What Should Happen in the First...
When a fraud incident crosses an organisation’s escalation threshold, the first hour can be critical. This article looks at how...
Read More
Online platforms create trust. When a customer books accommodation through a well-known travel website, buys from an established marketplace or communicates with a business through a recognised platform, that environment itself provides reassurance. Customers reasonably assume that the organisations and information they encounter have passed some level of scrutiny. Fraudsters understand the value of that trust too.
On 21 October 2026, the European Commission opened formal proceedings to assess whether Booking.com may have breached its obligations under the Digital Services Act (DSA) in relation to fraudulent accommodation listings, phishing scams and the transparency of paid-for listings.
The Commission has not concluded that Booking.com has broken the law. The investigation will examine whether the company sufficiently assessed and mitigated systemic risks associated with fraud on its platform. Booking.com has said it is cooperating constructively with the Commission and that security, trust and the protection of personal information remain priorities.
For organisations operating online platforms, marketplaces, customer portals or other digital ecosystems, the investigation raises a broader governance question: when criminals exploit the trust created by your service, how far does your responsibility extend?
The Commission’s investigation focuses on three areas.
First, it will examine fraudulent and non-compliant accommodation listings. These can include properties that do not exist or listings designed to persuade customers to pay for accommodation they will never receive.
Second, regulators are examining phishing scams that exploit reservation and guest information. These attacks can be particularly convincing because criminals may possess genuine details about a customer’s booking, including the accommodation, travel dates and price. That information can then be used to create urgent messages claiming that a payment has failed or that a booking will be cancelled unless new payment details are provided.
Finally, the Commission is investigating whether accommodation providers that paid to receive higher positions in Booking.com search results were always clearly identifiable as advertisements.
The proceedings follow earlier requests for information issued by the Commission, including a September 2025 request asking Booking.com how it identified and managed risks relating to fraudulent accommodation listings and how it verified businesses using its service.
Booking.com is designated as a Very Large Online Platform under the DSA, meaning it is subject to additional obligations around systemic risk assessment and mitigation. The Commission can ultimately impose fines of up to 6% of global annual turnover where a breach of the DSA is established, although no such finding has been made in this case.
One of the most significant lessons from travel-booking scams is that fraud becomes much harder to identify when it contains genuine information.
Booking.com itself warns customers about phishing messages that appear to come from accommodation providers or Booking.com and contain convincing details about the dates and cost of an upcoming stay. Fraudsters may then create urgency by claiming that payment details need to be resubmitted to prevent the reservation from being cancelled.
A generic message saying, “Your hotel booking has failed, please enter your card details” may immediately appear suspicious. A message referencing the correct hotel, dates, price and customer name is far more persuasive.
Organisations can therefore no longer rely on customers identifying scams because the communication contains obvious mistakes. When criminals obtain genuine contextual information, they can borrow some of the credibility of the organisation or platform they are impersonating.
Fraud occurring around an online platform does not necessarily mean the platform’s central infrastructure has been compromised.
The wider ecosystem may include hotels, property owners, suppliers, customer accounts, APIs, payment providers, communications services and employee devices. A compromise affecting one participant can give an attacker information or access that allows them to impersonate another trusted participant.
This principle applies well beyond travel. A bank may have highly secure infrastructure while customers are targeted through compromised merchant accounts. A retailer may protect its website while criminals impersonate suppliers. A professional services company may be secure while an attacker compromises a client account and uses genuine correspondence to target employees.
The organisation operating the platform may not control every component of that environment, but it can influence how difficult it is for criminals to exploit it.
The European Commission’s wider work on online financial scams identifies several controls that platforms can use to mitigate fraud. These include stronger identity and business verification, automated and human detection mechanisms, accessible reporting tools, effective redress processes and cooperation with other organisations.
The first stage is deciding who is allowed onto the platform. Know Your Business Customer controls can help identify suspicious organisations before they interact with users. This does not eliminate fraud, because legitimate businesses can themselves be compromised, but effective onboarding reduces the opportunity for criminals to create entirely fraudulent entities.
Detection then becomes important once the service is operating. Platforms can monitor for unusual behaviour, repeated complaints, sudden changes in account activity, suspicious payment requests and other indicators that an account may be being misused.
Customer reporting is another valuable source of intelligence. If several users report receiving similar payment demands from the same property account, that information needs to reach fraud and security teams quickly enough for the pattern to be identified and investigated.
No single control will prevent every incident. Effective fraud prevention depends on multiple layers making exploitation progressively more difficult.
Booking.com provides advice to travellers, including warnings not to provide payment information through unsolicited messages, to verify suspicious requests, to use two-factor authentication and to contact customer services where something appears unusual.
Education matters, but there is a limit to how much responsibility organisations can place on customers to distinguish increasingly sophisticated fraud from genuine communications, particularly when criminals have access to information that would normally be expected to be private.
Customer awareness should therefore support effective technical and organisational controls, rather than replace them.
The same principle applies internally. Organisations would not normally rely on employee phishing training as their only defence against account compromise. They combine training with MFA, filtering, monitoring, access controls and incident response. Fraud controls should follow the same defence-in-depth approach.
The Booking.com investigation also demonstrates how closely fraud, cyber security and data protection can be linked.
An attacker might begin by compromising a hotel employee’s account through phishing, creating a cyber security incident. They may then obtain guest information, creating a potential personal data breach. That information can subsequently be used to send convincing fraudulent payment requests.
For the victim, these are not three separate problems. They are one chain of events. Yet many organisations still manage them through separate teams, reporting lines and systems.
Cyber security may investigate the compromised account, data protection may assess whether regulatory notification is required, fraud teams may examine financial losses and customer services may receive complaints. If those teams do not share information effectively, each may see only one part of the attack.
Strong fraud governance therefore requires organisations to connect these signals. A small cyber event may become significant when combined with fraud reports, while a customer complaint may provide the first evidence of compromised credentials.
Brand reputation is often considered something that suffers after fraud, but it can also be what makes fraud successful in the first place.
Criminals impersonate banks, technology companies, delivery firms, employers, suppliers and government departments because familiarity lowers suspicion. The same principle applies to trusted platforms.
This means brand trust should form part of the fraud threat model. Organisations should understand how their names, domains, accounts and communication channels may be abused and have clear procedures for identifying and disrupting impersonation.
The Commission’s investigation into Booking.com is not limited to scams. It also concerns listings where accommodation providers reportedly paid for higher ranking in search results and whether those placements were sufficiently identifiable as advertising.
Although this may appear separate from fraud, the underlying issue is similar: users need to understand why they are seeing what they are seeing.
Under the DSA, advertising on online platforms is subject to transparency requirements. Very Large Online Platforms also need to assess systemic risks arising from aspects of their services, including advertising and recommender systems.
Trust therefore depends not only on preventing outright fraud, but also on ensuring the design of a service does not give users a misleading impression about how information has been selected or prioritised.
One of the important principles behind the DSA is that large platforms should consider not only how their services are intended to work, but also how those features may be deliberately manipulated.
A messaging system can help customers communicate with businesses, but it can also provide criminals with a trusted channel for phishing. An advertising platform can help businesses reach customers while also being misused to distribute fraudulent investments. A marketplace can connect legitimate sellers with buyers while providing scammers with access to potential victims.
This does not mean a platform operator is automatically responsible whenever a criminal misuses its service. It does mean foreseeable abuse should form part of the organisation’s risk assessment, and where patterns repeatedly emerge, controls should evolve in response.
The Booking.com investigation may concern one of the world’s largest travel platforms, but the underlying governance principles apply much more widely.
Any organisation that connects third parties with customers creates some form of trust relationship. This includes payment firms, online marketplaces, recruitment platforms, professional networks, property websites, financial services, software marketplaces and business-to-business portals.
Leadership teams should understand how third parties are verified before joining the ecosystem, how suspicious activity is detected afterwards, how customers can report suspected fraud and how information moves between fraud, cyber security, privacy, compliance and customer-service functions.
Organisations should also consider whether legitimate features create unexpected attack paths. The question is not simply whether a system works as designed, but whether that design could be manipulated in a predictable way by someone with malicious intent.
The European Commission’s investigation into Booking.com is still at an early stage. Opening formal proceedings does not mean that the company has breached the Digital Services Act, and the evidence will need to be examined before the Commission reaches any conclusion.
The case is nevertheless significant because it reflects a wider shift in the expectations placed on major digital platforms.
Fraud is increasingly being treated not simply as something criminals do to users, but as a systemic risk that organisations should actively assess and mitigate where their services create opportunities for fraud to occur.
That does not make platforms responsible for every scam. It does mean that scale, reach and the trust created by a service bring greater responsibility for understanding how that service can be misused.
Fraud prevention should therefore begin long before a victim reports losing money. It should form part of the way platforms, processes and customer journeys are designed.
AJC helps organisations understand and strengthen their approach to fraud risk, governance and prevention.
Our Fraud Risk Consultancy team can support businesses with fraud risk assessments, governance frameworks, policies and procedures, control reviews, scenario testing and remediation. We can also help organisations assess how fraud risks interact with cyber security, data protection, third-party relationships and customer-facing processes.
For businesses operating platforms, marketplaces or digital services, this can include reviewing onboarding and verification controls, identifying potential fraud scenarios, assessing escalation and reporting arrangements, and helping teams understand where gaps may exist across the wider ecosystem.
Contact AJC on 020 7101 4861 or email info@ajollyconsulting.co.uk to discuss how we can help strengthen your organisation’s fraud governance and controls.
Sources:
https://digital-strategy.ec.europa.eu/en/faqs/digital-services-act-questions-and-answers
https://eur-lex.europa.eu/eli/reg/2022/2065
https://www.booking.com/trust_and_safety/travellers.en-gb.html
Image accreditation: Booking.com HQ from Wikimediacommons (2023). Last accessed on 3 November 2026. Available at: https://commons.wikimedia.org/wiki/File:Kantoorgebouw_van_Booking_dot_com.jpg
When a fraud incident crosses an organisation’s escalation threshold, the first hour can be critical. This article looks at how...
Read More
October is Cyber Security Awareness Month, making it a good time for organisations to consider how their defences would perform...
Read More
The recent Google Cloud outage disrupted organisations across multiple sectors and highlighted the risks created by reliance on shared technology...
Read More