THE European Commission has opened formal proceedings against Booking[.]com to assess potential security failings under the EU’s Digital Services Act (DSA). The investigation will determine whether the online travel platform complied with the DSA’s requirements for security, transparency and risk mitigation, focussing on how Booking[.]com handles phishing risks, data sharing with accommodation providers, and safeguards to prevent data being misused to carry out phishing or fraudulent payments.
It will also examine the design and operation of Booking[.]com’s messaging service and whether it could be abused for phishing attacks, along with the platform’s management of systemic risks linked to illegal content such as impersonation fraud and non-compliant listings. The inquiry will additionally assess whether the firm’s advertising practices meet the DSA’s transparency obligations.
If non‑compliance is established, Booking[.]com could face a fine of up to 6% of its global annual turnover and may be ordered to take corrective actions. The DSA has been in force since November 2022 and targets Very Large Online Platforms and Very Large Online Search Engines.
Customers of Booking[.]com have long been a target for phishing and fraud linked to the platform. The Commission’s decision to proceed follows a preliminary probe and comes amid documented campaigns that have spoofed Booking[.]com domains or used partner credentials to harvest payment details.
Examples cited include a 2023 Secureworks–Sophos finding that Vidar infostealer campaigns leveraged partner hotel data to deceive customers, a 2025 ClickFix phishing effort impersonating Booking[.]com to prompt malware downloads, and a 2026 campaign against Booking[.]com partner accommodations in Japan using fake guest‑related emails. The outcome could influence how Booking[.]com strengthens protections for user data, improves messaging safeguards and enhances transparency around advertising.