European Commission Investigates Booking.com Over Security Concerns
The European Commission has initiated an investigation into Booking.com, a prominent online travel agency, due to potential security vulnerabilities that may have facilitated fraudulent listings and phishing scams. This decision marks a significant regulatory move aimed at safeguarding consumers within the digital marketplace.
The investigation seeks to determine whether Booking.com has violated the security and transparency requirements established by the EU’s Digital Services Act (DSA). This act, which came into effect in November 2022, imposes strict guidelines on Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) to enhance consumer protection and data security.
Key Focus Areas of the Investigation
Central to the inquiry is the Commission’s assessment of how effectively Booking.com has assessed and addressed phishing risks that impact its customers. A crucial aspect of this evaluation includes examining how the company manages customer reservation and guest data when sharing it with accommodation providers. The Commission aims to scrutinize the safeguards Booking.com has implemented to prevent the misuse of this sensitive information, which can lead to phishing attacks and the solicitation of fraudulent payments.
Additionally, the Commission is expected to analyze the design and functionality of Booking.com’s messaging service. There are concerns about its potential for misuse by malicious actors who may exploit it for phishing endeavors. The investigation will further assess whether Booking.com has appropriately evaluated systemic risks associated with the dissemination of illegal content, including impersonation fraud and non-compliant accommodation listings.
Moreover, the advertising practices of Booking.com will be under review to establish whether they comply with the transparency obligations set forth in the DSA. Such scrutiny is vital to ensure that advertising practices do not mislead consumers or contribute to the proliferation of fraudulent activities.
Should the investigation conclude that Booking.com has indeed fallen short in complying with the DSA’s provisions, the company faces fines of up to 6% of its global annual turnover. Furthermore, it could be mandated to implement corrective measures aimed at rectifying identified deficiencies in its operations.
Formal Proceedings and Regulatory Oversight
The decision to formally investigate Booking.com was announced on October 21 and follows a preliminary investigation by the Commission. Henna Virkkunen, the Commission’s executive vice-president responsible for tech sovereignty, security, and democracy, emphasized the importance of consumer protection in the travel industry. She stated, “Europeans should be able to book their holidays without fear of being scammed. The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”
The Commission has clarified that the initiation of formal proceedings does not presuppose a particular outcome. Instead, it retains the authority to accept commitments from Booking.com that would mitigate the concerns raised during the investigation.
Rising Vulnerabilities: The Phishing Threat
Booking.com customers have increasingly become targets for phishing campaigns in recent years. Cybersecurity researchers have observed numerous attacks where threat actors access personal information and spoof the company’s email domains to send harmful messages. In 2023, Secureworks, now integrated with Sophos, revealed how cybercriminals utilized the Vidar infostealer to gain unauthorized access to partner hotels’ Booking.com credentials. This information was subsequently exploited to send phishing emails that deceived Booking.com customers into revealing their payment details, resulting in financial losses for many individuals.
In a separate incident reported by Microsoft, a phishing attack known as the ClickFix campaign took place in March 2025. This initiative saw malicious emails impersonating Booking.com being dispatched to individuals across North America, Oceania, South and Southeast Asia, and Europe. The objective was to lure recipients into downloading infostealer malware, potentially compromising further customer data.
Furthermore, a phishing campaign uncovered by TrendAI Research in June 2026 targeted Booking.com partner establishments in Japan. This involved emails disguising themselves as guest complaints and review requests, aiming to trick hotel staff into executing harmful files.
As the Commission’s investigation unfolds, the scrutiny placed on Booking.com underscores the ongoing struggle between consumer protection and the evolving tactics employed by cybercriminals. Ensuring robust security frameworks within digital platforms is paramount for safeguarding both businesses and consumers in an increasingly interconnected world.