How the Booking.com phishing scam works, and why the EU is now investigating

A fake message arrives after a genuine hotel booking is already confirmed. It looks like it comes from Booking.com or from the hotel itself. That is the scam the European Commission is now investigating, according to Mediacorp. The Commission has opened a formal probe into whether Booking.com is doing enough to stop phishing scams and fraudulent listings, as required under the EU's Digital Services Act.

The investigation covers three things. Fake listings for properties that do not exist. Impersonation fraud and accommodation offers that do not comply with the rules. And phishing scams that exploit reservation and guest data shared between Booking.com and accommodation providers.

Where the scam actually starts

The mechanism depends on a detail easy to miss. A traveller books a real room through a real platform. That booking generates real data: a name, a stay date, a confirmation number. That data is shared with the accommodation provider so the stay can go ahead. Somewhere in that handoff, the scam gets its opening. A message exploiting that shared reservation data can look exactly like a legitimate follow-up, because it is built from real details about a real trip.

That is what makes phishing in this context different from a random scam text. The target has already booked. The message does not need to invent a reason to be believed, because the booking itself is the reason. A request to confirm payment details, or to click through and re-enter card information, lands on someone expecting exactly that kind of follow-up.

Fraudulent listings work on a separate but related weakness. A non-existent property, or an accommodation offer that does not match what is described, relies on the same platform trust that makes the phishing work. The traveller is choosing the listing because it sits inside Booking.com's own interface, carrying the credibility of the platform rather than of the individual host.

The Commission is also looking at paid-for boosted listings that are not clearly marked as advertisements. That matters for the same reason: a listing that looks like an organic, trustworthy result because it is not labelled as a paid placement is doing work the traveller did not agree to.

What the investigation shows

The Commission built this case from Booking.com's own risk assessment reports, submitted this year and over the previous three years, combined with a preliminary probe. The scam does not depend on a single bad actor slipping through. It depends on a reservation and data-sharing system built for convenience being usable, without extra friction, by whoever gets hold of a confirmation number.

Under the Digital Services Act, large platforms can face fines of as much as 6 per cent of global annual turnover for failing to address risks like these. EU tech chief Henna Virkkunen said the aim is to make sure travellers can book without fear of being scammed, and that the leading booking platform in Europe takes that responsibility seriously.

Anyone who receives a message about a booking they did not expect, even one with correct personal details attached, should go back to the booking directly through the official Booking.com app or website rather than clicking anything in the message.