Skip to content
Booking.com Targeted in EU Investigation Into Phishing Scams, Fraudulent Listings

Booking.com Targeted in EU Investigation Into Phishing Scams, Fraudulent Listings

Ground.News • October 21, 2026

EU regulators will examine whether Booking.com failed to curb fake listings, phishing and paid boosts, with possible fines reaching 6% of global turnover.

On Wednesday, the European Commission launched an investigation into Booking under the Digital Services Act to determine if the platform adequately mitigates fraudulent listings and phishing scams.

A Dutch consumers report recorded a "tenfold" increase in fraud notifications this year compared to 2025, with losses in the region of €82,000 on Booking.

Under the Digital Services Act, Booking Holdings could face fines of up to 6 per cent of global annual turnover if officials conclude anti-fraud measures are "absolutely substandard."

EU tech chief Henna Virkkunen stated, "Europeans should be able to book their holidays without fear of being scammed," as the Commission conducts an "in-depth investigation as a matter of priority.

Covered Lawsuit Against Booking

The European Commission has launched an investigation into whether the online travel booking platform Booking (Booking.com) violated the European Union's proposals and sufficiently exploited vulnerabilities and fraud by phishing, according to data in Brussels.

EU investigates Booking.com over fake listings and phishing scams

Booking, EU Survey on Scams and Ads

At the centre of the investigation, compliance with the Digital Services Act.

Not Done Enough Against Fraudsters? EU Investigates Booking.com

The Dutch travel portal should not have done enough against fraudsters on the platform. Also the protection of sensitive data and transparency in paid advertising are examined.

EU Sues Portal Booking.com – Customers Need to Know that Now

The European Commission has launched an official investigation into the popular Booking.com travel portal.

Fraudulent Ads and Scams : Brussels Survey on Booking

Brussels also blames the site for a potential failure to comply with its advertising transparency obligations, with regard to "boosted" ads, a paid function that gives institutions a better visibility on the platform. This is the first procedure launched by the EU for the Dutch-based platform (and subsidiary of the US group Booking Holdings), under the powerful European Digital Services Act, the DSA. "Europeans must be able to book their holiday…

43 % of the sources are Center

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Data Breach at HotelNetSolutions Fuels Phishing Attacks on Hotel Guests A wave of phishing attacks via email and WhatsApp is targeting guests of hotels in Germany and neighbouring countries, using real booking data. According to Heise, at least part of the incidents stem from a data breach at booking service provider HotelNetSolutions GmbH, whose OnePageBooking platform manages bookings for over 2,500 hotels and hotel groups. The company confirmed to affiliated hotels that booking information was demonstrably exfiltrated through a vulnerability in an interface between HotelControl and a connected hotel system, and says it closed the vulnerability on 19 September 2026. The exfiltrated data included the hotel name, the guest's name, email address and phone number, the booking number, arrival and departure dates and the total booking amount. Criminals are using it to send credible payment requests, and Heise reports that hotel guests have already lost money. Heise reports the breach may have lasted for months: Günter Born described a phishing wave using data apparently taken from HotelNetSolutions around March 2026, and the company has told hotels it cannot reliably attribute exfiltration retrospectively from its logs. It has not confirmed when unauthorised access began or ended, and declined to tell Heise how many hotels are affected. Reservations made between January and 13 September 2026 have been reported to the company as affected. Under the GDPR the company acts as a processor, so the affiliated hotels are responsible for notifying affected guests; Heise has seen such notifications. 47 sources 62

Extracted Entities

Attack Types (1)

Phishing

MITRE ATT&CK (1)

T1566 - Phishing