Booking.com has a scam problem. The EU wants answers

European regulators are investigating whether Booking.com is doing enough to protect travelers from fraudsters who exploit hotel reservations, impersonate property owners, and trick customers into making fraudulent payments.

Booking.com is facing a European Union investigation over concerns that scammers are exploiting the popular travel platform to steal money and personal information from unsuspecting holidaymakers.

The European Commission announced the investigation on Oct. 21, saying it wants to determine whether Booking.com has adequately addressed fraudulent accommodation listings, phishing scams, and other risks to consumers.

Key points

• The European Commission has launched an investigation into Booking.com under the Digital Services Act
• Regulators are examining fake accommodation listings, phishing attacks, and fraudulent payment requests
• Scammers can hijack legitimate hotel accounts and use real booking information to make their messages look trustworthy
• Dutch authorities recorded more than 1,000 fraud reports involving the platform in early 2026, with losses of approximately €82,000
• Booking.com says it is cooperating with regulators and remains committed to combating online fraud
• The company could face substantial penalties if violations of EU law are established

Scammers exploit legitimate hotel reservations

One of the Commission's biggest concerns is that criminals can exploit Booking.com's own reservation and messaging systems to target customers who have already booked accommodation.

According to The Register, European officials described cases in which scammers take control of accommodation providers' accounts, impersonate property owners, and contact travelers to demand additional payments.

The messages can be particularly convincing because they may contain genuine booking information.

For example, a traveler who has reserved a hotel room might receive a message claiming that their payment failed or that their reservation will be canceled unless they immediately verify their credit card.

The message may appear to come from the hotel itself, sometimes through the platform's legitimate communication channels.

Victims who follow the instructions can end up providing their payment information to criminals or transferring money to fraudulent accounts.

This is what makes these attacks particularly dangerous: the scam may arrive through a service the customer already trusts and address a reservation they actually made.

The Commission is examining how Booking.com shares reservation and guest information with accommodation providers, how its messaging system operates, and whether sufficient safeguards exist to prevent criminals from exploiting these features.

Fake hotels and fraudulent property listings

Regulators are also concerned about accommodation listings that advertise properties that don’t exist or are posted by individuals with no authority to rent them.

In some cases, fraudsters impersonate legitimate property owners and collect payments for accommodation they cannot provide.

Travelers may discover the deception only after arriving at their destination, when the hotel or holiday rental turns out to be nonexistent or unavailable.

Officials suggested that the platform could improve property-owner verification, check accommodation licenses, and remove suspicious listings more quickly after receiving reports of fraud.

Fraud reports have surged

The investigation follows mounting concerns about the scale of fraud affecting online travel bookings.

According to The Register, European officials pointed to Booking.com's own acknowledgment in June 2024 that travel scams had increased by between 500% and 900% in the preceding 18 months.

In the Netherlands alone, authorities received more than 1,000 fraud notifications in early 2026, with reported losses totaling approximately €82,000.

That represented a 10-fold increase from the same period a year earlier, according to figures cited by EU officials.

The Commission says the problem extends beyond the Netherlands, with similar reports emerging from other European countries.

One official described the company's efforts as "absolutely substandard," arguing that stronger systems could help prevent fraudulent activity before travelers lose money.

Paid hotel rankings also under scrutiny

European regulators are also examining whether Booking.com clearly identifies properties that appear higher in search results because their owners pay the platform larger commissions.

Under the EU's Digital Services Act (DSA), online platforms must ensure that users can recognize ads and understand why they are seeing them.

The Commission wants to know whether travelers can distinguish between accommodation listings that rank prominently because they match their search criteria and those receiving preferential placement through commercial arrangements.

If violations are established, Booking.com could face fines of up to 6% of its worldwide annual turnover under the DSA.

Booking.com says it’s cooperating fully with European regulators and maintains that protecting travelers, accommodation partners, and personal information remains a priority.

How to avoid Booking.com scams

Travelers should be cautious when receiving unexpected messages about reservations, even when those messages appear to come from a legitimate hotel.

Criminals increasingly exploit familiar services and real customer information to make fraudulent requests look authentic.

Here are some precautions worth taking:

• Be suspicious of unexpected payment requests. If a hotel suddenly asks you to pay an additional fee, update your card details, or confirm a reservation through an unfamiliar link, verify the request independently.
• Don't trust a message simply because it appears inside Booking.com. Compromised accommodation accounts can allow criminals to communicate through legitimate channels.
• Avoid clicking payment links sent through messages. Open the Booking.com app or website directly and check your reservation and payment status.
• Contact the property using verified details. If something seems suspicious, call the accommodation using a number obtained independently, rather than one supplied in the questionable message.
• Check listings carefully before booking. Examine recent reviews, property details, cancellation conditions, and unusually attractive prices.
• Protect your accounts. As a rule of thumb, you should use strong, unique passwords and enable two-factor authentication for all your online accounts.
• Act quickly if you've paid a scammer. Contact your bank or card issuer, report the incident to Booking.com, and preserve any messages or payment records.

Bitdefender Premium Security can provide an additional layer of protection against phishing websites, malicious links, and other online threats.

On topic:

Banks must prepare for AI failures before customers pay the price, UK watchdog warns

AI agents want to shop for you; banks warn of scams and privacy risks

An online ad was enough to deliver spyware—no click required