The EU Investigates Booking.com Over Fake Listings, Phishing Scams and Paid Rankings Not Labelled as Ads: How to Avoid Booking Scams and Where to Complain in Portugal

The European Commission has opened formal proceedings against Booking.com under the Digital Services Act (DSA), the EU law on online platforms. It will examine whether the site has done enough against fake accommodation listings and phishing scams that use guests' booking details, and whether it labels paid-for rankings as advertising, according to its press release of 21 October.

"Europeans should be able to book their holidays without fear of being scammed," said Henna Virkkunen, the Commission's Executive Vice-President for Tech Sovereignty, Security and Democracy.

What the Commission is investigating

The first strand is fake listings: whether Booking.com properly assessed the risks from illegal content, such as properties that do not exist, impersonation fraud and accommodation offers that break the rules, and whether it removes such listings effectively.

The second is phishing. The Commission will look at how reservation and guest data is shared with accommodation providers, at the design of Booking.com's messaging service, and at whether safeguards stop that data being used to request fraudulent payments.

The third is boosted listings. Hosts can pay a higher commission to rank higher in search results, and the Commission will check whether users can tell these are advertisements and see who paid for each one.

If proven, these failures would breach Articles 34 and 35 of the DSA, which require very large platforms to assess and mitigate systemic risks, and Article 26(1), which requires advertisements to be clearly identifiable. Booking.com was designated a Very Large Online Platform on 25 April 2023; the Commission sent it formal requests for information on 23 September 2025 and 26 May 2026.

What happens next

The Commission says it will investigate "as a matter of priority", through further requests for information, interviews or inspections. It can impose interim measures, adopt a non-compliance decision or accept commitments from Booking.com, and opening proceedings does not prejudge the outcome. According to the Commission's DSA enforcement page, a fine can in no case exceed 6 percent of a provider's global annual turnover.

How to protect yourself when booking

Booking.com's own safety page says it will never ask for card details by email, phone, text or WhatsApp, and never for a bank transfer that differs from the payment policy in your booking confirmation. Do not pay anything outside that policy, and no genuine payment requires gift cards. Be wary of urgent demands (such as "transfer within 24 hours or the booking will be cancelled"), hosts who insist on talking outside the platform, and prices well below similar properties nearby.

If you have clicked a link or shared details, it advises contacting its customer service, resetting your password, turning on two-factor authentication and asking your bank to block your card. Our report on how banks now check the payee's name explains what that check catches, and what it cannot stop.

Where to complain in Portugal

A fraud (burla) can be reported online through the Queixa Eletrónica (electronic complaint) portal of the Ministério da Administração Interna (Ministry of Internal Administration), which forwards complaints to the GNR or PSP police and is open to foreign nationals living in or visiting Portugal.

For a platform's breach of the DSA, Portugal's Digital Services Coordinator is the Autoridade Nacional de Comunicações (ANACOM, National Communications Authority). Its complaints page (in Portuguese) asks for written complaints to [email protected], giving your name and email, the service's web address, a description of the breach with any evidence, and your correspondence with the platform. As Booking.com is established in the Netherlands, ANACOM may pass a complaint to the Dutch coordinator.