Booking.com faces EU probe over fake listings and phishing scams

What happened

The European Commission has opened a probe under the Digital Services Act (DSA) into Booking.com over fake listings and phishing on the travel platform, according to The Register. The Commission has described the company's fraud defences as "absolutely substandard", moving the issue from consumer complaints into formal regulatory scrutiny.

The investigation centres on two linked problems. Fraudulent listings can present accommodation that does not exist or is not available as advertised, while phishing attempts target people using the service. Both hit customers at the point of booking, when trust and payment decisions are made.

The probe is at an early stage, and no outcomes or remedies have been reported. The action is best read as a formal demand for Booking.com to strengthen its controls against scams on the platform.

Why it matters

Booking.com's journey is high-trust and pre-payment. A fake listing or phishing message breaks expectations at the moment a customer is most committed, and the damage often extends beyond one transaction to confidence in the platform as a whole. Fraud controls are therefore part of the customer experience, not only a security function sitting behind it.

The regulatory focus also points to a wider shift for digital services. Verification, reporting and warning flows need to be designed into the journey, and they need to work for ordinary users who are not expecting an attack. For organisations modernising their platforms, this suggests that trust and safety capabilities should be built into product and operating-model decisions from the outset.

The Renascence take

Most coverage will treat this as a compliance story about a large platform. The more useful question is why scams persist long enough to draw regulatory attention in the first place, since that usually reflects friction in how users recognise and report fraud. Fraud defence is a service-design problem: the safest outcome is one where the customer never has to make a fine-grained judgement about whether a listing is genuine. Operators should audit their own booking and messaging journeys from the perspective of a first-time user under pressure, and treat fraud signals as a core part of the experience they are responsible for.