Booking’s phishing crisis proves trust cannot be outsourced

A travel app should remove uncertainty, not repackage it as a checklist for the customer. Yet that is increasingly the bargain of online booking: the platform takes the commission and controls the marketplace, while the traveler is expected to decide whether a property exists, whether a message is genuine and whether a payment request is safe. The European Commission’s new investigation into Booking.com is therefore bigger than one company. It is a test of whether digital marketplaces are willing to own the risks created by their own convenience.

On October 21, the Commission opened a formal proceeding under the Digital Services Act to examine Booking.com’s handling of fraudulent accommodation listings, phishing and the transparency of sponsored placements. The platform has more than 45 million average monthly active users in the EU and has said it is cooperating fully, insisting that security, trust and personal-data protection are priorities, according to reports on the EU probe. The investigation does not establish wrongdoing, but it asks the question that matters: did Booking do enough before users were harmed?

“Be careful” is not a fraud-prevention system

The most revealing part of this story is not that scammers impersonate property owners. That is an old trick. It is that they can exploit a platform’s existing relationships, data and messaging channels to make the deception look authentic. A fake listing, a hijacked host account or a message containing real reservation details can turn a warning-resistant user into an easy target.

The investigation will examine how reservation and guest data are shared with properties, how Booking’s messaging system works, and whether those arrangements provide enough protection against fraudulent payment requests. That is precisely where the usual consumer advice starts to collapse. “Check the sender” is weak advice when the message arrives through a trusted booking context and includes information that appears to confirm the reservation.

Booking itself reported that travel scams increased 500% over an 18-month period, according to news reports on the EU probe. Fraudehelpdesk data cited in reports on the investigation showed 1,072 fraud reports in the Netherlands in the first part of 2026, involving €82,000 in losses—ten times the number of cases reported in the comparable period a year earlier. Those figures do not prove that Booking caused every incident. They do show why a platform with this scale cannot treat fraud as an unfortunate side effect that users must learn to navigate.

Identity checks should happen before the listing reaches the customer

The obvious response is not another pop-up telling travelers to remain vigilant. It is stronger verification upstream. The Commission says it will assess whether Booking properly identifies and removes nonexistent properties, non-compliant accommodation offers and listings created through impersonation. That places responsibility where it belongs: on the marketplace that decides who can sell, how prominently they appear and which communications reach customers.

No identity system will eliminate every scam. But that is not a persuasive excuse for weak friction at the point where a property joins the platform or changes its payment details. We think the standard should be simple: the harder it is for a host account to appear credible, alter sensitive information or contact a guest with a payment demand, the less burden falls on the traveler.

This is also why liability matters. If a platform benefits from centralizing discovery, booking and communication, it should not claim only the benefits of being the trusted intermediary while disclaiming the costs of that trust being abused. The EU’s DSA investigation is valuable because it frames fraud as a systemic-risk question rather than as a series of isolated mistakes by careless users.

Sponsored visibility makes trust even harder to judge

The second issue—paid placement—is less dramatic than phishing, but it cuts into the same foundation: can users understand why they are seeing a particular property? The Commission is examining whether accommodations paying higher commissions receive greater visibility and whether those placements are clearly identified as advertising. It will also consider whether users can understand who paid, why an ad was shown and how the relevant settings can be changed, as ANSA reports.

That may sound like a separate transparency dispute, but it is connected. Search ranking already feels like a recommendation from the platform. If payment can influence prominence without a clear label, the user is being asked to distinguish relevance from commercial priority with incomplete information. In a marketplace where the listing itself may be fraudulent, that ambiguity is not cosmetic. It weakens the signals people use to decide what deserves trust.

Clear labels are the minimum, not the solution. Booking should make the commercial reason for visibility understandable without forcing users to decode fine print or guess why one property outranks another. A trustworthy interface should reduce uncertainty at the moment of choice, not disclose it after the choice has been made.

The real loser is the convenience model

The danger for Booking and similar apps is not merely a potential regulatory penalty. It is the erosion of the central promise that made these services useful: enter a destination, choose a place and pay with confidence. Once every message becomes a possible trap and every prominent listing a possible paid shortcut, the app has transferred its verification work back to the customer.

The Commission can investigate, demand information, conduct inspections and require changes; the process has no fixed deadline, and opening it does not presume guilt. But the direction is right. Platforms should be required to demonstrate meaningful risk controls, not simply publish advice after scams become widespread.

Our verdict is straightforward: travelers should remain cautious, but they should not be made the primary fraud-detection layer for a marketplace they cannot audit. Booking needs stronger host and account verification, safer controls around reservation data and payment messages, and unmistakable advertising labels. Warnings are useful. They are not a substitute for responsibility.