The European Commission has officially opened a formal investigation into Booking.com to determine whether the travel giant has failed to adequately address systemic security risks that have facilitated fraudulent listings and widespread phishing campaigns. The move represents a significant escalation in the regulatory oversight of major online platforms, as authorities seek to ascertain whether the company has breached critical security and transparency provisions mandated by the European Union’s Digital Services Act (DSA).
The investigation, announced on October 21, follows a comprehensive preliminary inquiry conducted by the Commission. By designating Booking.com as a major player in the digital economy, the European Union is signaling that platforms of this scale bear a heightened responsibility to protect their users from malicious actors. As the DSA continues to reshape the digital landscape for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs), the scrutiny placed upon Booking.com serves as a litmus test for how effectively these regulations can be enforced to curb sophisticated cyber-criminality.
Investigating Systemic Security Failures
At the heart of the Commission’s investigation is the question of whether Booking.com has diligently assessed and mitigated the risks posed to its customers. A primary area of focus concerns the platform’s data-sharing protocols. The Commission intends to scrutinize how the firm shares reservation and guest information with its vast network of accommodation providers. The central concern is that the current mechanisms for handling this data may lack the necessary safeguards to prevent sensitive guest information from being intercepted or misused by cybercriminals to facilitate phishing attacks or solicit fraudulent payments.
Beyond the movement of data, the Commission is set to examine the design and operational functionality of Booking.com’s internal messaging service. This feature, while intended to facilitate seamless communication between hosts and guests, has become a high-value target for malicious actors. Investigators will assess whether the platform has implemented sufficient technical controls to prevent this communication channel from being weaponized. If the infrastructure of the messaging system is found to be inherently vulnerable to exploitation, the platform could be held accountable for failing to implement "security by design" principles.
Furthermore, the investigation will delve into the platform’s broader efforts to curb illegal content. This includes an assessment of how the company identifies and removes non-compliant accommodation listings and prevents impersonation fraud. The Commission is looking for evidence that Booking.com has established robust, systemic risk-mitigation strategies to ensure that its platform is not being used as a staging ground for deceptive practices that harm the average consumer.
In addition to security, the Commission will turn its attention to the company’s advertising practices. Transparency is a cornerstone of the DSA, and investigators will determine whether Booking.com meets the stringent transparency obligations required for online advertising. This includes verifying whether users are provided with clear, accurate information regarding the nature and origin of the advertisements they encounter on the site.
Should the investigation conclude that Booking.com has failed to comply with the DSA in these critical areas, the consequences could be severe. Under the current regulatory framework, the company could face fines of up to 6% of its global annual turnover. Beyond financial penalties, the Commission holds the power to mandate comprehensive corrective measures, forcing the company to overhaul its security infrastructure and operational policies.
A Growing Pattern of Cyber Threats
The decision to launch formal proceedings comes against a backdrop of increasing reports detailing how Booking.com has become a frequent target for cybercriminals. In recent years, researchers have observed a sophisticated evolution in the tactics used to defraud both the platform’s customers and its partner hotels. These campaigns have evolved from simple email spoofing to complex, multi-stage attacks that exploit trust in the Booking.com brand.
A notable example occurred in 2023, when security firm Secureworks—now part of Sophos—documented a campaign involving the Vidar infostealer malware. In this instance, threat actors targeted partner hotels, compromising their Booking.com credentials. Once inside the hotel’s dashboard, the attackers were able to access genuine booking information. Armed with real, specific details about upcoming guest reservations, the hackers sent highly personalized and convincing phishing emails to unsuspecting travelers. These messages often directed victims to fraudulent payment portals, resulting in significant financial losses for customers who believed they were interacting with a legitimate representative of the hotel or the booking site.
The sophistication of these attacks has continued to grow. In March 2025, Microsoft researchers identified a campaign known as "ClickFix," which targeted individuals across North America, Oceania, Southeast Asia, and Europe. By impersonating Booking.com in email communications, threat actors attempted to lure users into downloading infostealer malware under the guise of resolving booking issues. The campaign demonstrated how hackers are increasingly leveraging the perceived urgency of travel logistics to manipulate users into compromising their own devices.
The threat extends to the supply side of the travel industry as well. In June 2026, TrendAI Research identified a phishing campaign specifically targeting accommodation partners in Japan. In this scenario, the attackers sent emails masquerading as guest complaints or requests for review updates. By manipulating the staff at these hotels into executing malicious files, the attackers sought to gain a foothold in the accommodation providers’ internal networks, further illustrating that the platform’s ecosystem faces threats from multiple angles.
Regulatory Expectations and Next Steps
The European Commission’s move is rooted in the implementation of the Digital Services Act, which has been in force since November 2022. The legislation was specifically designed to address the unique challenges posed by Very Large Online Platforms, which serve as critical infrastructure for modern commerce and communication.
Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security, and democracy, emphasized the necessity of this intervention. "Europeans should be able to book their holidays without fear of being scammed," Virkkunen stated. "The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."
While the opening of formal proceedings represents a significant step, the Commission has been careful to note that this action does not prejudge the final outcome of the investigation. The process is designed to be an objective inquiry, and the Commission maintains the authority to accept commitments offered by Booking.com to resolve the identified concerns. This allows for a potential path where the company can work directly with regulators to implement necessary security upgrades and policy changes, potentially avoiding the most severe penalties if they can demonstrate a genuine commitment to rectifying the vulnerabilities.
As the investigation progresses, the focus will remain on whether Booking.com can prove that its existing security measures are sufficient to protect the integrity of its platform. For users and partners alike, the outcome of this case will be closely watched, as it may set a precedent for how travel-related platforms are expected to safeguard their digital environments in an era of persistent and evolving cyber threats. For the time being, the platform remains under intense regulatory pressure to demonstrate that it is prioritizing the safety and security of its global user base above all else.
