EU Commission investigates Booking.com over fake adverts and phishing scams

The European Commission has opened an investigation into Booking.com over fake adverts, paid search rankings and a data breach that exposed users to phishing scams. The Amsterdam-headquartered platform faces fines of up to 6 percent of turnover if the Commission finds it breached the rules and refuses to change its policies.

The first branch examines whether Booking.com breached data protection laws by failing to crack down on fake adverts. A second considers whether the site told users which listings had been ranked higher because their owners paid more, as transparency rules require. A third concerns accusations that hackers gained access to the company's reservation and guest data, exposing users to phishing scams.

The scale of the problem is documented. Scams reported on the platform rose 500 percent between 2022 and 2024, and fraud on the platform totalled €4.2 billion in 2024 alone. Tech sovereignty commissioner Henna Virkkunen said Europeans "should be able to book their holidays without fear of being scammed."

Booking.com said it was "cooperating fully" and that security, trust and the protection of personal information are top priorities, adding it remains committed to working with governments, regulators, law enforcement and industry partners to combat cybercrime.

The structure under scrutiny is the standard one: the platform charges commission on every hotel night in Europe and sells trust in the form of verifications, reviews and member rates — but has so far borne none of the risk when a listing turns out to be fake. The victim is left alone with the card company. If the Commission establishes liability for third-party fraud, it sets a precedent for the entire booking industry, and the bill lands either on the commission or on the consumer. The company's statement promises cooperation with exactly the regulators whose investigation it says is unnecessary.