EU Opens Booking.com DSA Investigation Into Scam Risks: What Hotels and Hosts Should Watch
The European Commission is examining Booking.com’s approach to phishing, fraudulent listings and other scam risks under the Digital Services Act.
The European Commission has opened formal proceedings to assess how Booking.com handles systemic risks linked to fraud and scams under the Digital Services Act (DSA). The inquiry puts phishing attempts, fraudulent listings and the platform’s risk-management measures under scrutiny, with potential consequences for hotels, hosts and other businesses that rely on Booking.com to reach customers.
Reporting published on October 21, 2026, including MarketScreener’s report on the EU inquiry into Booking.com, says the Commission is conducting an in-depth examination after a preliminary probe. The review draws on risk-assessment materials that Booking.com submitted to EU authorities in 2025 and 2026.
The proceedings do not mean that the Commission has found Booking.com in breach of the DSA. They do, however, move the matter into a formal enforcement process focused on whether the company properly identified relevant risks, assessed them adequately and took effective action to mitigate them.
What the Booking.com DSA proceedings examine
The central issue is platform risk management. The Commission is assessing Booking.com’s handling of fraudulent listings, phishing and other scams disseminated through its service. That includes the quality of the company’s risk assessments and the controls it uses to reduce harm to users.
Under the DSA enforcement framework, the Commission and national Digital Services Coordinators can seek information and conduct fact-finding. If non-compliance is ultimately established, an inquiry may result in binding corrective measures, ongoing monitoring or penalties. At this stage, the reporting does not establish what outcome the Commission will reach or what specific changes, if any, Booking.com will be required to make.
The case concerns the DSA, not Booking.com’s separate designation as a gatekeeper under the Digital Markets Act (DMA), which dates to 2024. The distinction matters because the two laws address different issues.
| EU framework | Relevant focus for Booking.com | What the current proceedings concern |
|---|---|---|
| Digital Services Act | Risk assessment, risk mitigation and transparency in online intermediation | Handling of systemic risks associated with fraud, phishing and scams |
| Digital Markets Act | Gatekeeper obligations and competition-related rules | Not the subject of this investigation |
This is also part of a wider European enforcement pattern. The supplied reporting identifies X, Shein and Temu among major platforms facing DSA scrutiny, signalling that fraud prevention and user protection are important channels for enforcement. The Booking.com case is notable because marketplace safety is not confined to social media or retail platforms. Travel platforms can also become routes for deceptive listings and messages that attempt to extract payment details or personal information.
What Booking.com partners should monitor
For accommodation providers, the immediate practical point is not to assume new obligations before Booking.com or EU authorities communicate them. Instead, businesses should monitor official partner updates and be prepared for potential changes to the information, checks or reporting expected by the platform.
Possible areas to watch include:
- Verification processes for property, business or account information.
- Payment and messaging safeguards designed to reduce phishing and fraudulent payment requests.
- Partner reporting processes for suspicious listings, messages or account activity.
- Transparency communications explaining platform controls and how partners should use them.
These are potential implications, not confirmed requirements from the investigation. Still, businesses that maintain accurate listing information, use established platform payment channels and give staff clear procedures for handling suspicious guest communications will be better placed to respond if Booking.com changes its controls.
The inquiry may also affect the visibility of risk information. Clearer disclosures about how fraud controls work could help partners understand when a platform has taken action and what evidence it may need from a property owner. Conversely, any new verification or reporting steps could add operational work for small accommodation teams that already manage bookings, guest communication and payments with limited capacity.
The most useful preparation is therefore operational rather than legalistic. Review who can edit property information, how employees validate payment-related messages, where suspicious activity is recorded and who is responsible for escalating it. Those internal steps cannot replace Booking.com’s DSA responsibilities, but they can reduce avoidable exposure to impersonation and scam attempts.
Platform policy changes can expose weak spots in a business’s own booking, identity and customer-support workflows. Scalevise helps teams assess where AI can reduce manual triage, standardize risk signals and connect operational data without treating automation as a substitute for platform controls. A practical AI implementation consultation can turn emerging partner requirements into a focused workflow plan that protects staff time and customer trust. Request a consultation to identify the highest-value next step.
Frequently Asked Questions
What is the European Commission investigating at Booking.com?
The Commission is assessing Booking.com’s management of systemic risks related to fraud and scams, including fraudulent listings and phishing attempts, under the Digital Services Act.
Has the EU found that Booking.com violated the DSA?
No. Formal proceedings have been opened, but the reported inquiry has not established non-compliance or announced a final outcome.
Does this case concern Booking.com’s DMA gatekeeper status?
No. Booking.com has been designated a DMA gatekeeper since 2024, but the current proceedings concern DSA duties on risk assessment, risk mitigation and transparency.
What should hotels and hosts using Booking.com do now?
They should watch for official communications from Booking.com and EU authorities, keep listing and account information accurate, and maintain clear internal processes for identifying and escalating suspicious messages or activity.
Conclusion
The Commission’s formal DSA proceedings place Booking.com’s fraud and scam controls under closer examination without determining the outcome in advance. For hotels and hosts, the case is a reason to watch for platform guidance and to strengthen the everyday processes that help staff recognize suspicious listings, messages and payment requests.