The European Commission has launched an investigation into Booking.com over concerns about online fraud and phishing scams targeting travellers. Criminals have exploited messages about bookings to trick customers into making fraudulent payments, sometimes using convincing messages that appear to come directly from hotels. Apparently, a platform capable of finding you a romantic apartment in Barcelona within three seconds has considerably more difficulty determining whether the person requesting your credit card details is actually the hotel.

Booking.com, headquartered in Amsterdam, has spent years perfecting the art of making customers book quickly. Rooms are supposedly disappearing, twelve people are allegedly looking at the same property, and somewhere a digital countdown is quietly suggesting that hesitation could ruin your entire holiday. But when scammers exploit that same atmosphere of urgency, suddenly everyone agrees that customers should slow down and think carefully.

Brussels is demanding stronger consumer protection, while Booking.com maintains that security remains a priority. One imagines the company carefully examining how to introduce additional verification without accidentally making the booking process less profitable. It is a beautiful contradiction: the platform has mastered the science of making people panic before paying, and regulators are now asking it to prevent criminals from doing exactly the same thing.

The scammers, meanwhile, must be delighted. Someone else built the perfect sales funnel.

What actually happened

  • On 21 October 2026 the European Commission opened formal proceedings against Booking.com under the Digital Services Act, covering fake listings, phishing via booking and guest data, and advertising transparency. Opening proceedings does not establish a breach; Booking.com says it is cooperating fully.
  • Sources: NL Times, ZDFheute