The European Union has launched formal proceedings against Booking.com, accusing the travel giant of failing to stop a surge in AI-powered scams, fake listings, and hidden paid placements across its platform. Investigators will use the company’s own internal disclosure of a 500 to 900 percent spike in travel fraud as the foundation for their case.
This action marks the first time Brussels has wielded the Digital Services Act against an accommodation marketplace. Until now, regulators had focused enforcement on social media firms and content moderation failures. Wednesday’s announcement extends the law’s reach into commercial fraud prevention, a shift legal experts say will shape obligations for every major online marketplace operating in Europe.
The stakes reflect Booking.com’s market power. Roughly 66 percent of all online accommodation bookings across the EU flow through the Amsterdam-based platform, which counts more than 45 million monthly European users. At that scale, even small verification gaps create widespread harm.
Regulators have structured the investigation around three suspected DSA violations. First, insufficient listing verification allowed fabricated properties, host impersonation, and non-compliant offers to remain live. A UK consumer watchdog demonstrated the problem by successfully listing 10 Downing Street as a holiday rental with zero identity checks. Second, investigators will examine whether Booking.com adequately protected reservation data from phishing and smishing attacks. Third, the platform allegedly failed to label boosted search results as paid advertising, potentially misleading travelers who assumed top rankings reflected quality.
The fraud surge traces directly to generative AI tools released in early 2023. Booking.com’s own security chief publicly acknowledged the 500 to 900 percent increase in scams the following year, attributing it to AI’s ability to produce flawless, personalized phishing messages. Microsoft researchers documented how attackers compromised hotel partner accounts using a browser-based “repair” trick, then accessed guest reservation details to send convincing payment demands through the platform’s legitimate messaging channel.
Dutch authorities recorded 957 Booking.com phishing reports in the first half of 2026 alone, with confirmed losses exceeding €82,000. UK fraud reports between 2023 and 2024 totaled £370,000 in documented losses.
Individual cases show the human toll. A Dutch traveler paid €355 for an access code to a Cape Town apartment that did not exist. In Portugal, two families each paid €1,200 to rent a home whose owner never listed it.
The Commission can fine Booking.com up to 6 percent of global turnover, potentially $1.61 billion based on 2025 revenue. The company says it is cooperating fully. For travelers, existing bookings remain valid, but the investigation underscores immediate practical steps: enable two-factor authentication, treat any off-platform payment request as suspicious, and verify listings independently before booking.
