EU puts Booking.com’s fraud controls and paid hotel rankings under investigation

Brussels is examining the reservation-data flows, messaging tools and paid rankings that connect hotels with guests. For operators, the immediate issue is exposure through those systems—not an announced change in commissions or a finding that Booking.com broke the law.

The European Commission has opened a formal investigation into Booking.com, bringing two commercially sensitive parts of hotel distribution into the same enforcement case: safeguards around guest transactions and the transparency of paid visibility. Announced on 21 October 2026, the proceedings examine suspected breaches of the EU’s Digital Services Act. They are an investigation, not a finding of infringement.

For hotels, the significance lies in where Brussels is looking. The inquiry extends beyond fake accommodation advertisements to the way reservation and guest information reaches accommodation providers, the functioning of Booking.com’s messaging service, and the presentation of listings whose providers pay higher commissions for greater prominence. These are systems through which legitimate hotels conduct business, not merely peripheral sources of fraudulent content.

Booking.com told Reuters it was engaging constructively with the Commission. “Security, trust and the protection of personal information are top priorities at Booking.com,” a spokesperson said, adding that the company remained committed to working with regulators, law enforcement and industry partners against cybercrime and online fraud.

– Brussels is examining the transaction pathway

---

The Commission’s fraud inquiry has two distinct strands. One concerns whether Booking.com adequately identifies, assesses and mitigates risks from fake listings, impersonation and non-compliant accommodation offers, including through their removal. The other concerns phishing that exploits reservation and guest data.

That second strand brings the platform–property relationship directly into view. Investigators will examine risks associated with data shared with accommodation providers and the design and functioning of the messaging service, including whether safeguards sufficiently prevent information being misused to solicit fraudulent payments. The announcement does not establish where any particular compromise originated or assign responsibility for individual incidents.

The operational implication is narrower than a wholesale rethink of online travel agency distribution. As a management response—not a newly imposed legal requirement—operators have reason to test whether their payment instructions, messaging access and incident-escalation processes are consistent and auditable. The relevant question is whether a guest can distinguish an authorized request from a fraudulent one, and whether the property can reconstruct what happened when that distinction fails.

For owners and asset managers, that makes fraud handling a distribution-control issue as well as an IT issue. It does not yet provide a basis for estimating incremental losses or assuming that switching booking channels would eliminate the exposure.

– Paid prominence faces a separate transparency test

---

The commercial strand concerns accommodation providers paying higher commissions to improve their position in Booking.com search results. The Commission will examine whether those boosted listings are clearly identifiable as advertisements and whether users can readily see who is behind an advertisement, who paid for it and why it was shown.

This is a disclosure test, not an announced prohibition on paid ranking. The Commission identifies Article 26(1) of the DSA as the relevant advertising-transparency provision, alongside Articles 34 and 35 for systemic-risk assessment and mitigation.

Clearer labels could change how travelers interpret prominent results, but any effect on clicks, conversion or acquisition cost remains unestablished. For revenue and distribution teams, the practical response is to measure the incremental contribution of paid visibility separately from overall Booking.com production. The proceedings alone do not justify cutting distribution expenditure; separate measurement would allow hotels to assess any subsequent presentation change against its actual commercial results.

– The next material development would be a specific platform change

---

The October decision escalates an existing inquiry. The Commission’s preliminary work drew on Booking.com’s 2026 risk assessment and those for the preceding three years, transparency reports, and replies to information requests dated 23 September 2025 and 26 May 2026.

The Commission will now gather further evidence and can accept commitments, impose interim measures or reach a non-compliance decision. Its announcement gives no completion date. DSA infringements can attract fines of up to 6% of a provider’s global annual turnover—a statutory ceiling, not an estimate of Booking.com’s exposure.

For hotels, the next actionable development would be a specific change to messaging safeguards, data-sharing arrangements or advertising disclosures. That would determine whether operators need to revise fraud controls, payment communications or paid-visibility budgets. For now, the sources establish regulatory scrutiny, not a demonstrated effect on hotel revenue or distribution costs.