Startup Blog for First Time Entrepreneurs who Bootstrap

EU Opens Booking.com Investigation Over Scams, Phishing and Paid “Boosted” Listings. What It Means if You Rent Out Rooms or a Holiday Home

TL;DR: why is the EU investigating Booking.com?

On 21 October 2026 the European Commission opened formal proceedings against Booking.com under the Digital Services Act (DSA), a law already in force (Adopted). It will check three things: whether Booking.com does enough against fake and non-compliant listings, whether the guest data it shares with accommodation providers and its messaging service make phishing scams too easy, and whether listings that hosts boost by paying a higher commission are clearly labelled as ads. Nothing has been decided yet, and there is no deadline. If you rent out rooms, a guesthouse or a holiday home on Booking.com, secure your extranet account now, and expect paid visibility to be labelled more clearly. For more on platform rules hitting small businesses this month, see our report on Meta’s new Commercial Terms.
If you run a small B&B, a farm stay or two holiday flats, Booking.com is probably your biggest sales channel. It is also where scammers now find your guests. In the Netherlands alone, reports of phishing around booking sites rose from 162 in the second half of 2025 to 1,072 in the first half of 2026, and more than 90% of them concerned Booking.com.
Last week Brussels decided to look at how the platform deals with that. Here is what the Commission is investigating, what it could mean for the commission you pay and the guests you host, and what to do this week.

What happened on 21 October

The European Commission opened formal proceedings to check whether Booking.com may have breached the Digital Services Act. In its press release, it says the platform may not have “diligently assessed or effectively mitigated” risks linked to fraudulent listings and phishing scams, and may not have clearly labelled as ads the listings whose providers paid for a higher ranking.
Booking.com has been a “very large online platform” under the DSA since 25 April 2023, which means extra duties to find and reduce risks to users. The Commission’s decision follows two formal requests for information, sent on 23 September 2025 and 26 May 2026, and a review of Booking.com’s risk assessment reports from 2026 and the three years before.
Henna Virkkunen, the Commission’s Executive Vice-President for tech sovereignty, said: “Europeans should be able to book their holidays without fear of being scammed.” Booking.com told The Next Web that “security, trust and the protection of personal information are top priorities”, and told AFP it is cooperating fully.

The three things the Commission will investigate

AreaWhat the Commission will checkDSA ruleWhy it matters to small hosts
1. Fraudulent and non-compliant listingsFake listings for non-existent properties, impersonation fraud, non-compliant offers, and how fast they are removedArt. 34 and 35 (risk assessment and mitigation)Fake copies of real properties take bookings and trust away from honest hosts
2. Phishing using reservation and guest dataHow guest data is shared with accommodation providers, how the messaging service works, and safeguards against fraudulent payment requestsArt. 34 and 35Your extranet login and guest chat are the doors scammers use
3. Paid “boosted” listingsWhether listings boosted by a higher commission are clearly shown as ads, with who paid and why a user sees themArt. 26(1) (ad transparency)Paid visibility you buy may have to carry an ad label
Source: European Commission, IP/26/2223, 21 October 2026. Status: the DSA rules are Adopted law; the breaches are only suspected. Opening proceedings “does not prejudge any final outcome”, the Commission says.

Why phishing is the part that hits hosts hardest

The scam usually starts with the host, not the guest. Criminals send phishing emails or malware to accommodation providers and take over their Booking.com extranet account. Spain’s national cybersecurity centre INCIBE-CERT explains why that is so valuable: anyone holding the extranet login can read the bookings and message guests through the platform’s own chat. INCIBE says fraudulent messages to guests using real booking data increased during 2026.
The guest then receives a message with their real dates, names and price, asking them to “confirm” the booking or pay again through a link. According to the Dutch Fraudehelpdesk, 95% of the booking-site phishing reports it received in the first half of 2026 came via WhatsApp, and many messages contained detailed information about an existing reservation. It links the trend to data breaches that give scammers more personal details.
For a small host, the damage is double: the guest loses money, and you get the angry message, the bad review and sometimes the cancelled stay. That is why the Commission’s focus on how guest data is shared with accommodation providers and on the design of the messaging service matters to you, even though the case is against Booking.com and not against hosts.

Boosted listings: will paid visibility need an ad label?

The third strand is about money many hosts already spend. The Commission says accommodation providers “can make their listings more visible in Booking.com’s search results by paying a higher commission”, and users should be able to recognise these “boosted listings” as advertisements. The press release does not name a programme, but Booking.com sells this kind of visibility in several ways:
Booking.com optionWhat you giveWhat you get, per Booking.com
Preferred Partner ProgrammeA small increase in commission; needs a performance score of at least 70% and a review score of at least 7/10, checked every 90 daysA badge and more exposure in search; Booking.com claims 65% more search views and 20% more bookings
Visibility BoosterYou choose check-in dates, a target country and a commission rate on a sliderA higher ranking and visibility for short periods
GeniusDiscounts for Genius members rather than extra commissionA better ranking, according to Spain’s competition authority
Sources: Booking.com partner help pages on the Preferred Partner Programme, Visibility Booster and commission (accessed 26 October 2026); CNMC (Genius). Booking.com does not publish the percentage added on top of your base commission.
Under DSA Article 26(1), every ad on a platform must show, clearly and in real time, that it is an ad, on whose behalf it is shown, who paid for it and why the user sees it. If the Commission finds that boosted listings are ads, the likely result is labels, not a ban. But a visible “ad” or “sponsored” tag could change how guests click on paid listings, and so how much the extra commission is worth to you.
This is not the first time regulators have questioned these programmes. When Spain’s competition authority fined Booking.com €413.24 million on 30 July 2024, it criticised “insufficient transparency” on the cost-effectiveness of the Preferred, Preferred Plus and Genius programmes, which improve ranking in exchange for a higher commission or discounts. Spain’s national court suspended the fine while it hears Booking.com’s appeal, Hosteltur reported in March 2025.

Where this fits: Booking.com’s other EU rules

Booking.com is also a “gatekeeper” under the Digital Markets Act since 13 May 2024. A Commission DMA factsheet of 28 September 2026 says Booking.com removed its contractual price parity rules in July 2024, including as a condition for Genius, Preferred and Preferred Plus in the EEA, so you are free to offer lower prices on your own website. It also says Booking.com will update the ranking annex of its terms “later this year”.
And it is part of a wider push on online marketplaces. The Commission fined Temu €200 million under the DSA on 28 May 2026, its first DSA fine for a marketplace, and opened proceedings against Shein on 17 February 2026. Under the DSA, fines can reach 6% of a platform’s worldwide annual turnover. The Commission can also order interim measures or accept commitments from Booking.com to settle the case.
For you, the practical point is that Booking.com’s rules for partners could change during the investigation: how guest contact details are shared, what links can go through the chat, and how paid visibility is shown. Other platforms are changing their terms too; see our report on fake countdown timers and hidden fees for how regulators treat pressure tactics on booking and shop pages.

What this means for you

You don’t need to wait for Brussels. If you host guests through Booking.com or any other platform, do these this week.
  1. Lock your extranet account. Turn on two-factor login for the Booking.com extranet and for the email address behind it. Give each person their own login, and remove former staff or cleaners. Our guide to cybersecurity essentials for non-technical founders covers passwords, devices and phishing in plain English.
  2. Control links in the guest chat. Booking.com’s messaging security settings let account admins approve links or block all links to guests; changing them requires two-factor login. Check your payout bank account details too.
  3. Warn your guests before they arrive. Add one line to your confirmation and house rules: you will never ask for card details or a new payment by chat, WhatsApp or link. Clear, early messages are part of good customer service on a small budget.
  4. If you are hacked, act fast. INCIBE-CERT advises changing your platform and email passwords from a trusted device, closing open sessions, turning on two-factor login, checking users, message templates and bank details, and warning affected guests. Guest data is personal data, so check your duties under the GDPR rules for small companies.
  5. Check what your paid visibility costs. Look up the extra commission you pay for Preferred or Visibility Booster on your invoices and compare it with the extra bookings. If boosted listings get an ad label, re-test whether it still pays. Our guide to pricing psychology and strategy helps you think about margins.
  6. Build a direct channel. Since price parity is gone in the EU, you can offer a better rate to returning guests who book directly. If you are still choosing a rural or hospitality idea, see our list of small business ideas for rural Europe, starting with farm stays.
Running a small hospitality business, or planning one?

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder, so you can practise pricing, sales channels and customer trust before real money is at stake.

👉 Start the game

What to watch next

  • More information requests, interviews or inspections: the Commission says it will investigate “as a matter of priority”, but sets no deadline.
  • Commitments from Booking.com: the company can offer changes, for example to ad labels or guest-data sharing, to settle the case. Changes like these would reach hosts through new partner terms.
  • Booking.com’s new ranking terms: the DMA factsheet says the ranking annex will be updated later in 2026.
  • Spain’s court ruling on the €413.24 million fine, still under appeal.

FAQ: the EU investigation into Booking.com

Why is the EU investigating Booking.com?

On 21 October 2026 the European Commission opened formal proceedings under the Digital Services Act. It is checking whether Booking.com does enough against fake and non-compliant listings and phishing scams that use reservation and guest data, and whether listings boosted by a higher commission are clearly labelled as ads.

Has Booking.com been fined?

Not under the DSA. Opening proceedings does not prejudge the outcome, and there is no deadline. If breaches are proven, DSA fines can reach 6% of worldwide annual turnover. Spain fined Booking.com €413.24 million in 2024 under competition law, but a court suspended that fine pending appeal.

Does the investigation affect hosts and small accommodation providers?

Not directly; the case is against the platform. But it could change how Booking.com shares guest data with hosts, how its messaging service works and how paid visibility such as Preferred Partner or Visibility Booster is shown.

What are Booking.com boosted listings?

Listings that rank higher because the accommodation provider pays more, for example through a higher commission. Booking.com sells this through programmes such as Preferred Partner and Visibility Booster. The Commission wants to know if users can recognise them as ads.

How do Booking.com phishing scams work?

Criminals usually take over a host’s extranet account through phishing or malware, then message guests with real booking details and a link asking them to confirm or pay again. The Dutch Fraudehelpdesk says 95% of such reports in early 2026 came via WhatsApp.

How can I protect my Booking.com extranet account?

Turn on two-factor login for the extranet and your email, give each person their own login, remove old users, use the messaging security settings to block or approve links, never share a 2FA code or password, and tell guests you never ask for payments by chat.
2026-10-26 05:23 Startup News and Trends