EU Opens Formal Probe into Booking.com Over Systemic Security Failings and DSA Compliance

The European Commission has officially launched a formal investigation into Booking.com, the world’s leading online travel agency, to determine whether the platform has failed to implement necessary safeguards against fraudulent listings, phishing, and systemic security risks. The probe, announced on October 21, marks a significant escalation in the European Union’s enforcement of the Digital Services Act (DSA), signaling a new era of accountability for Very Large Online Platforms (VLOPs).

At the heart of the investigation is whether Booking.com has adequately assessed and mitigated the risks posed by malicious actors who have consistently exploited the platform’s infrastructure to conduct sophisticated phishing attacks and financial scams against unsuspecting travelers.

The Core Allegations: A Breach of the Digital Services Act?

The European Commission’s inquiry is multi-faceted, focusing on whether Booking.com has failed to uphold its statutory obligations under the DSA, which was designed to ensure a safer and more transparent digital environment for European citizens.

Risk Assessment and Mitigation

The Commission is scrutinizing how Booking.com manages the flow of guest and reservation data to third-party accommodation providers. There is significant concern regarding the safeguards—or lack thereof—that prevent this sensitive information from being harvested by cybercriminals. Investigators are looking for evidence of "diligence" in how the platform monitors its ecosystem to ensure that hotel partners are not being used as entry points for credential harvesting or fraudulent payment solicitation.

The Messaging Vulnerability

A key focus of the probe is the design and operational security of Booking.com’s internal messaging service. Over the past several years, threat actors have frequently weaponized this feature, masquerading as hotel staff to communicate directly with guests. By injecting malicious links or urgency-driven payment demands into these trusted channels, attackers have successfully defrauded numerous customers. The Commission aims to determine if the platform’s design choices intentionally or unintentionally facilitate these abuses.

Illegal Content and Impersonation

Beyond phishing, the investigation covers the platform’s broader responsibility to address illegal content, including the prevalence of non-compliant accommodation listings and impersonation fraud. The Commission is questioning whether the firm has implemented effective systemic risk mitigation measures to identify and remove these fraudulent entities before they can harm users.

Advertising Transparency

Finally, the probe will assess Booking.com’s advertising practices. Under the DSA, platforms are required to provide clear, granular information regarding the nature and targeting of advertisements. The Commission intends to verify whether the company meets these transparency standards or if it is masking the true nature of its promotional activities.

A Chronology of Escalation: From Localized Scams to Global Probes

The decision to initiate formal proceedings did not happen in a vacuum. It follows a prolonged period of intense scrutiny, during which cybersecurity researchers and consumer advocacy groups highlighted a consistent pattern of abuse.

Pre-2023: Cybersecurity researchers begin noting an uptick in specialized phishing campaigns targeting the hospitality sector, specifically identifying Booking.com as a high-value vector.
2023: A turning point in visibility occurs when cybersecurity firm Secureworks (now part of Sophos) documents how threat actors deployed the "Vidar" infostealer malware. By infecting the systems of partner hotels, attackers gained access to Booking.com’s extranet credentials, allowing them to send highly convincing, authentic-looking phishing emails to guests.
March 2025: Microsoft security researchers identify a widespread "ClickFix" campaign. This sophisticated attack used social engineering to impersonate Booking.com, targeting users globally—from North America to Europe—by luring them into downloading malware disguised as legitimate software.
June 2026: TrendAI Research uncovers a targeted campaign in Japan, where hackers impersonated guest complaints to manipulate hotel staff into executing malicious files, demonstrating that the platform’s vulnerabilities were being exploited across diverse geographical markets.
October 2026: Following a preliminary investigation, the European Commission formally launches its probe, citing the failure of the platform to adequately curb these recurring threats.

The Mechanics of the Fraud: How Cybercriminals Exploit the Ecosystem

To understand the severity of the situation, one must examine the methods employed by threat actors. The attacks on Booking.com are rarely "spray and pray" phishing attempts; they are highly targeted, persistent, and exploit the trust inherent in the hotel-guest relationship.

The "Trusted Channel" Attack

Because Booking.com allows messaging between hotels and guests, it creates a "trusted environment." When a guest receives a message through the official platform interface, they have little reason to doubt its legitimacy. Attackers compromise a hotel’s internal system—often via malware like Vidar—and use that access to log into the hotel’s Booking.com dashboard. From there, they send messages to guests who have legitimate upcoming reservations.

These messages often contain links to fraudulent payment portals that mirror the official Booking.com interface. Because the message originates from the official platform, the success rate of these scams is significantly higher than traditional email phishing.

The Infostealer Epidemic

The use of infostealers has become the primary method for breaching the hospitality sector. By infecting a hotel employee’s workstation with malware, attackers can harvest credentials for various booking engines and property management systems. Once the credentials are exfiltrated, they are often sold on dark web marketplaces, providing a "turnkey" solution for other criminals to launch their own fraud campaigns.

EU Regulators to Investigate Booking.com Over Scam Risks

Official Responses and Regulatory Stance

The European Commission’s move is a definitive signal that the "grace period" for major platforms to adapt to the DSA is over. Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security, and democracy, issued a sharp statement regarding the decision:

"Europeans should be able to book their holidays without fear of being scammed. The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."

The Commission has been careful to state that the opening of formal proceedings does not predetermine a guilty verdict. The investigation is an evidence-gathering phase. However, the Commission maintains the power to accept commitments from Booking.com—essentially allowing the company to propose solutions and systemic changes to avoid the most severe penalties.

A spokesperson for Booking.com has acknowledged the probe, stating that the company is "committed to working closely with the European Commission" and emphasizes that it invests heavily in security measures to protect both partners and customers. They maintain that the security of their platform is a top priority.

Potential Implications: The Price of Non-Compliance

The stakes for Booking.com are exceptionally high. Under the Digital Services Act, if the investigation concludes that the company has failed in its duties, the financial penalties could be severe.

Financial Consequences

The DSA allows the Commission to impose fines of up to 6% of a company’s global annual turnover. Given Booking.com’s massive footprint in the travel industry, a 6% penalty would represent a staggering financial blow, potentially reaching into the hundreds of millions or billions of euros.

Operational Mandates

Beyond fines, the Commission can mandate specific operational changes. These could include:

Enhanced Authentication: Requiring multi-factor authentication (MFA) for all hotel partners to prevent account takeover.
Content Moderation Overhaul: A complete redesign of the internal messaging system to detect and block malicious links in real-time.
Data Siloing: Stricter protocols on how guest data is shared with hotels to limit the blast radius of any potential data breach.
Auditing and Reporting: Compulsory, regular third-party security audits to ensure ongoing compliance with the DSA’s safety standards.

The "Precedent Effect"

This investigation serves as a warning to other VLOPs in the travel and hospitality sector, such as Airbnb or Expedia. The Commission is demonstrating that it will not tolerate the "platformization of crime," where a site’s scale is used as a shield against the responsibility for illegal activity occurring within its walls.

Conclusion: A Turning Point for Digital Travel

The investigation into Booking.com is not merely a bureaucratic process; it is a fundamental test of the EU’s ability to enforce digital safety in a borderless online economy. For millions of Europeans, the ability to travel without the looming threat of financial theft is a basic consumer right.

As the inquiry proceeds, the industry will be watching closely. If the Commission finds that Booking.com has indeed fallen short of the DSA’s high standards, it will set a landmark precedent that will likely force a wholesale restructuring of how travel platforms handle user data, communicate with partners, and defend against the evolving threat landscape of the 21st century.

The digital travel sector is at a crossroads: it must either embrace a new, more rigorous model of platform security or face the full, punitive weight of European regulation. For Booking.com, the coming months will be defined by their ability to convince regulators that they are not just a marketplace, but a responsible guardian of the millions of travelers who entrust them with their data and their security every day.