European Commission opens DSA investigation into Booking.com over fake listings, phishing/smishing scams and weak fraud defenses
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 21/10/2026 12:15; os links antigos trazem para cá.
The European Commission has opened a formal investigation under the Digital Services Act (DSA) into Booking.com, a very large online platform with more than 45 million EU users. It will examine whether the company does enough to stop fraudsters from using the platform for fake listings, impersonation fraud, phishing and smishing (theregister.com, olhardigital.com.br). Officials described the company's fraud defenses as "absolutely substandard" (theregister.com). The probe follows a preliminary analysis and a review of the risk reports Booking.com submitted this year and in the previous three years (olhardigital.com.br). It also follows Booking.com's own June 2024 admission of a 500-900 percent jump in travel scams over the prior 18 months (theregister.com). Opening the proceeding does not imply guilt, but a DSA breach can bring fines of up to 6% of global annual turnover (olhardigital.com.br). Booking.com says it is cooperating fully with the Commission and works with governments, regulators, law enforcement and industry partners against online fraud (theregister.com, olhardigital.com.br).
Detalhes técnicos
- Fraudulent listings: fake hosts present themselves as the owner of premises they do not own and advertise them for rent. Regulators will also look at listings for non-existent properties and non-compliant accommodation (theregister.com, olhardigital.com.br).
- Account takeover and social engineering: scammers take over a property owner's account and contact details, then message guests claiming additional payments are due (theregister.com).
- Phishing and smishing: the Commission covers phishing and SMS phishing, including phishing that abuses booking data and guest information shared with partner properties (theregister.com, olhardigital.com.br).
- Data protection: the Commission suspects Booking.com does not sufficiently protect the data of consumers and business users (theregister.com).
- Advertising transparency: a third strand examines whether ads and boosted (paid-ranking) listings are clearly distinguished from organic results (theregister.com, olhardigital.com.br).
- Risk assessment: the Commission considers Booking.com's DSA risk assessment insufficient, even though the company takes internal measures based on its own cases and external reports (theregister.com).
- The sources provide no IOCs, CVEs, named threat actors or breach details (olhardigital.com.br).
Remediação
- The Commission expects a more diligent risk assessment from Booking.com. It will assess whether the company identified these risks and adopted sufficient mitigation measures (theregister.com, olhardigital.com.br).
- Measures the Commission named: addressing abuse of the reservation system, rapidly removing listings once fraud is reported, checking licenses, and changing how property owners are onboarded (theregister.com).
Linha do tempo
-
European Commission opens DSA investigation into Booking.com over fake listings, impersonation fraud and phishing scams
ler a análise desta fonte ocultar
The European Commission has opened a formal investigation into Booking.com to determine whether the platform adequately counters fraudulent advertising, phishing scams and non-compliant accommodation listings under the Digital Services Act (DSA). The probe follows a preliminary analysis and a review of the risk reports the company submitted this year and in the previous three years. Regulators will examine listings for non-existent properties, impersonation fraud, and phishing that abuses booking data and guest information shared with partner establishments. They will also look at paid ads that are not clearly labelled as advertising. Opening the proceeding does not imply guilt, but a DSA breach can bring fines of up to 6% of global annual turnover. Booking.com says it is cooperating with the Commission.
Technical Details
- Fraud themes under review: fake property listings, impersonation scams, and phishing that exploits reservation data and guest details shared with partner properties.
- Additional focus: paid advertisements not clearly identified as such.
- The article provides no IOCs, CVEs, threat actors or breach details.
Remediation
- The Commission will assess whether Booking.com identified these risks and adopted sufficient mitigation measures.
- Booking.com states it works with governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud.
-
EU Commission opens DSA probe into Booking.com over fake listings, phishing and smishing scams
ler a análise desta fonte ocultar
The European Commission has opened an investigation under the Digital Services Act (DSA) into whether Booking.com, a very large online platform with more than 45 million EU users, does enough to stop fraudsters using it for scams, phishing and smishing. Officials described the company's fraud defenses as "absolutely substandard". The probe follows Booking.com's own June 2024 admission of a 500-900 percent jump in travel scams over the prior 18 months. In the Netherlands alone, more than 1,000 fraud notifications were made in the first part of 2026, causing about €82,000 in damage, a tenfold year-on-year increase. Booking.com says it is cooperating fully with the Commission.
Technical Details
- Fraudulent listings: fake hosts present themselves as the owner of premises they do not own and advertise them for rent.
- Account takeover and social engineering: scammers take over a property owner's account and contact details, then message guests claiming additional payments are due. The Commission also covers phishing and smishing (SMS phishing).
- Data protection: the Commission suspects Booking.com does not sufficiently protect the data of consumers and business users.
- Advertising transparency: the third strand examines whether ads and boosted (paid-ranking) listings are clearly distinguished from organic results.
- Risk assessment: the Commission considers Booking.com's DSA risk assessment insufficient, even though the company takes internal measures based on its own cases and external reports.
Remediation
The Commission expects a more diligent risk assessment from Booking.com. Measures it named include:
- addressing abuse of the reservation system;
- rapidly removing listings once fraud is reported;
- checking licenses;
- changing how property owners are onboarded.