legitimate listing. The Commission will examine whether Booking.com properly identified, assessed, and mitigated these systemic risks and whether it effectively removes problem listings.

Second, phishing scams that exploit reservation and guest data shared with accommodation providers. Investigators are looking at the design of Booking.com’s messaging service and whether safeguards prevent data misuse. Scammers use real booking details to send convincing messages that appear to come from the hotel or the platform, often requesting card details or extra payments via external links.

Third, paid-for boosted listings that are not clearly identifiable as advertisements. Users should be able to distinguish organic results from paid promotions and access information about the advertiser and ranking parameters.

These problems are not abstract. Travellers report receiving “pending confirmation” emails that include correct reservation numbers, dates, and amounts. The emails pressure people to confirm card details or transfer money or risk losing the booking. Similar tactics have appeared in the platform’s own messaging system.

Irish People Impacted by Booking.com Scams

Irish users have reported a clear increase in these phishing attempts. The Irish Independent noted that Irish travellers are increasingly receiving fake “pending confirmation” emails linked to bookings made through Booking.com. One well-documented case involves Brendan Burgess, founder of Askaboutmoney.com. He lost more than €900 after responding to a convincing email ahead of a trip to Vienna. The message contained the correct reservation details, which made it appear legitimate. He later confirmed with the hotel that it was a scam.

Irish customers were also among those contacted by Booking.com earlier in 2026 about a possible data incident. The company warned that unauthorised parties may have accessed booking details, names, emails, addresses, phone numbers, and any information shared with the accommodation. Cybersecurity experts noted this raised the risk of follow-up scams targeting people with confirmed travel plans.

Other Irish reports include residential addresses in Dublin being used as bait for fake short-term rental listings. One landlord described visitors arriving almost daily with bookings for accommodation that did not exist at the property. In separate cases, short-term lets advertised on Booking.com have been linked to rental scams on other platforms, with victims losing substantial deposits. These incidents show that the risks reach Irish households both as travellers and as property owners.

Practical Steps for Families and Travellers

Families booking holidays online should treat unexpected payment requests with caution. Contact the property directly using a verified phone number, not a link in an email or app message. Never enter card details on a page reached through an unexpected link. Check the official Booking.com app or website for messages rather than relying solely on email. Enable two-factor authentication on accounts and review privacy settings so limited personal data is shared.

Parents planning family trips can use this as a teaching moment. Explain to older children and teens how scammers use real booking details to build trust. Review family rules around sharing personal information and responding to urgent requests. The same habits that protect against online scams on social media or gaming platforms apply here. Report suspected fraud to An Garda Síochána. For guidance on account security and reducing what others can find online, see CODA’s resources on protecting personal information and managing your digital footprint.

The Booking.com DSA investigation highlights a broader point. Large platforms that facilitate everyday family activities must meet clear legal standards for risk assessment and mitigation. Irish travellers and families have already felt the impact through financial losses and data exposure. Stronger platform accountability under the DSA can reduce these risks, but individual vigilance remains essential.

References

• European Commission — Official announcement and enforcement of the investigation.
• European Commission press release: Commission to investigate how Booking.com combats scams and fraud under the Digital Services Act
• Digital Services Act — Full policy page on the EU rules for online platforms.
• Digital Services Act full legal text (EUR-Lex)
• Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy
• Commission request for information under the DSA from Apple, Booking.com, Google and Microsoft on financial scams (September 2025)
• An Garda Síochána — Official site for reporting crime and online fraud in Ireland.
• Irish Independent report on the EU probe and Irish phishing reports
• Reuters coverage of the investigation into phishing and fraudulent listings

Further Guidance from CODA

• Resources for Parents: Online Safety Settings and Advice — Practical settings and family guidance that support safer account use across services.
• Your Digital Footprint — Steps to limit personal details that scammers can exploit.
• Information Guides for Parents — Covers catfishing, privacy, and related risks relevant to family travel planning.
• Protecting Personal Information Online — Account security practices that reduce exposure during bookings.

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for schools, parents and organisations. Our guides support practical conversations about online behaviour and the choices people make. However, education and app settings do not replace safeguarding or professional support.

Send a message

Contact Children of the Digital Age to enquire about online safety education, parent sessions or training for your school or organisation.