EU Commission launches review of Booking.com’s anti‑phishing safeguards

The European Commission announced on Monday that it will open a formal investigation into online travel agency Booking.com to determine whether the platform has taken sufficient steps to shield users from phishing attacks that impersonate the service.

Regulators say a noticeable increase in fraudulent emails and messages claiming to be from Booking.com has prompted concerns about the adequacy of the company's security controls. Under the EU's Digital Services Act, large online platforms are required to implement robust measures that prevent the spread of deceptive communications and protect consumer data.

The inquiry will focus on several key areas, including the verification processes for outbound communications, the use of two‑factor authentication for account access, and the speed and transparency of the company’s response when phishing incidents are reported. Investigators will also assess how Booking.com informs customers about potential scams and whether it collaborates with law‑enforcement agencies to track malicious actors.

Booking.com issued a brief statement confirming that it “takes the security of our members very seriously” and that it has a “comprehensive set of tools and protocols designed to detect and block fraudulent activity.” The company added that it will fully cooperate with the Commission’s review and implement any recommended improvements.

The move follows a series of high‑profile EU actions against digital platforms that were found lacking in consumer protection. Earlier this year, authorities scrutinized Amazon and Airbnb for similar shortcomings, citing the same legislative framework that obliges firms to mitigate risks linked to online scams and misinformation.

If the Commission concludes that Booking.com has fallen short of its obligations, it could impose fines of up to 6% of the company’s global revenue or mandate specific technical upgrades. Such enforcement would signal a broader push by European regulators to tighten security standards across the travel‑booking sector, where cross‑border transactions make users especially vulnerable.

The investigation is expected to run for several months, with interim findings to be published as they become available. In the meantime, consumer‑rights groups advise travelers to verify the sender’s address, avoid clicking links in unsolicited messages, and report suspicious communications directly to Booking.com’s support channels.