Lorraine Williamson
The European Commission has launched a formal investigation into Booking.com over concerns about fake accommodation listings, phishing scams and the way paid promotions appear in search results.
The investigation, announced on Wednesday 21 October, could have implications for millions of travellers booking accommodation in Spain and across Europe, as well as property owners who use the platform to advertise their rentals.
Why is Booking.com being investigated?
Brussels wants to establish whether Booking.com has done enough to identify and reduce the risk of fraud under the European Union’s Digital Services Act (DSA). The legislation places obligations on major online platforms to assess risks to users, tackle illegal content and make advertising more transparent.
The Commission has identified three areas for investigation: fraudulent accommodation listings, phishing scams involving reservation and guest information, and paid listings that may not be clearly identified as advertisements. The opening of formal proceedings does not mean Booking.com has been found guilty of breaking EU law.
Fake holiday rentals leave travellers vulnerable
One of the Commission’s concerns is whether Booking.com has adequate systems to identify fraudulent or non-compliant accommodation listings and remove them when problems are reported.
The issue has already affected holidaymakers in Spain. Earlier this month, hundreds of travellers reportedly arrived at a residential building near Madrid’s Retiro Park after booking accommodation that did not exist. The case raised questions about how convincing fraudulent listings can appear, even when they seem to have established reviews and ratings.
The European investigation is not limited to that particular incident. It is examining whether Booking.com’s wider systems are sufficiently effective at preventing fraud, identifying suspicious activity and responding when users report problems.
How phishing scams can target genuine bookings
The second area concerns phishing, where criminals impersonate a legitimate business or accommodation provider to obtain personal information or persuade customers to make fraudulent payments.
These scams can be particularly convincing when messages refer to a real reservation. A traveller might receive a message that appears to come from their accommodation, asking them to confirm payment details, follow a link, or transfer money to avoid cancellation.
Brussels is examining the risks of sharing booking and guest information with accommodation providers, as well as the design and operation of Booking.com’s messaging service. The investigation will assess whether the platform has taken sufficient measures to protect users against these forms of fraud.
Are paid listings clearly identified?
The Commission is also questioning how Booking.com presents accommodation providers that pay for greater visibility in search results.
Paying to appear more prominently is not necessarily prohibited. However, European rules require users to be able to recognise advertising and understand why certain listings are being promoted.
Investigators will examine whether travellers can clearly distinguish between accommodation appearing because it matches their search and properties receiving greater prominence because the provider has paid for it.
What does this mean for property owners in Spain?
The investigation is relevant not only to tourists but also to hotels, holiday rental businesses and individual property owners who advertise accommodation through Booking.com.
If criminals gain access to an accommodation provider’s account, they may be able to impersonate the business and contact guests with fraudulent payment requests. Such incidents can damage a property’s reputation and create difficulties for genuine customers, even when the owner has not knowingly participated in the fraud.
Booking.com says it is cooperating fully with the European Commission and maintains that customer safety, trust and the protection of personal information are priorities. The company says it remains committed to working with authorities and industry partners to combat online fraud.
The European investigation does not change Spain’s existing tourist accommodation registration and licensing requirements. Owners must continue to comply with the rules applicable to their properties, while taking appropriate precautions to protect their booking accounts.
How to protect yourself when booking accommodation
Spain’s consumer organisation OCU has warned that fraudulent accommodation listings can leave travellers without somewhere to stay and facing substantial financial losses.
It recommends checking that a tourist property’s registration number matches the relevant regional records, keeping payments within the booking platform’s official channels and being suspicious of unexpected requests for external bank transfers.
Travellers should also retain booking confirmations and payment records. If they suspect fraud, they should report it promptly to the booking platform and the relevant authorities, while contacting their bank immediately if payment details or money may have been compromised.
Could Booking.com face a fine?
The European Commission will now gather further evidence, which may include requests for information, interviews and inspections. Booking.com will have the opportunity to respond to the concerns and propose measures to address them.
If breaches of the Digital Services Act are eventually established, penalties could reach up to 6% of the company’s worldwide annual turnover. However, there is no automatic fine, and the Commission has not reached a final decision.
For travellers booking accommodation in Spain, the immediate message is to remain alert to suspicious listings and unexpected payment requests, even when using a familiar platform. The investigation will determine whether Booking.com needs to do more to prevent those risks.