The EU Is Investigating How Booking.com Fights Scams. Here’s What It Means for Managers.

In September, dozens of travelers stood outside the same building in Paris’s 7th arrondissement, a few streets from the Eiffel Tower. They had all booked the same apartment on Booking.com, at €70 a night. It did not exist.

The building’s caretaker told Le Parisien, the French daily, that at least a hundred people turned up in a single day, and that “some slept in their cars.” Her frustration was less with the scammers than with the timeline: “What I don’t understand is that Booking.com hasn’t blocked the listing in four days.” (Quotes translated from French.)

One month later, that same question, how fast and how well a platform finds and removes fraud, sits at the center of a formal investigation from Brussels.

---

What is the EU investigating Booking.com for?

On October 21, the European Commission opened formal proceedings against Booking.com under the Digital Services Act (DSA), the EU law that sets safety and transparency duties for large online platforms. It is the first DSA investigation into the company.

The Commission is looking at three areas:

• Fraudulent and non-compliant listings: whether Booking.com properly assessed the risk of fake properties, impersonation fraud and accommodation that breaks local rules, and whether it removes them effectively.
• Phishing using real booking data: whether the way reservation and guest data is shared with accommodation providers, and the design of Booking.com’s messaging service, leave room for scammers to “solicit fraudulent payments.”
• Boosted listings: whether listings that rank higher because the property pays a higher commission are clearly labeled as ads.

The probe follows information requests the Commission sent in September 2025 and May 2026, and a review of Booking.com’s risk assessment reports going back to 2023. If breaches are confirmed, fines can reach up to 6% of global annual revenue. There is no deadline, and Booking.com can offer commitments to settle the Commission’s concerns.

Booking.com said it is “cooperating fully” and that “security, trust and the protection of personal information are top priorities,” according to the Irish Times.

To understand why Booking.com is first in line, it helps to look at what the company is to European regulators.

---

Why is Booking.com the lightning rod for scams in Europe?

When the housing debate needs a face, it is usually Airbnb. When the scam debate needs one in Europe, it is increasingly Booking.com. That is not because the problem is unique to it, but because of its size and its regulatory status.

Booking.com is Europe’s largest accommodation platform, and the EU treats it accordingly:

• It was designated a Very Large Online Platform under the DSA in April 2023, which brings duties to assess and reduce “systemic risks” such as fraud.
• It was designated a gatekeeper under the Digital Markets Act (DMA), the EU’s competition rulebook for the biggest platforms, in 2024.

EU tech chief Henna Virkkunen framed the investigation in exactly those terms: “we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”

Guests also have plenty of reasons to be wary. In April, Booking.com confirmed that unauthorized third parties had accessed some guests’ names, emails, phone numbers and booking details, and reset reservation PINs in response. The Paris case added AI to the picture: Booking.com’s head of fraud, Pascal Mafait, described it as a far more sophisticated attack than a simple fake listing, one that involved AI tools, according to Le Tribunal du Net.

None of this is exclusive to Booking.com. RSU has covered a multi-million dollar fake listings scheme on Airbnb that ran across roughly 100 US properties. But being the biggest platform in Europe means Booking.com is where regulators start.

The Commission’s phishing concern also points to something specific about how Booking.com works: how guests pay.

---

How do scammers exploit Booking.com bookings?

On Airbnb, the guest always pays the platform. On Booking.com, that is not always the case. Depending on the property’s setup, a guest may pay Booking.com, pay at the property, or pay through a link the property sends.

That flexibility suits many hosts and hotels. It also means guests are used to receiving payment messages from the property, so a fake one looks normal. That is the gap the Commission is pointing at when it names the design of Booking.com’s messaging service and the risk of data being used to “solicit fraudulent payments.”

The risk runs in both directions:

• Guest side: scammers who obtain real booking details can send convincing messages asking for payment or “verification.”
• Host side: in the Paris case, scammers appear to have phished hosts’ own accounts, taken control of real listings and changed the address, keeping the original reviews, according to Journal du Geek, a French tech news site.

For hosts, that second point matters as much as the first: a hijacked listing damages the real property’s reputation as well as the guest’s trip.

The third part of the investigation has nothing to do with scams, but it does touch a topic RSU covered this month.

---

Will Booking.com’s paid visibility listings be labeled as ads?

The Commission says “accommodation providers can make their listings more visible in Booking.com’s search results by paying a higher commission,” and that guests should be able to recognize these “boosted listings” as ads. The release does not name a program, but the description likely covers options such as Booking.com’s Preferred and Preferred Plus programs.

The same programs were already under EU review for a different reason. As RSU reported earlier this month, Booking.com’s DMA changes removed price parity (the requirement not to undercut Booking.com’s prices elsewhere) from eligibility for Genius, Preferred and Preferred Plus, and external prices no longer affect its sponsored discounts in Europe.

Put side by side, the two laws ask different questions about the same visibility tools:

• The DMA asked: are these programs fair to the properties that join them?
• The DSA now asks: are they transparent to the guests who see the results?

For hosts who pay a higher commission for visibility, an “ad” label is the outcome to watch. It is not clear yet how guests would respond to it.

The ad question is specific to Booking.com. The scam question is not.

---

Why platforms are limiting what hosts see about guests

Phishing works because a small piece of real information, a name, a date, a phone number, makes a fake message believable. Platforms have been responding by keeping more of that information inside their own systems.

• In 2023, Airbnb stopped sharing guest email aliases and pushed communication onto its own messaging.
• Airbnb’s move to temporary phone numbers follows the same logic.
• The EU is applying the same pressure beyond travel: Meta has faced a DSA investigation over scam ads since 2024.

For hosts, these changes have a real cost. Less guest contact information makes it harder to coordinate check-ins and to build direct relationships with repeat guests. That frustration is fair.

But guests reading about ghost apartments and data breaches are not wrong to be worried either, and platforms cannot be criticized for doing nothing and then for doing something. The Booking.com investigation makes it likely that this kind of tightening continues, on Booking.com and on its competitors.

So what does that mean in practice for the people listing on these platforms?

---

What does the Booking.com investigation mean for hosts and managers?

Nothing changes for hosts today. Opening proceedings does not prejudge the outcome, there is no deadline, and hosts do not need to do anything. But the three areas under review point to where change is most likely if Booking.com offers commitments or the Commission rules against it.

• Messaging and payments: the Commission has named messaging design and payment requests directly. Tighter controls on payment links, or on the guest data shared with properties, would be a likely response.
• Account security: the Paris case shows host accounts are a target, not just guest inboxes. Extra verification steps for hosts logging in or editing listing details would fit the same direction.
• Listing compliance: “non-compliant accommodation offers” sits next to fake listings in the release. That overlaps with the EU’s short-term rental registration rules, which have applied since May 2026 and ask platforms to check registration numbers.
• Paid visibility: hosts who pay a higher commission for visibility may see their listings carry an ad label in Europe.

The common thread is trust. Every change above adds a little friction for hosts, and each one is designed to make a booking feel safer to a guest who has read about ghost apartments in Paris.

---

Why the scrutiny won’t stop at Booking.com

Booking.com is the first booking platform to face a DSA investigation over scams, and it is unlikely to be the last. Scammers do not pick platforms by brand; they go where the bookings and the data are, and AI is making their messages faster and more convincing.

For hosts, the lesson travels well beyond Booking.com and beyond Europe. When a platform limits contact details, routes payments or adds verification steps, it is usually responding to pressure like this. Understanding that pressure makes those changes easier to plan around, even when they are inconvenient.