Regulatory investigation launched
The European Commission has initiated a formal probe into Booking.com under the Digital Services Act (DSA). The investigation follows a period of increasing reports regarding fraudulent activity on the platform, including fake hotel listings and sophisticated phishing campaigns targeting users.
Regulators have stated that the platform's current measures to prevent fraud are inadequate. The probe will examine whether the company has done enough to protect users from malicious actors who gain access to the accounts of legitimate hotel partners to send fraudulent messages to guests.
How these scams work
In many documented cases, criminals do not compromise the Booking.com central systems directly. Instead, they gain access to the individual management portals used by hotels. Once inside, they use the platform's internal messaging system to contact customers who have existing bookings.
Because these messages come from the official app or website, they often bypass standard email spam filters. The messages typically claim there is an issue with a payment card and provide a link to a secondary website to re-enter financial details. This is known as phishing—a method of stealing sensitive data by pretending to be a trustworthy entity.
Implications for business users
For UK small businesses, this presents a risk to both operational budgets and data security. If an employee follows a fraudulent link while using a work device, they may expose corporate credit card details or login credentials.
There is also a risk for small hospitality businesses that list their properties on the platform. If your partner account is compromised, it can be used to defraud your customers, which may lead to financial liability or loss of reputation.
Recommended actions
Until the Commission concludes its investigation and the platform implements more stringent controls, we recommend the following steps:
- Verify payment requests: If you receive an urgent request to re-verify payment details via a link, contact the hotel directly using a phone number from their official website, not the number provided in the message.
- Use Multi-Factor Authentication (MFA): Ensure that any staff member with access to travel booking accounts has MFA enabled. This requires a second form of identification, such as a code from an app, to log in.
- Employee Awareness: Remind staff that legitimate platforms rarely ask for full payment details via a chat window or an external link after a booking has been confirmed.