Skip to content
EU Regulators Open Probe Into Booking.com Over Fake Listings and Phishing Scams

EU Regulators Open Probe Into Booking.com Over Fake Listings and Phishing Scams

Finance.Biggo • October 21, 2026

European Union technology regulators are examining whether Booking.com does enough to remove fraudulent property listings and phishing schemes, opening a formal investigation that could expose its parent company to a penalty of up to 6% of global annual revenue.

The European Commission, which enforces the bloc's tech and competition rules, said the probe follows a preliminary review and an assessment of risk reports the hotel reservation platform filed this year and in each of the three prior years. Large online platforms are required under the Digital Services Act to take stronger action against illegal and harmful content, or face fines of as much as 6% of worldwide annual turnover.

The inquiry centers on three areas:

Investigators will also determine whether the company properly identified, evaluated and mitigated the systemic risks tied to those problems. Booking.com is a unit of Booking Holdings (BKNG).

"Europeans should be able to book their holidays without fear of being scammed," EU tech chief Henna Virkkunen said in a statement. "The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."

The Digital Services Act took effect for the largest platforms in 2023, obliging them to audit their own risks and submit regular compliance reports to Brussels. The Commission has used the framework to press major travel and e-commerce operators on how they police listings and advertising on their sites.

The opening of a formal proceeding does not establish wrongdoing, and the company has not publicly responded to the allegations. A finding of infringement could bring a penalty of up to 6% of Booking Holdings' global annual revenue, a sum that would run into the billions of dollars for a group of its size.

For investors, the investigation adds a regulatory overhang to a platform whose European accommodation business is central to its earnings. Beyond any fine, the case could force changes to how listings are verified, how guest data is shared with hotels and other partners, and how paid placements are labeled, all of which touch on the fees and visibility that drive the marketplace's economics.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Data Breach at HotelNetSolutions Fuels Phishing Attacks on Hotel Guests A wave of phishing attacks via email and WhatsApp is targeting guests of hotels in Germany and neighbouring countries, using real booking data. According to Heise, at least part of the incidents stem from a data breach at booking service provider HotelNetSolutions GmbH, whose OnePageBooking platform manages bookings for over 2,500 hotels and hotel groups. The company confirmed to affiliated hotels that booking information was demonstrably exfiltrated through a vulnerability in an interface between HotelControl and a connected hotel system, and says it closed the vulnerability on 19 September 2026. The exfiltrated data included the hotel name, the guest's name, email address and phone number, the booking number, arrival and departure dates and the total booking amount. Criminals are using it to send credible payment requests, and Heise reports that hotel guests have already lost money. Heise reports the breach may have lasted for months: Günter Born described a phishing wave using data apparently taken from HotelNetSolutions around March 2026, and the company has told hotels it cannot reliably attribute exfiltration retrospectively from its logs. It has not confirmed when unauthorised access began or ended, and declined to tell Heise how many hotels are affected. Reservations made between January and 13 September 2026 have been reported to the company as affected. Under the GDPR the company acts as a processor, so the affiliated hotels are responsible for notifying affected guests; Heise has seen such notifications. 47 sources 62

Extracted Entities