The European Commission announced today, October 21, 2026, that it has opened formal proceedings against Booking.com under the Digital Services Act — the EU's flagship platform law — over suspected failures to stop fake accommodation listings, reservation-linked phishing scams, and paid "boosted" search placements that may not be clearly labeled as advertising. If you've ever typed "is booking.com legit" or "booking.com scam" into Google before paying for a hotel, this probe is about exactly those doubts.
Booking.com is Europe's dominant travel booking platform, and for travelers in the US booking European trips it's often the first stop too. Here's what the investigation covers, how fake hotel listings and booking phishing actually work in 2026, and the checks that keep your money safe.
## 1. What the EU probe is really about
The Commission's announcement breaks the case into three strands:
- Fake and non-compliant listings. Properties advertised that don't exist, impersonation fraud (scammers posing as real hotels), and accommodation offers that break local rules. Regulators want to know whether Booking.com properly identified and assessed these risks and did enough to keep fake listings away from users.
- Phishing exploiting reservation and guest data. Booking.com shares reservation details with accommodation providers, and scammers have weaponized that pipeline. The investigation will examine the messaging service and how guest data moves between the platform and providers.
- Paid "boosted" listings that may not look like ads. The Commission will check whether search results that hotels paid to promote are transparently identifiable as advertising.
A few things the probe is NOT: it is not a finding that Booking.com broke the law, and no fine has been imposed. Formal proceedings unlock the Commission's evidence-gathering powers; a breach decision, if any, would come later — and Booking.com may propose commitments to resolve the concerns. But the scale is serious: DSA violations can bring fines of up to 6% of a company's global annual turnover. The probe follows a preliminary investigation and risk-assessment reports Booking.com submitted from 2023 to 2026.
The context matters for shoppers: Dutch authorities recorded more than 1,000 fraud notifications linked to these scams in early 2026, with €82,000 in losses — a tenfold rise from the year before. "Europeans should be able to book their holidays without fear of being scammed," said EU tech chief Henna Virkkunen. Meta has faced DSA scrutiny over scam advertising since 2024, and the EU fined X €120 million in its first DSA penalty — so platforms are genuinely on notice.
## 2. Why travel booking scams are exploding right now
Three forces are converging this autumn:
Travel is the perfect scam product. Bookings are bought weeks or months before use, paid in full upfront, and often non-refundable — so victims may not discover the fraud until they arrive at a door that doesn't exist. Peak season (summer holidays, then Christmas and New Year trips) concentrates billions in spending on a handful of platforms.
Phishing got dangerously personal. The scams the Commission flagged aren't generic spam. They use real reservation details — your name, dates, the hotel you actually booked — lifted from the data shared between Booking.com and accommodation providers. A message that knows your check-in date is far more convincing than a random "you won a prize" email.
AI does the heavy lifting. Fake listings now come with fluent, professional copy in any language, convincing property photos, and even fabricated review histories. One operator can run dozens of bogus listings at once — and when a listing gets flagged, the next one is already live.
## 3. How the fake hotel listing scam works
The classic version plays out in four steps:
Step 1 — The listing. A property appears on Booking.com with professional photos, a great location, and prices 30–50% below comparable hotels. The photos are often stolen from a real hotel elsewhere in the world — or generated wholesale.
Step 2 — The booking. You pay upfront, often in full. The confirmation looks exactly like any other booking. In the US, that's commonly $150–$400 per night disappearing from your card; in Europe, €120–€350.
Step 3 — The silence (or the phishing). Sometimes nothing happens — no confirmation email, no contact. Other times you receive messages from the "property" asking you to re-confirm payment details via a link, which is the phishing strand of the scam.
Step 4 — Check-in day. You arrive and the property doesn't exist, or the real hotel at that address has never heard of you or the listing. The listing has often vanished from the platform by then.
A variant skips the platform entirely: scammers clone Booking.com's look on a separate website, buy ads for "Booking.com 40% off," and harvest cards directly. Same outcome, different door.
## 4. How reservation-data phishing works (the scary part)
The phishing the EU flagged is a step beyond ordinary email scams because it rides on information that should be private:
- Real booking details. The message addresses you by name, cites your actual dates and property, and may reference the confirmation number — because the scammer got hold of the reservation data shared with the "accommodation provider."
- Inside the trusted channel. Many victims receive these messages through the platform's own messaging system, which feels safer than email. But a compromised or fake provider account can send anything.
- The payment "re-confirmation." The classic hook: "your card was declined, re-enter your details here to keep your reservation" — with a link to a lookalike page. The urgency (your trip is at stake) short-circuits skepticism.
- The WhatsApp pivot. After first contact, scammers often move you to WhatsApp or Telegram "for faster service," where no platform protections apply.
Legitimate platforms and hotels will essentially never ask you to re-enter full card details through a link in a message. Treat any such request as hostile until proven otherwise.
## 5. Seven red flags of a fake hotel booking
Run any suspicious listing or message through this list:
1. The price defies the market. A 4-star hotel in central Paris for €49 a night, or a beachfront Miami room for $59 — real discounts run 10–30%; "70% off" on premium dates is bait.
2. No verifiable footprint outside the platform. A real hotel has a website, Google Maps reviews, and mentions elsewhere. If the property exists only as one listing with no independent trace, be suspicious.
3. Brand-new or review-free listings for "established" hotels. A property claiming ten years in business with zero reviews, or reviews that all appeared within the same week, is a classic fabrication pattern.
4. The photos don't survive a reverse image search. Right-click and search the listing photos — if the same images advertise a different property in another country, the listing is stolen or fake.
5. The "host" pushes you off-platform. Any request to pay by bank transfer, or to continue the conversation on WhatsApp to "get a better rate," is a red flag. Platforms protect on-platform payments; scammers know it.
6. Vague or evasive property details. No exact address, no phone number, answers that dodge direct questions about the location or check-in process. In the EU, accommodation providers must meet local registration and transparency rules — evasion is a signal.
7. Payment or "verification" links inside messages. Real platforms process payments in the booking flow, not through links sent in chat. A message asking you to "re-confirm your card" is the phishing play, full stop.
If three or more of these hit, stop and verify before paying anything.
## 6. "Boosted" listings and paid top spots: the transparency problem
The Commission's third strand deserves its own section because it affects every search you run, not just scams:
- Paid placement isn't labeled clearly. When hotels pay for better visibility ("boosted" or sponsored placements), the DSA requires that advertising be identifiable. If you can't tell which top results are ads, your booking decision is being steered invisibly.
- Top spot ≠ best or most trustworthy. Ranking can reflect payment, not quality. A listing's position tells you nothing about whether it's real.
- Reviews on listings can be gamed too. Fake listings often launch with a wall of glowing five-star reviews — all posted in a burst, all vague, none mentioning specifics. If a listing's reviews look manufactured, paste the review text into our free fake review checker: it reads the language patterns that separate genuine write-ups from fabricated ones. One honest note about how it works: the checker reads review text you paste in — it does not fetch listing pages or analyze links on its own. Copy the suspicious reviews, paste them in, and get a verdict on the words themselves.
- In the US, the FTC's fake-review rule now allows civil penalties against deceptive review practices — and in the UK, the CMA has live fake-review investigations running. Paid placement and fake reviews are both under real regulatory pressure on both sides of the Atlantic.
## 7. The two-minute check before you book or pay
Before you enter card details for any booking:
1. Verify the property off-platform. Search the hotel name + city. A real property has a website, map listing, and reviews across multiple sites. No independent footprint = don't book.
2. Reverse-image-search the listing photos. Stolen photos from another property or country are the single fastest tell.
3. Run suspicious URLs through a website scam checker. If a "booking confirmation" link or a too-cheap deal arrives from outside the platform, our free website scam checker examines the domain age, contact details, and business identity behind it — the exact things cloned booking sites try to hide.
4. Confirm directly with the property. Call or email the hotel at a number from its own website (not the listing) and ask whether your reservation exists. Five minutes, near-total certainty.
5. Keep payment on-platform and protected. Pay by credit card or PayPal with buyer protection — never by bank transfer, wire, gift cards, or crypto at a "host's" request. If a listing only accepts irreversible payment, walk away.
6. Never re-enter card details from a message link. If a message claims your payment failed, log in through the official app or site yourself and check the booking status there.
Our full walkthrough of domain and business-identity checks is in our website legitimacy guide: https://fakereviewdetector.org/blog/is-this-website-legit-how-to-check-online-store-safe
## 8. Already paid a fake listing? Act now
Speed matters — scammers pull listings and disappear:
1. Contact the platform immediately. Report the listing and the messages through Booking.com's (or the relevant platform's) official support. Screenshot everything first — listings vanish.
2. Dispute the charge. Credit cards and PayPal offer buyer protection for services never received. In the US, file the dispute with your card issuer; in the EU, the same rights apply to cross-border card purchases, and your bank must investigate.
3. Report it. In the US, report to the FTC at ReportFraud.ftc.gov. In the UK, report to Action Fraud. In the EU, contact your national consumer center — the ECC-Net network handles cross-border cases. These reports are exactly what triggered the Commission's probe.
4. Lock down your data. If you entered card details on a phishing page, call your bank now and consider replacing the card. If you reused a password on the fake site, change it everywhere. Watch for follow-on phishing using your trip details.
Fake hotel listings and reservation phishing are under formal EU investigation as of today — which means enforcement is coming, but your next booking can't wait for it. Two minutes of verification before you pay is the cheapest travel insurance there is.
FAQ
Q: Is Booking.com legit?
A: Booking.com is a real, major travel platform — the EU probe is about whether it does enough to keep fake listings and phishing off its platform, not about whether the platform itself is fake. The risk is individual fraudulent listings and scam messages, which exist on every large booking platform.
Q: How can I tell if a hotel listing is fake?
A: Check for an independent footprint (own website, map reviews), reverse-image-search the photos, be wary of prices far below market, and never pay or "re-confirm" through links in messages. Details in section 5 above.
Q: Booking.com sent me a message asking me to re-enter my card details. Is it real?
A: Treat it as a scam until proven otherwise. Log in through the official app or website yourself and check your booking status there — never through the message's link. Legitimate platforms don't ask for full card details via message links.
Q: What are my refund rights if I booked a fake hotel?
A: Dispute the charge with your card issuer or PayPal for services not received. In the EU you have strong cross-border consumer rights; in the US, card network rules and the FTC complaint system apply. Report to the platform, your bank, and the relevant authority (FTC / Action Fraud / national consumer center).
Sources: Reuters, "Booking.com targeted in EU investigation into phishing scams, fraudulent listings" (Oct 21, 2026) — formal DSA proceedings, three strands (fake listings/impersonation, reservation-data phishing, paid boosted listings), no violation established, follows 2023–2026 risk-assessment reports. Morningstar/Dow Jones (Oct 21, 2026, 06:19 ET) — up to 6% global turnover fines, formal proceedings unlock evidence-gathering. The Register via European Commission (Oct 21, 2026) — Dutch authorities 1,000+ fraud notifications early 2026, €82,000 losses, tenfold rise; Virkkunen quote: "Europeans should be able to book their holidays without fear of being scammed."; Booking.com cooperating; X €120M first DSA penalty; Meta under DSA scrutiny since 2024. Internal guides linked: website legitimacy, AI-generated fake reviews.
Explore the evidence behind your next question.
Start a website check