The European Commission has officially launched a formal investigation into the operations of Booking.com, signaling a major regulatory push to hold one of the world’s largest travel platforms accountable for persistent security vulnerabilities. The probe, announced on October 21, aims to determine whether the online travel agency has failed to adequately protect its users from fraudulent listings and sophisticated phishing scams, potentially violating the stringent security and transparency mandates outlined in the European Union’s landmark Digital Services Act (DSA).
This move follows a comprehensive preliminary investigation by the Commission, which identified several areas where the platform’s systemic risk management may be insufficient. As a "Very Large Online Platform" (VLOP) under the DSA—the comprehensive regulatory framework that came into force in November 2022 to govern the digital landscape—Booking.com is held to a higher standard of duty regarding user safety and the mitigation of illegal content.
Scrutinizing Data Practices and Phishing Mitigation
At the heart of the Commission’s investigation is the question of how Booking.com handles the vast ecosystem of sensitive information it manages. Because the platform acts as an intermediary between millions of travelers and hundreds of thousands of accommodation providers, it handles a constant flow of reservation details and guest data. The Commission is now scrutinizing the specific safeguards the firm employs to ensure this data is not intercepted or misused by malicious actors.
Specifically, regulators are interested in the mechanisms through which reservation and guest data are shared with third-party hotels and hosts. There is a concern that if these communication channels are not sufficiently secured, they provide a prime environment for cybercriminals to orchestrate phishing attacks. By masquerading as legitimate accommodation providers, attackers have historically been able to solicit fraudulent payments from unsuspecting travelers, often appearing within the official Booking.com messaging interface.
Furthermore, the Commission will evaluate the technical design and functional architecture of the Booking.com messaging service. The objective is to determine whether the platform has implemented sufficient "security by design" principles to prevent its own tools from being weaponized. If the platform’s messaging system is found to be easily exploitable by threat actors looking to conduct social engineering, it could represent a significant failure to mitigate systemic risks as required by the DSA.
Addressing Systemic Risks and Advertising Transparency
Beyond the immediate threat of phishing, the Commission is casting a wider net to assess how the company addresses systemic risks associated with illegal content. This includes not only direct impersonation fraud but also the proliferation of non-compliant or "ghost" accommodation listings that deceive users. The investigation will examine whether Booking.com has the necessary internal protocols and monitoring capabilities to identify and remove such content proactively rather than reactively.
The investigation also extends to the platform’s advertising practices. Under the DSA, major platforms are required to adhere to strict transparency obligations to ensure that users are fully aware of why they are being targeted with certain ads and who is behind them. The Commission will assess whether Booking.com’s advertising ecosystem is sufficiently transparent and if it complies with the legal requirements designed to protect consumers from misleading or manipulative marketing techniques.
Should the Commission conclude that Booking.com has failed to meet its obligations under the DSA, the consequences could be severe. The regulatory framework allows for significant financial penalties, with fines reaching up to 6% of a company’s total global annual turnover. Beyond the financial impact, the Commission could mandate comprehensive corrective measures, forcing the company to overhaul its security architecture, data sharing protocols, and content moderation systems to ensure future compliance.
Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security, and democracy, emphasized the urgency of the matter in a statement regarding the decision. "Europeans should be able to book their holidays without fear of being scammed," Virkkunen said. "The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."
The Commission was careful to note that the opening of formal proceedings does not predetermine the final outcome of the investigation. The process is designed to be an objective inquiry, and the Commission remains empowered to accept formal commitments from Booking.com to resolve the identified concerns without necessarily proceeding to a punitive judgment, provided the company can offer viable, concrete solutions to the issues at hand.
A Pattern of Vulnerability: The Threat Landscape
The formal investigation arrives against a backdrop of years of reported security incidents that have frequently left Booking.com customers and their partners vulnerable. Cybersecurity researchers have long highlighted the platform as a preferred target for threat actors, who leverage the trust inherent in the brand to execute their campaigns.
One of the most notable trends in recent years has been the compromise of partner accounts. In 2023, security firm Secureworks, now a part of Sophos, documented a sophisticated campaign in which cybercriminals utilized the Vidar infostealer malware. By infecting the systems of partner hotels, attackers were able to harvest legitimate credentials. Once inside the hotel’s administrative portal on Booking.com, the attackers gained access to genuine, real-time booking information. This level of access allowed them to send highly convincing, personalized phishing emails to customers, directing them to fraudulent payment portals that were indistinguishable from the official site.
The sophistication of these attacks has continued to evolve. In March 2025, Microsoft researchers reported on a "ClickFix" campaign that specifically targeted Booking.com users across North America, Oceania, parts of Asia, and Europe. This campaign demonstrated a high level of operational maturity, as the attackers sent emails that perfectly mimicked the company’s branding and tone. These emails were designed to lure victims into downloading infostealer malware under the guise of resolving a booking error or payment issue, further highlighting the ongoing struggle to prevent the exploitation of the platform’s customer communication channels.
The threat extends to the supply side as well. In June 2026, TrendAI Research identified a campaign that specifically targeted hotel staff in Japan. By impersonating guests and submitting fake complaints or requests for review updates, attackers attempted to trick employees into executing malicious files. These files were designed to gain a foothold within the hotel’s internal network, potentially providing the attackers with long-term access to the hotel’s interface with the Booking.com platform.
These recurring incidents underscore why the European Commission is focusing so intently on the security of the communication channels and the vetting of content. As the digital economy grows, the responsibility of platforms to act as a secure intermediary has become a matter of fundamental consumer protection. The outcome of this investigation will likely serve as a benchmark for how the Digital Services Act is applied to other major platforms operating within the European Union, setting a precedent for the level of security and transparency expected of digital giants in the years to come.
