You get a message the night before a trip. It looks like it's from your hotel. There's a problem with your payment, it says, and here's a link to fix it. Messages like that are part of what Europe is now asking Booking.com about. On Wednesday, Oct. 21, the European Commission said it's looking into the site over fake listings and phishing. Phishing means fake notes built to steal a login or a card. Edith Hancock reported it in the Journal.
The commission is the EU's executive arm. Its worry is that the site's defenses against fraud and scams fall short. The case runs under the Digital Services Act, a 2022 EU law aimed at a wide set of online harms. Breaking it can be costly. The fine can run as high as 6% of a company's yearly sales worldwide.
The commission named two questions. The first is how Booking.com spots and weighs the risk of fake listings, and how it keeps them off users' screens. The second is how reservation and guest details get passed to the hotels and rentals on the site. That second question matters for the message at the top of this story. A scammer who can see your booking can write a very convincing note.
What the company says
Booking.com says it's cooperating fully. It says it wants to work with regulators and police to fight online fraud and cybercrime. The parent, Booking Holdings (BKNG), closed at $158.38 on Wednesday, down $5.54. On Thursday it closed at $161.10, up $2.72. The story names no U.S. action. The safe way to book is the same on any site.
Our read
Insurance and Consumer Protection, M11. We don't own Booking Holdings in any book. The planning point is the way you book. Booking scams tend to run one of two ways. The listing looks real, the photos are stolen, and the price is a little too good. Or the listing is real and the message isn't. Someone who knows your name, your dates and your hotel sends a note about a payment problem. The link leads to a page that takes your card. The platform's own checkout is your moat. The moment someone asks you to pay outside it, by link, by wire or by gift card, you've left the moat.
Here's the connection to your own money. The next trip in your calendar touches this story. This week, open that reservation in the app, never from a message link, and write down the property's direct phone number from its own website. If a payment note arrives, call that number before you click anything. Pay with a credit card, because dispute rights are generally stronger than on a debit card. And turn on two-step login for the booking account, since a stolen login is how a scammer learns your dates. You check the locks before you leave the house, and you check the link before you pay. If you'd like a quick checklist for the family's travel accounts, bring it to your next review.