European Commission opens proceedings against Booking.com over scams and ads

The European Commission has announced formal proceedings against Booking.com. They concern whether the platform complies with the Digital Services Act (DSA). According to the Commission's announcement (21 October 2026), the service may not have carefully assessed and effectively reduced the risks linked to fraudulent listings and phishing scams.

Three areas under scrutiny

The first is fictitious apartments, listings for properties that do not exist and impersonation of property owners. The Commission wants to establish whether Booking.com properly verifies such listings and removes them once detected.

The second is phishing, meaning attempts to extract data and money by people posing as trusted parties. This includes messages that appear to come from a hotel and contain genuine booking details, then ask for a repeat payment or card verification. The Commission will examine whether the way guest information is shared with property owners, and the internal messaging system, provide adequate protection.

The third is advertising transparency. Hotels can pay for a higher position in search results. According to Brussels, Booking.com may not have clearly labelled such offers as advertising. The DSA requires users to be able to recognise an advert, know who paid for it and why they are seeing it.

What happens next

The proceedings follow a preliminary inquiry. The Commission analysed risk assessment reports from recent years, transparency reports and the company's answers to questions sent in September 2025 and May 2026. It is working with the Dutch Authority for Consumers and Markets, because the company is based in the Netherlands.

The Commission can now carry out further checks and request more information. If it finds infringements, it can order changes or impose a fine of up to 6% of the company's annual worldwide turnover. It is also possible to accept commitments offered by Booking.com. Opening proceedings does not mean an infringement has been established.

In April 2026, media reported a security breach involving Booking.com reservation data, after which customers were warned about suspicious messages. Spider's Web stresses, however, that this does not mean every such scam stems from a break-in to the platform's systems.

What this means for you

The proceedings do not change the rules for using the service for now. However, they concern scams you may encounter when booking accommodation for holidays or trips to Poland. Be wary of messages asking for a repeat payment or card details, even if the booking details match, and do not click links in such messages. It is better to clear up any doubts directly with the property or through the official app or website.