The European Commission has officially launched a formal investigation into the online travel giant Booking.com, citing significant concerns regarding the platform’s security practices and potential failures to prevent fraudulent activity. The move comes as part of the European Union’s ongoing enforcement of the Digital Services Act (DSA), a landmark legislative framework designed to regulate large online platforms and ensure a safer, more transparent digital environment for European citizens.
The probe aims to determine whether Booking.com, which is classified as a Very Large Online Platform (VLOP) under the DSA, has fallen short of its legal obligations to protect users from malicious actors. Central to the investigation is the prevalence of fraudulent hotel listings and sophisticated phishing scams that have plagued the platform, leaving many consumers vulnerable to financial theft and data compromise. By initiating these proceedings, the Commission is signaling a rigorous approach to holding dominant digital entities accountable for the systemic risks inherent in their services.
Investigating Systemic Security Risks and Data Handling
The European Commission’s scrutiny is wide-ranging, focusing on several critical aspects of how Booking.com manages user interactions and data security. A primary concern for regulators is the manner in which reservation and guest information is shared with third-party accommodation providers. The Commission intends to examine the specific safeguards—or lack thereof—that are in place to ensure that sensitive customer data is not weaponized by criminals to facilitate phishing attacks or fraudulent payment solicitations.
In recent years, the intersection of traveler data and hotel management systems has become a lucrative target for cybercriminals. The investigation will evaluate whether Booking.com has sufficiently assessed and mitigated the risks associated with this data flow. Specifically, the Commission is looking into whether the platform’s current security protocols are adequate to prevent malicious actors from gaining unauthorized access to internal communication channels.
Furthermore, the Commission will conduct a deep dive into the design and functionality of Booking.com’s internal messaging service. There is growing concern that the current architecture of these messaging tools may be inherently exploitable, allowing attackers to masquerade as hotel staff or support personnel to deceive travelers. By analyzing the platform’s infrastructure, the Commission hopes to uncover whether the design choices themselves have inadvertently lowered the bar for cybercriminals, and whether more robust authentication or monitoring mechanisms are required to secure these communication loops.
Addressing Illegal Content and Advertising Transparency
Beyond direct phishing risks, the Commission’s investigation encompasses the broader issue of systemic risks related to the dissemination of illegal content. This includes, but is not limited to, the proliferation of impersonation fraud and the presence of non-compliant accommodation listings. The DSA requires platforms to proactively identify and mitigate risks that could lead to illegal activity, and the Commission is now testing whether Booking.com’s internal processes are sufficiently robust to meet these stringent requirements.
Advertising transparency also sits at the forefront of the investigation. The DSA mandates that platforms provide clear information regarding the nature and targeting of advertisements. The Commission will assess Booking.com’s current advertising practices to determine if they align with the transparency obligations set out by the Act. If the platform is found to be obfuscating its advertising mechanisms or failing to provide users with the necessary context regarding sponsored content, it could be found in violation of the law.
Should the investigation conclude that Booking.com has failed to comply with the DSA in these critical areas, the consequences could be severe. Under the current regulatory framework, the company faces the possibility of significant financial penalties, with fines potentially reaching up to 6% of its global annual turnover. Beyond the monetary impact, the Commission holds the authority to mandate corrective measures, requiring the company to fundamentally alter its security architecture or operational procedures to ensure future compliance.
The Broader Regulatory Context
The DSA, which officially came into force in November 2022, represents a paradigm shift in how the European Union governs the digital economy. It applies specifically to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs), acknowledging that these entities possess a unique responsibility due to their massive user bases and the systemic influence they exert.
The decision to move forward with formal proceedings against Booking.com, which was publicly announced on October 21, follows a comprehensive preliminary investigation conducted by the Commission. This early fact-finding phase allowed regulators to gather sufficient evidence to justify a full-scale inquiry.
Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security, and democracy, emphasized the necessity of this action in a recent statement. “Europeans should be able to book their holidays without fear of being scammed,” Virkkunen remarked. “The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”
It is important to note that the initiation of these proceedings does not imply a predetermined outcome. The Commission has stated that it does not prejudge the final decision. Throughout the process, the regulatory body remains open to accepting commitments offered by Booking.com, should the company propose credible and effective remedies to resolve the identified security and transparency issues.
A History of Security Challenges
The regulatory scrutiny comes against a backdrop of increasing cyber threats targeting both Booking.com and its global network of partners. Over the past few years, the platform has frequently been cited in reports by cybersecurity researchers who have documented the persistent efforts of threat actors to exploit the trust inherent in the travel booking process.
Common tactics observed by security firms include the use of sophisticated social engineering, where attackers spoof official Booking.com email domains to send highly convincing, malicious messages to customers. These messages often lure victims into clicking on links that lead to credential harvesting sites or direct them toward fraudulent payment gateways.
In 2023, Secureworks—now a part of Sophos—documented a prominent campaign involving the Vidar infostealer. In this operation, cybercriminals gained unauthorized access to the internal credentials of partner hotels through the Booking.com platform. With this access, they were able to initiate legitimate-looking conversations with customers, effectively using the platform’s own infrastructure to extract payment details and conduct financial fraud.
The threat landscape continued to evolve in early 2025, when Microsoft researchers identified a "ClickFix" campaign that leveraged the Booking.com brand. This campaign, which spanned multiple regions including North America, Oceania, and Europe, utilized deceptive emails to trick users into downloading infostealer malware under the guise of resolving booking issues.
More recently, in June 2026, researchers at TrendAI Research highlighted a campaign targeting partner accommodations specifically in Japan. The attackers impersonated guest complaints and review requests, a strategy designed to trick hotel staff into executing malicious files. By compromising the staff’s systems, the attackers gained a foothold that allowed them to further target unsuspecting travelers.
These incidents underscore the systemic nature of the problem, where the compromise of a single partner hotel or an individual user account can have cascading effects on the platform’s overall integrity. As the European Commission moves forward with its formal investigation, the industry will be watching closely to see how these regulatory pressures influence the future of platform security and the protection of global travelers. For now, the proceedings serve as a reminder that as digital platforms grow in size and influence, their responsibility to defend their users against the evolving tactics of cybercriminals becomes increasingly paramount.
