EU Commission Opens Formal Investigation Into Booking.com Over Phishing Risks

The European Commission has initiated a formal investigation into Booking.com to determine if the travel platform failed to adequately protect customers from phishing attacks and fraudulent listings. According to Infosecurity Magazine, regulators are assessing whether the company breached security and transparency provisions mandated by the EU’s Digital Services Act. The probe specifically examines how the platform manages risks associated with customer data and communication channels.

In plain English

Regulators are looking closely at how Booking.com shares sensitive reservation and guest information with accommodation providers. The Commission wants to know if the safeguards in place prevent this data from being misused to launch phishing campaigns or solicit fraudulent payments. Another key area of scrutiny is the design and functioning of Booking.com’s messaging service. Investigators will assess whether the platform’s communication tools can be easily abused by malicious actors to trick users into revealing personal details or sending money to scammers.

The background

The decision to launch these formal proceedings followed a preliminary investigation conducted by the Commission. Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security and democracy, stated that Europeans should be able to book holidays without fear of being scammed. She emphasized that the Digital Services Act sets clear responsibilities for platforms to address these risks. The DSA came into force in November 2022 and applies to Very Large Online Platforms and Very Large Online Search Engines.

What changes now

If the Commission determines that Booking.com failed to comply with the DSA in these areas, the company could face significant penalties. Fines could reach up to 6% of the firm’s global annual turnover, and Booking.com may be required to take corrective measures. The Commission noted that opening formal proceedings does not prejudge the final outcome. It remains empowered to accept commitments offered by Booking.com to remedy the matters subject to the proceedings. Cybersecurity researchers have observed numerous phishing campaigns targeting Booking.com customers and partners in recent years.

What made it possible

This situation highlights risks inherent in platforms that facilitate third-party transactions and communications. When a service provider shares user data with external partners, such as accommodation hosts, it expands the attack surface. If those partners do not have robust security controls, sensitive information can leak and be used for impersonation or credential harvesting.

Additionally, built-in messaging features can become vectors for social engineering if they lack adequate filtering or verification mechanisms. Security teams usually monitor for anomalous communication patterns and verify the integrity of data sharing agreements. They check whether isolation controls prevent bad actors from accessing customer data through partner interfaces.

What to do and how to stay safe: Booking.com

• Monitor official booking confirmations and payment requests through the platform's official website or app, rather than relying on external links sent via messaging services.
• Verify the identity of accommodation providers by cross-referencing contact details with those listed on the platform before sharing personal or financial information.
• Enable multi-factor authentication on travel booking accounts to add an extra layer of security against unauthorized access if credentials are compromised.
• Report suspicious messages or requests for payment directly to the platform's support team to help identify and block malicious actors.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why is the EU investigating Booking.com?

The European Commission is investigating whether Booking.com breached Digital Services Act provisions by failing to adequately protect customers from phishing and fraud.

What could happen if Booking.com is found non-compliant?

The company could face fines of up to 6% of its global annual turnover and be required to implement corrective measures.

When did the formal proceedings begin?

The Commission announced the decision to launch formal proceedings on October 21, following a preliminary investigation.