Booking.com faces EU probe over scams, fines could reach 6%

Booking.com is now under formal investigation in Brussels. On 21 October 2026 the European Commission opened formal proceedings against the platform under the Digital Services Act, and a breach can cost up to 6% of its global annual turnover.

Booking.com has carried the status of a very large online platform since April 2023. That label puts it in the group of services the Commission supervises most closely, and this case is the test of what that supervision means for a travel marketplace.

What the Commission is examining

The inquiry names five problem areas. Regulators are looking at fake listings and people posing as property owners, and at how quickly Booking.com takes a listing down once someone complains. They are examining account hijacking and fraudulent messages sent to guests, and the data the platform shares with hotels. They are also checking whether paid rankings, which Booking.com calls boosted placements, are labelled clearly enough for a traveller to tell them from organic results.

Executive Vice-President Henna Virkkunen framed the action around the traveller. “Europeans should be able to book their holidays without fear of being scammed,” she said.

Commission spokesperson Thomas Regnier supplied the figure behind the case. He cited a 500% rise in scams between 2022 and 2024.

The penalty and the company’s reply

Fines under the Act can reach 6% of global annual turnover. For serious and repeated breaches the Commission can also pursue a temporary ban on the service in the EU. Booking.com said it is cooperating fully with the Commission.

Who it touches in APAC

Hotels. Several of the five areas sit inside a property’s own account. A fake listing puts a false version of a hotel in front of guests. A hijacked account lets a criminal write to arriving guests under the hotel’s name. Booking.com’s own data sharing with hotels is part of the inquiry too. A guesthouse in Bali, a ryokan in Kyoto and a beach resort in Goa log in to the same extranet as a hotel in Lisbon, so the exposure is the same wherever the property stands.

OTAs. Every regional online travel agency runs a marketplace with the same pressure points: checking that a listing belongs to the person who posted it, answering complaints fast, and screening messages between guests and suppliers. The Commission’s list reads as a ready checklist for any platform that expects a regulator to ask the same questions one day. Paid placement is the sharpest of them. An OTA that sells prominence to suppliers will want its labelling in order before a supervisor asks.

Airlines and DMCs. Neither sells through Booking.com’s hotel marketplace in the way a hotel does, but both depend on European guests who trust what lands in their inbox. A message that poses as a hotel, a transfer company or a tour operator damages the whole trip, and a DMC whose partner hotel has been impersonated is the one that takes the complaint. Airlines face the same pattern in fake refund and rebooking messages.

What the rules replace

Until now, the answer to listing fraud and account takeover on a large platform was its own policy, enforced at its own pace and judged mostly by the platform. Proceedings under the Digital Services Act bring in an outside body that can demand evidence and apply a defined penalty. Ranking labels move the same way. How a paid placement is shown to a traveller used to be a commercial decision, and it is now a point of law for a platform of this size.

When it is likely to reach APAC

The proceedings concern Booking.com’s service in the EU, so nothing changes in Asia on the day of the announcement. The route to APAC runs through the product. A platform told to label paid rankings and speed up takedowns for one region often finds it cheaper to build one process and run it everywhere. If that happens, hotels across Asia will see it first in their extranets, as new labels on boosted placements, new verification steps at login or a changed complaints flow. The Commission has given no date for a decision, so hotels should treat the next few months as a window to prepare, not a deadline.

Hotel groups that sell to European travellers also have a commercial reason to watch. If paid rankings become more visible to guests, the return on boosted placement may shift, and revenue managers will want to compare it against direct booking spend.

Key takeaway

Hotel and OTA leaders in APAC do not need a ruling to act. We would start with extranet security: two-step sign-in, a short list of named users and a review of who holds access to every channel account. Operators with European guests should also check that their listings on every platform match their own website, since impersonation sits at the top of the Commission’s list.

Daksh Sharma

Chief Editor, TravHQ

Daksh Sharma is a travel tech enthusiast and a prolific voice in the B2B travel industry. A speaker at numerous travel-tech events, he is at the forefront of digital and AI adoption in travel. He conducts AI training and implementation programmes and works as a digital advisor to a number of global B2B brands.

More from Daksh

Have a story Daksh should see? Write to editor@travhq.com.