Skip to content
The European Commission probes Booking Holdings for fraud and scams in listings

The European Commission probes Booking Holdings for fraud and scams in listings

Tradingview • October 21, 2026

The European Commission opened formal proceedings against Booking.com, owned by Booking Holdings BKNG , under the Digital Services Act. The Commission wants to investigate whether the platform does enough to remove fraudulent listings and stop phishing scams. The DSA requires large platforms to assess systemic risks and take steps to reduce them. Booking BKNG will be probed to see if it met those requirements.

The investigation covers three areas. The first is fake listings, such as rentals that don't exist, identity-theft scams, and offers that break regulations. The second is how Booking shares reservation and guest data with accommodation providers and how its messaging system works. The Commission will check whether Booking has enough safeguards to stop that data from being used for phishing and requests for fraudulent payments. The third is paid placement. Hotels can rank higher in results by paying a bigger commission, and regulators will check whether those listings are clearly marked as ads, including who paid for them and why users see them.

"Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously," highlighted Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy.

Following the investigation, if the European Commission confirms violations, it could fine Booking BKNG up to 6% of its global annual revenue. However, Booking BKNG can still offer fixes to avoid a penalty. The EC noted that it will treat the case as a priority and may use interviews, inspections, or interim measures.

Shares of Booking BKNG edged 0.3% lower in premarket trading on Wednesday.

Disclaimer Content provided by Seeking Alpha is intended for information purposes only, and that Seeking Alpha does not offer any personalist investment advice and is not a licensed securities dealer, broker, US investment adviser or investment bank.

More news from Seeking Alpha

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Data Breach at HotelNetSolutions Fuels Phishing Attacks on Hotel Guests A wave of phishing attacks via email and WhatsApp is targeting guests of hotels in Germany and neighbouring countries, using real booking data. According to Heise, at least part of the incidents stem from a data breach at booking service provider HotelNetSolutions GmbH, whose OnePageBooking platform manages bookings for over 2,500 hotels and hotel groups. The company confirmed to affiliated hotels that booking information was demonstrably exfiltrated through a vulnerability in an interface between HotelControl and a connected hotel system, and says it closed the vulnerability on 19 September 2026. The exfiltrated data included the hotel name, the guest's name, email address and phone number, the booking number, arrival and departure dates and the total booking amount. Criminals are using it to send credible payment requests, and Heise reports that hotel guests have already lost money. Heise reports the breach may have lasted for months: Günter Born described a phishing wave using data apparently taken from HotelNetSolutions around March 2026, and the company has told hotels it cannot reliably attribute exfiltration retrospectively from its logs. It has not confirmed when unauthorised access began or ended, and declined to tell Heise how many hotels are affected. Reservations made between January and 13 September 2026 have been reported to the company as affected. Under the GDPR the company acts as a processor, so the affiliated hotels are responsible for notifying affected guests; Heise has seen such notifications. 47 sources 62

Extracted Entities

Attack Types (1)

Phishing

MITRE ATT&CK (1)

T1566 - Phishing