You made the reservation. The hotel exists. The dates of your stay are correct. Then you get a message: you need to reconfirm your card or make a payment, otherwise you risk losing your reservation.
It seems credible enough to click. This is exactly the kind of situation that has now become the focus of an official European Commission investigation into Booking.com.
Brussels opened formal proceedings on Wednesday, October 21, 2026 , to verify whether Booking.com has sufficiently assessed and mitigated the risks related to fraudulent ads and phishing attempts. In parallel, the Commission is checking whether paid listings are clearly marked as advertisements. The investigation is taking place under the Digital Services Regulation (DSA).
Important: the opening of the procedure does not mean that the platform has been found guilty. It is an investigation into possible violations of European obligations.
What does the European Commission actually check?
The first concerns non-existent accommodation, non-compliant listings and offers published by people fraudulently posing as owners. The Commission is assessing whether the platform identifies these risks and whether the measures to remove problematic listings are effective.
The second problem is phishing, which can exploit real information about reservations and tourists. Brussels is checking how data is shared with accommodation establishments and how the messaging system works, to determine whether existing protections are sufficient against fraudulent payment requests.
The third direction concerns transparency: properties that pay higher commissions for a higher search position must be clearly identifiable as advertising, according to DSA rules.
You have the real reservation. The hotel is real. The message may be fake.
One fraud scenario reported in reports of the phenomenon involves criminals taking over a property's account. A message sent later through a channel associated with the booking may appear authentic precisely because the tourist has already made a real reservation.
A sudden request to “reconfirm” your card, an unexpected payment difference, or an ultimatum of several hours are red flags. The fact that a message contains correct details about your stay does not prove that the sender is legitimate.
Why did the problem reach Brussels?
According to the materials examined by the Commission, the approach was preceded by a preliminary investigation: risk assessments submitted by Booking.com in 2026 and the three previous years, transparency reports and responses to official requests of September 23, 2025 and May 26, 2026.
The Commission is cooperating with the Consumer and Markets Authority of the Netherlands, where the company has its European headquarters. Booking.com is designated as a very large online platform under the DSA from April 2023.
There's another problem: what do you see first in searches?
In a market where the top results can directly influence the choice of accommodation, a paid placement must be distinguished from a regular result. The investigation aims to determine whether users can clearly identify listings promoted through additional commissions. It is not yet a finding that all such results are disguised advertising.
What is Booking.com at risk?
The Commission may request additional information, carry out further investigative measures, take interim measures or accept commitments from the company. A decision of non-compliance may lead to sanctions under the DSA, including fines of up to 6% of the company's global annual turnover , under the conditions laid down in the Regulation. There is no fixed deadline for the completion of the procedure.
Do you have a reservation on Booking.com? Five useful checks
- Do not enter your card details in a link you receive unexpectedly, even if the message claims to cancel your reservation.
- Compare any new payment request with the terms in the original confirmation.
- Do not send payment information via SMS, email, or WhatsApp to someone claiming to represent the accommodation.
- Get in touch property using an independently found number and check the situation directly in the application.
- If you have already disclosed your card details, contact the bank urgently, report the incident to the platform and, if applicable, to the authorities.
The real stakes: trust in online booking
Booking.com is not being investigated because a traveler found a room smaller than in the photos. What is at stake is the responsibility of a large platform when fraudulent listings, phishing attempts, and poorly labeled promotions can occur in its ecosystem.
The European Commission is yet to determine whether the company's measures comply with the DSA. Until then, the rule for tourists remains simple: a real booking does not mean that every message received about it is real.
Sources and documentation: European Commission — official press release, October 21, 2026 ; European Commission Representation in Romania — Romanian version ; Booking.com — traveler safety page.
Photo: European Commission
