The European Commission has initiated an investigation into Booking.com to assess potential security shortcomings that may have facilitated fraudulent listings and phishing scams. This probe aims to determine whether Booking.com has violated the security and transparency requirements outlined in the EU's Digital Services Act (DSA). Central to the investigation is an evaluation of how effectively the company has managed phishing risks, particularly in the way it handles reservation and guest data shared with accommodation providers. The Commission is also examining the design of Booking.com's messaging service to ascertain if it is vulnerable to misuse by cybercriminals. Additionally, the inquiry will explore whether Booking.com has adequately addressed systemic risks related to illegal content dissemination, including impersonation fraud and non-compliant accommodations. The company's advertising practices are under review to ensure compliance with the DSA's transparency obligations. Should Booking.com be found in violation of the DSA, it could face fines of up to 6% of its global annual revenue and be mandated to implement corrective actions. The DSA has been in effect since November 2022, targeting Very Large Online Platforms and Search Engines. This formal investigation follows a preliminary inquiry by the Commission and was announced on October 21. Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, emphasized the importance of ensuring consumer protection against scams in the digital space. While the investigation is ongoing, the Commission can accept commitments from Booking.com to address the issues at hand. Cybersecurity researchers have noted various phishing campaigns targeting Booking.com users in recent years. These attacks have involved threat actors acquiring customer data and mimicking the company's email domains to distribute malicious messages, leading to stolen payment details. Notable incidents include the deployment of the Vidar infostealer by cybercriminals in 2023 and the ClickFix campaign reported by Microsoft in 2025, which impersonated Booking.com to distribute malware. In 2026, TrendAI Research identified a phishing campaign targeting Booking.com partner accommodations in Japan, further highlighting the platform's vulnerability to phishing threats.