Verify Property Listings Directly to Avoid Booking.com Scam Risks
EU regulators probe Booking.com over fake listings and phishing, warning businesses that fraud defenses are failing users.
Key points
- European Commission opens Digital Services Act investigation into Booking.com’s fraud controls.
- Scammers use fake ownership claims and account takeovers to steal traveler funds.
- Dutch fraud reports rose tenfold in early 2026, with significant financial losses.
The European Commission opened an investigation into Booking.com on Wednesday, alleging the platform fails to stop fraudsters from running scams and phishing campaigns against its users. Regulators stated that the company’s fraud defenses are absolutely substandard, prompting a formal probe under the Digital Services Act.
Officials told The Register that the investigation covers three main areas: preventing fraudulent listings, countering phishing and social engineering, and ensuring advertising transparency. The Commission suspects Booking.com is not sufficiently protecting consumer and business user data while allowing scammers to operate with ease.
Regulatory Focus and Scope
The probe examines whether Booking.com prevents non-compliant listings where fraudsters portray themselves as property owners. Investigators are also looking at how the platform handles phishing and smishing attacks. Officials noted that scammers often take over legitimate property owner accounts to impersonate them and request additional payments from travelers.
A third strand of the investigation focuses on advertising transparency. Regulators want to know if the platform clearly distinguishes between organic search results and boosted listings. This clarity is essential for users to understand which properties are paying for higher ranking versus those appearing naturally.
Impact on Users and Businesses
Booking.com admitted in June 2024 that travel scams increased by 500 to 900 percent over the previous 18 months. This surge in fraudulent activity has drawn significant regulatory attention. Officials cited these high figures as a primary reason for their concern regarding the platform’s safety measures.
In the Netherlands, more than 1,000 fraud notifications were recorded in the first part of 2026. These incidents caused damage totaling €82,000, representing a tenfold increase compared to the previous year. An official described this as a real problem, noting that the Dutch figures represent only a small portion of the overall issue.
What to watch
The European Commission will continue its investigation into Booking.com’s compliance with the Digital Services Act. Businesses should monitor official announcements regarding the outcome of the probe. Users may see changes to how listings are verified or displayed as the platform responds to regulatory pressure.
What made it possible
This type of intrusion relies on identity verification failures and account takeover vulnerabilities. Attackers exploit weak authentication or social engineering to seize control of legitimate business accounts. Once inside, they manipulate contact details and listing information to intercept payments. Teams usually check whether multi-factor authentication is enforced and if login anomalies trigger immediate alerts.
Background: Multi-factor authentication
Implement multi-factor authentication by requiring a second verification step beyond the password. Use smartphone apps or hardware tokens for critical accounts. This stops attackers who steal credentials through phishing or data leaks. Configure it immediately on email, banking, and cloud services to secure your digital assets.
Read the full guide: Multi-Factor Authentication Setup for Small Teams
What to do and how to stay safe: Booking.com
- Verify property ownership independently before sending any payments outside the platform.
- Check account settings regularly to ensure contact details have not been altered by unauthorized users.
- Report suspicious messages or requests for additional fees directly to the platform support team.
- Enable multi-factor authentication on all business and consumer accounts to reduce takeover risks.
Step-by-step guide: Account Takeover: How Attackers Bypass Login Security
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why is the EU investigating Booking.com?
The European Commission is probing Booking.com under the Digital Services Act for failing to stop fake listings, phishing, and scams.
How much did scams increase according to Booking.com?
Booking.com admitted in June 2024 that travel scams jumped by 500 to 900 percent over the previous 18 months.
What happened in the Netherlands in 2026?
Over 1,000 fraud notifications were made in the first part of 2026, causing €82,000 in damage, a tenfold increase.
