The EU says Booking.com may not do enough against scams. Hotels have already felt what it did.
On October 21 the EU opened its first Digital Services Act case against Booking.com, and a Commission official called what it has done against scams "absolutely substandard"
by Markus Busch
Driving the news. The European Commission opened formal proceedings against Booking.com on October 21, its first case against the platform under the Digital Services Act, the EU's rulebook for large online platforms. The Commission lists three areas: fraudulent listings, phishing scams that use Booking.com's reservation and guest data, and paid listings that are not clearly marked as ads.
In its announcement, the Commission adds that it is looking at how reservation and guest data is shared with accommodation providers, and at how Booking.com's messaging service is designed and run.
A Commission spokesperson described the scam to The Register in plain terms. Criminals take over a property's Booking.com account, take over the contact details with it, and message guests that they need to pay more. An unnamed Commission official, speaking in the same briefing, said: "we feel that what they have done is absolutely substandard." A second official said Booking.com's own risk assessment was not sufficient and that the company could go much further.
The third area concerns hotels that pay for a higher spot in Booking.com's results. The Commission suspects those listings were not clearly labeled as ads.
Booking.com's answer. Booking.com says it is cooperating fully and that security, trust and the protection of personal information are top priorities.
What it already did. The measures exist, and hotels are working with them now. Since September 28, Booking.com no longer sends guest phone numbers to any hotel's PMS, channel manager or messaging tool. The number still shows in the Extranet, booking by booking. Booking.com told its partners why: scammers have been sending travelers WhatsApp and text messages that quote real booking details and push them to pay urgently to keep their room. A phone number that never leaves Booking.com can't be stolen from a hotel's system.
Messages that do go out pass two checks. Booking.com strips any link the hotel hasn't approved in its messaging settings, and it blocks mail from sending addresses the hotel hasn't registered. A payment link from a stranger has a harder time reaching a guest. So does a hotel's own check-in link, until someone approves it.
The catch. Opening proceedings is not a finding. The Commission has not said Booking.com broke the law, and there is no deadline for the case. If it does find a breach, fines can reach 6 percent of global annual turnover, and Booking.com can offer changes along the way to settle the Commission's concerns. The two officials quoted are not named.
Nothing on record ties the September 28 change to this case. Booking.com made it three weeks earlier and gave fraud as the reason.
And the fixes have a cost that lands at the hotel, not in Brussels. A WhatsApp welcome set to go out to every Booking.com guest now finds no number and doesn't go.
What it means for hotels. Two parts of this case sit at your front desk. One is the guest details that come with a Booking.com reservation. The other is the Booking.com inbox you use to write to your guests.
Booking.com has already changed the first one. Since September 28, the guest details arrive without a phone number, for every hotel, after one notice to the software companies. Anything it offers Brussels to settle the case will land in the same two places: in what arrives with the booking, and in what your messages are allowed to carry.
The Commission named the messaging service.
Booking.com's statement named no fix.
Read also: Everything the OTA sends you about your guest expires
Enjoying this analysis? Hospitality.today delivers daily insights on hotel distribution, AI trends, and travel commerce — straight to your inbox. Subscribe for free at Hospitality.today →