EU opens DSA probe into Booking.com over scams and phishing

On 21 October 2026 the European Commission opened formal proceedings against Booking.com under the Digital Services Act (Regulation (EU) 2022/2065). The proceedings follow a preliminary investigation and will establish whether the platform, designated as a very large online platform (more than 45 million users in the EU), has properly assessed and mitigated the fraud risks that run through its service. Booking.com said it is cooperating fully with the Commission.

For security teams the story matters for a specific reason: at its core is an attack chain known for years, which starts at accommodation providers and ends in customers’ wallets, using genuine booking data.

The three strands of the investigation

All three outlets agree on the scope of the proceedings:

• fraudulent and non-compliant listings: ads published by people posing as owners of properties that do not belong to them, and accommodation that does not comply with the rules;
• phishing, smishing and social engineering: the Commission will examine how Booking.com shares reservation and guest data with accommodation providers, which safeguards prevent that data from being used to request fraudulent payments, and how the platform’s messaging service is designed, since it can be abused for phishing. According to The Register, the Commission also suspects insufficient protection of consumer and business user data;
• advertising transparency: whether paid ads and properties that pay to rank higher are recognisable as such.

If an infringement is found, the fine can reach 6% of global annual turnover, along with mandatory corrective measures. The Commission points out that opening proceedings does not prejudge the outcome and that it can accept commitments offered by the company.

The attack chain

A Commission spokesperson quoted by The Register describes the scheme: scammers take over a property owner’s account, replace the contact details and message guests asking for additional payments. Agenda Digitale explains why it works: the message contains the correct stay dates and amounts, and urgently asks the guest to re-enter card details to avoid losing the room. Even a careful user has little to go on to spot it.

The campaigns documented over the years, recalled by Infosecurity Magazine, show where the access comes from:

• 2023: Secureworks (now part of Sophos) described the use of the Vidar infostealer to steal partner hotels’ Booking.com credentials, which were then used to send phishing to customers and steal payment details;
• March 2025: Microsoft reported a ClickFix campaign impersonating Booking.com, with emails aimed at the hospitality sector in North America, Oceania, Asia and Europe, designed to get victims to install credential-stealing malware;
• June 2026: TrendAI Research identified emails targeting partner accommodations in Japan, disguised as guest complaints and review requests, to get staff to run malicious files.

In MITRE ATT&CK terms the sequence reads as follows: phishing aimed at accommodation staff (T1566) and user execution (T1204), theft of credentials stored in the browser (T1555.003), use of valid accounts on the platform (T1078) and finally impersonation towards guests (T1656). The weak point is not a single piece of software but the property’s account: whoever controls it sees enough data to craft credible requests.

The figures cited by the Commission

According to The Register, officials pointed to Booking.com’s own admission, in June 2024, of a 500–900% rise in travel scams over the previous 18 months. In the Netherlands alone, again according to The Register (the only source for this figure), more than 1,000 fraud reports were filed in the first part of 2026, ten times the previous year, with €82,000 in damage, and similar reports come from almost every member state. One official described the measures taken so far as «absolutely substandard». Going forward, the Commission expects a more thorough risk assessment, which could include tackling abuse of the reservation system, quickly removing reported listings, checking licences and changing how property owners are onboarded.

Agenda Digitale frames the case within Articles 34 and 35 of the DSA (assessment and mitigation of systemic risks) and recalls two precedents involving marketplaces: a €200 million fine for Temu on 28 May 2026 and €550 million for AliExpress on 20 July 2026.

What it means for European and Italian companies

The DSA applies to the platform, but the operational risk stays with accommodation providers, which are very numerous in Italy, and with companies whose employees book business travel. For hotels, farm stays and short-term rental managers, a compromised account means customers defrauded in their name, reputational damage and possible personal data breaches involving guests, to be assessed under the GDPR.

What to do now

Accommodation providers and property managers

• enable multi-factor authentication on booking platform accounts where available, with named accounts for staff and immediate revocation for anyone who leaves;
• manage bookings from up-to-date workstations with active antivirus/EDR, without saving passwords in the browser;
• treat attachments and links in complaints, review requests or documents «from a guest» with caution, and train staff never to paste commands into the Run dialog or PowerShell when a web page asks them to (the ClickFix technique);
• regularly check the account’s contact details, payout details and logins: a change you did not make is a sign of compromise;
• if you suspect unauthorised access, change credentials from a clean machine and alert the platform and guests with active bookings.

Companies and travel managers

• remind employees that a request to re-enter card details received by message, SMS or chat must always be verified in the official app or website, never through the link received;
• consider virtual or spending-limited corporate cards for travel.

Technical monitoring

• hunt on endpoints for PowerShell or mshta processes launched by explorer.exe with obfuscated commands, and for access to browser credential stores by unusual processes.

How ARXDOME helps

ARX Expose flags lookalike domains registered by others, company accounts involved in breaches and your email SPF and DMARC configuration, which help against anyone impersonating your company. ARX Shield keeps track of workstation protection status, and ARX Horizon lets you search for the indicators of compromise of known campaigns.

Last updated: 22 October 2026