EU probes Booking.com over fake listings and data exposure risks

The European Commission launched a formal investigation into Booking.com to determine if the travel platform meets Digital Services Act obligations regarding illegal content and user risks. The probe focuses on three specific areas: non-existent property listings, unauthorized access to reservation data, and unclear labeling of paid advertising placements. This marks the first official DSA enforcement action against the company, which operates as a very large online platform under EU law.

Root cause

The investigation stems from the Commission’s review of Booking.com’s risk assessment documents submitted in the current year and the three preceding years. According to AFP, a senior EU official characterized the company’s risk assessment work since 2023 as absolutely substandard. The Commission is examining whether these assessments adequately address threats posed by scammers creating fake listings or posing as legitimate hosts. Additionally, the probe looks at how the platform manages accommodations that fail to comply with local regulations.

Attack path

Scammers exploit the platform by listing properties that do not exist or by impersonating legitimate hosts to deceive travelers. A second vector involves the misuse of reservation and guest data shared with hosts. According to DutchReview, Booking.com notified some customers in April that an unauthorized third party had accessed reservation-related information. Attackers use these genuine booking details to craft phishing messages that appear to originate from the platform or the hotel.

Affected versions

• Booking.com platform interface accessed by more than 45 million monthly users in the EU.
• Host management systems that facilitate sharing of guest and reservation data with property providers.
• Search result algorithms that determine the placement and labeling of sponsored advertising listings.

Mitigation

• Booking.com stated it is cooperating fully with the EU investigation and regulatory authorities.
• The company pledged to continue working with governments, law enforcement, and industry partners to combat online fraud.
• Booking.com emphasized that security, trust, and protection of personal information remain top priorities for the organization.
• The platform can offer commitments to the Commission to address identified concerns during the investigation period.

Signals worth monitoring

Security teams should monitor for anomalies in vendor verification logs and unusual access patterns to reservation data. Look for spikes in user reports regarding fake listings or impersonation attempts. Check whether third-party host accounts are accessing guest information outside of normal operational windows.

Verify that sponsored content is clearly distinguished from organic search results to prevent confusion. Teams usually review data sharing agreements to ensure hosts only receive necessary information. Contain potential breaches by isolating compromised host accounts and resetting user credentials if data exposure is suspected. Monitor email logs for phishing attempts using legitimate booking reference numbers.

Background: Phishing

Phishing email examples often mimic trusted brands with urgent requests. Look for mismatched sender domains, generic greetings, and links that do not match the display text. Verify the request through a separate channel before clicking any links or downloading attachments.

Read the full guide: Phishing Email Examples: How to Spot the Hidden Traps

What to do and how to stay safe: Booking.com

• Verify reservation details directly through official booking confirmations rather than clicking links in unsolicited messages.
• Check property reviews and host verification status carefully before completing any travel bookings online.
• Report suspicious listings or impersonation attempts to platform support teams immediately to help identify fraud.
• Monitor bank statements and credit card reports for unauthorized charges related to travel reservations.

Step-by-step guide: Account Takeover Fraud: How Attackers Steal Identities and How You Stop It

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why is the EU investigating Booking.com?

The probe examines whether Booking.com meets Digital Services Act obligations to tackle illegal content and manage risks like fake listings and phishing scams.

What are the potential penalties for Booking.com?

If the Commission finds a violation, Booking.com could face a fine of up to 6% of its annual global turnover.

When did Booking.com become subject to strict DSA rules?

Booking.com has been classified as a very large online platform under the DSA since April 2023.