Booking.com faces EU probe over fake hotels and hijacked bookings

The case

The European Commission has launched a formal investigation into Booking.com, the world's largest hotel booking platform, over allegations that it has failed to protect users from fraud ^[1]. The probe follows reports of fake hotel listings, account takeovers that let fraudsters change booking details and misleading advertisements ^[2].

Booking.com, which is owned by Booking Holdings Inc., could face fines of up to 6% of its global annual turnover if the Commission finds it has breached the Digital Services Act ^[1]. For a company that reported €21.4 billion in revenue in 2023, that works out at roughly €1.28 billion, or about 15 billion Swedish kronor ^[3].

The investigation centres on three claims: that scammers have listed fake hotels on the platform, that criminals have hijacked customer accounts to redirect bookings and payments, and that the platform's design and recommendation algorithms may amplify misleading offers ^[2].

What the Digital Services Act requires

The Digital Services Act has applied to very large online platforms since 25 August 2023 ^[4]. It requires platforms to put systems in place to identify and mitigate risks, act swiftly when they become aware of illegal content, and design their services to prevent harm ^[4].

Think of it like the difference between a hotel that hires security and one that doesn't: the law doesn't expect zero crime, but it does expect reasonable measures to stop it happening and a plan for when it does.

Platforms must also keep records of how they handle content moderation decisions and complaints, and hand them over to authorities on request ^[4]. For Booking.com, that means the Commission will want to see what the company knew about fraudulent listings, when it knew it and what it did about it.

Breaches can lead to fines of up to 6% of worldwide annual revenue, and in serious or repeated cases the Commission can ban the platform from operating in the EU for up to six months ^[4].

The evidence question

When a platform is accused of not doing enough to stop fraud, the argument turns on what it knew and when. Did a listing exist? When was it reported? What action was taken, and by whom?

Those questions can only be answered with records: reports from users, internal notes on investigations, decisions to remove or keep a listing, and logs of when changes were made. The Commission will ask for them, and Booking.com will need to show they haven't been tidied up after the fact.

A platform that can demonstrate a clear timeline—this listing was reported on this date, reviewed by this team, and removed within X hours, with each step logged—is in a stronger position than one that has to reconstruct events from memory or incomplete records.

What the probe will look at

The Commission has said it will examine three areas ^[2].

First, whether Booking.com has effective systems to detect and remove fake listings before they reach customers. A scammer who lists a hotel that doesn't exist, collects payment and disappears causes direct financial harm, so the question is whether the platform's checks are good enough.

Second, whether account security is adequate. If a criminal takes over a customer's account and changes the booking details to redirect payment, the platform needs to spot that quickly. The DSA doesn't say how, but it does say the risk must be managed ^[4].

Third, whether the platform's design—its search results, recommendations and ranking—makes misleading offers more visible. If an algorithm pushes listings with inflated discounts or fake urgency messages to the top, that's a design choice, and under the DSA it's one the platform is responsible for ^[4].

A record of what the platform knew

When a supervisor asks what a platform knew and when, the answer depends on what was recorded and whether that record can be trusted.

Here, the thing to seal is each moderation decision as it is made: the listing reference, the complaint or flag that triggered the review, the decision (remove, keep or escalate), the reviewer and the timestamp. Sealing takes a fingerprint of the record, not the content, so the decision itself never leaves the platform's systems. If a regulator questions the timeline a year later, anyone the platform shares the record with can check that it is exactly what was written on the day.

Who can check it? The platform's own compliance team, external auditors, the Commission and, if it reaches court, a judge.

What it shows is that a record of a decision existed at a particular time and has not been altered since. What it doesn't show is that the decision was right, that the review was thorough or that every fraudulent listing was caught. It is a record of what was done, not proof that it was enough.

You can start by sealing moderation logs with WitniumChain through the REST API, the SDK or the MCP server. The content stays with you; only a fingerprint is sent. The first 2,000 seals a month are free. Read how it works in the documentation.

How it would work

1. Each time a listing is flagged, reviewed or removed, the platform writes a record.
2. A fingerprint of that record is sealed, with a timestamp, on a chain where changes show.
3. To check, the regulator or auditor calculates the fingerprint again and compares it with the sealed version.

What this means for you

If you run a platform, marketplace or any service where users post content or make bookings, ask yourself:

• Could you show a regulator which reports you received last month, and what you did with them?
• If a fraudulent listing slipped through, could you explain when it appeared, when it was reported and why it wasn't removed sooner?
• Are your moderation records kept in a way that would hold up if someone questioned them six months later?

The DSA doesn't prescribe the technology, but it does expect you to keep records and hand them over when asked ^[4]. A log that your own team could quietly edit is easier to challenge than one with an independent check.

What to watch

The Commission's investigation is ongoing, with no set deadline for a decision ^[2]. If it finds a breach, Booking.com will have a chance to respond before any fine is imposed.

The case is one of several DSA probes the Commission has opened into large platforms, including earlier investigations into TikTok, X and AliExpress ^[1]. The first fines under the DSA have not yet been issued, so the Booking.com case may set a precedent for how seriously the Commission enforces the platform duties.

For now, the question is what records Booking.com can produce and whether they will be enough to show it did what the law required.