Commission Opens DSA Probe into Booking.com Over Fake Listings and Phishing

The European Commission has opened formal proceedings against Booking.com under the Digital Services Act (DSA). Regulators are investigating whether the accommodation giant failed to adequately identify and neutralise systemic risks on its platform, specifically fake property listings and phishing operations targeting travellers.

Under EU rules, the opening of formal proceedings means Brussels has moved past preliminary queries and is now using its statutory investigative powers to scrutinise Booking.com’s internal risk management and verification processes. The inquiry zeroes in on two long-running headaches for online holidaymakers: fraudulent property listings that do not exist or are not owned by the host, and deceptive messages impersonating hotels to steal payment card details.

For anyone who has ever turned up at an address with a suitcase only to discover a vacant lot or an oblivious resident, the inquiry strikes at a very practical consumer fear. Booking portals have transformed modern holiday planning, but their ubiquity has also attracted sophisticated fraud rings who exploit platform messaging tools to fleece guests.

The Digital Services Act is the EU’s rulebook designed to make tech platforms take active responsibility for the safety of their services. For ordinary travellers, a successful enforcement action could force the platform to introduce far stricter merchant verification, clearer warnings, and tighter controls on how hosts contact guests. It signals that Brussels expects dominant digital intermediaries to treat fraud prevention not merely as good customer care, but as a binding legal duty.

In the Brussels machinery, the DSA represents one of the European Commission's most muscular transformations: from a treaty-monitoring bureaucracy into a live digital enforcement agency with direct oversight of tech giants. For years, consumer protection relied on a patchwork of national authorities issuing warnings after the damage was done. Under the DSA's system for very large online platforms, the Commission can go directly under the bonnet of the algorithm.

Launching a formal proceeding is standard institutional shorthand for putting an intermediary on notice. The move carries no immediate finding of guilt, but it does hand EU officials extensive powers to demand internal data, scrutinise risk assessments, and conduct formal interviews. In typical Brussels fashion, the bar for compliance is documented diligence: it is not enough for a platform to simply be annoyed by scammers; it must prove to the Berlaymont that it built adequate structural defences against them.

Opening formal proceedings does not set a rigid legal timer on the Berlaymont. The Commission's digital enforcement teams will now collect evidence, issue detailed requests for information, and review how Booking.com evaluates merchant legitimacy.

Booking.com will have the opportunity to defend its compliance records or propose legally binding commitments to resolve the Commission’s concerns. If the investigation concludes that the company infringed the DSA without offering sufficient remedies, the executive possesses the statutory authority to impose hefty fines or require mandatory overhauls of its user-verification architecture.