--- title: "Booking under investigation: preventing fraud requires verifiable controls" description: The European Commission investigates Booking.com for potential DSA breaches, focusing on fraud prevention and the security of guest data. image: https://blog.isecauditors.com/hubfs/booking-under-investigation.png --- English - [Spanish](https://blog.isecauditors.com/booking-bajo-investigacion-prevenir-el-fraude-exige-controles-verificables) - [English](https://blog.isecauditors.com/en/booking-under-investigation-preventing-fraud-requires-verifiable-controls) [![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png) ![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png)](https://blog.isecauditors.com/?hsLang=en) - [← www.isecauditors.com](https://www.isecauditors.com/) - [academy.isecauditors.com](https://academy.isecauditors.com/) - [← www.isecauditors.com](https://www.isecauditors.com/) - [academy.isecauditors.com](https://academy.isecauditors.com/) [API Testing](https://blog.isecauditors.com/en/tag/api-testing) [Security Audits](https://blog.isecauditors.com/en/tag/security-audits) [Social Engineering](https://blog.isecauditors.com/en/tag/social-engineering) # Booking under investigation: preventing fraud requires verifiable controls [Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar) Oct 21, 2026, 3:03:45 PM Madrid, 21 October 2026. The European Commission has opened formal proceedings to assess possible breaches of the Digital Services Act (DSA) by Booking.com. It will examine fraudulent listings, phishing scams exploiting reservation and guest data, and the identification of paid promoted listings. This is an ongoing investigation into possible infringements. \[1–3\] The inquiry includes how data is shared with accommodation providers and how messaging operates. Booking has said it is cooperating with the Commission. For hotels, agencies and platforms, the news reinforces the need to review access, suppliers and payment processes, alongside reporting and response mechanisms. \[2–3\] At Internet Security Auditors, we stress that knowing a reservation’s dates or price does not establish a message’s legitimacy. We recommend confirming unexpected payment requests through an independent channel, obtained from a verified source, and checking them against the booking terms. Urgent requests for card details or threats of cancellation warrant additional verification. \[4\] Organisations should enable multifactor authentication, restrict access to guest data and review staff and third-party accounts. Reservation and reception teams need training, payment-change processes should be tested, and logs should support investigations into suspicious access or messages. These measures should be tested and reviewed periodically. \[5\] At  Internet Security Auditors, we assess these risks through web application and API audits, authorised penetration testing and social engineering assessments. We complement this work with training and consultancy on data protection and risk management, turning findings into actions, accountable owners and evidence. The aim is to improve security throughout the process, from supplier access to customer communications and payment. \[6–8\] [![CTA-audits-hacking-social-engineering-testing](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/CTA-audits-hacking-social-engineering-testing.png?width=900&height=382&name=CTA-audits-hacking-social-engineering-testing.png)](https://www.isecauditors.com/en) ![booking-under-investigation-reservations-data-and-fraud](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/booking-under-investigation-reservations-data-and-fraud.png?width=900&height=419&name=booking-under-investigation-reservations-data-and-fraud.png) Referencias \[1\] European Commission — Formal DSA proceedings concerning Booking.com (21 October 2026) [https://digital-strategy.ec.europa.eu/en/news/commission-investigate-how-bookingcom-combats-scams-and-fraud-under-digital-services-act](https://digital-strategy.ec.europa.eu/en/news/commission-investigate-how-bookingcom-combats-scams-and-fraud-under-digital-services-act) \[2\] El País — Coverage of the proceedings and their scope (21 October 2026) [https://elpais.com/economia/2026-10-21/bruselas-sospecha-que-booking-no-hace-lo-suficiente-para-vigilar-los-fraudes-en-las-reservas-y-los-datos-de-los-clientes.html](https://elpais.com/economia/2026-10-21/bruselas-sospecha-que-booking-no-hace-lo-suficiente-para-vigilar-los-fraudes-en-las-reservas-y-los-datos-de-los-clientes.html) \[3\] Reuters — Investigation into fraudulent listings and phishing scams (21 October 2026) [https://www.reuters.com/business/media-telecom/bookingcom-targeted-eu-investigation-into-phishing-scams-fraudulent-listings-2026-10-21/](https://www.reuters.com/business/media-telecom/bookingcom-targeted-eu-investigation-into-phishing-scams-fraudulent-listings-2026-10-21/) \[4\] Booking.com — Traveller safety advice: payment requests and suspicious messages [https://www.booking.com/trust\_and\_safety/travellers.en-gb.html](https://www.booking.com/trust_and_safety/travellers.en-gb.html) \[5\] Booking.com — Partner safety advice: account protection and two-factor authentication [https://www.booking.com/trust-and-safety/partners.en-gb.html](https://www.booking.com/trust-and-safety/partners.en-gb.html) \[6\] Internet Security Auditors —  API Audits [https://isecauditors.com/en/api-audit](https://isecauditors.com/en/api-audit) \[7\] Internet Security Auditors— Social Engineering Assessments [https://www.isecauditors.com/en/social-engineering-test](https://www.isecauditors.com/en/social-engineering-test) \[8\] Internet Security Auditors— GDPR Consultancy [https://isecauditors.com/en/gdpr-consulting](https://isecauditors.com/en/gdpr-consulting) - [Tweet](https://twitter.com/share) --- ![author-image](https://blog.isecauditors.com/hubfs/Logo_isecauditors_contraccion_HP.png) [Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar) PCI SSA, PCI QSA, CISSP, CSSLP, ISO 27001 L.A., CSFPC, SFPC Security Consultant Consulting Department --- [Legal Notice](https://www.isecauditors.com/aviso-legal) [Policy Privacy](https://www.isecauditors.com/politica-privacidad) [Cookie Policy](https://www.isecauditors.com/politica-cookies) --- Copyright © 2026 - All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Alberto Villar Arévalo", "url" : "https://blog.isecauditors.com/en/author/alberto-villar" }, "dateModified" : "2026-10-21T13:03:45.559Z", "datePublished" : "2026-10-21T13:03:45.000Z", "headline" : "Booking under investigation: preventing fraud requires verifiable controls", "image" : [ "https://blog.isecauditors.com/hubfs/booking-under-investigation.png" ], "mainEntityOfPage" : { "@id" : "https://blog.isecauditors.com/en/booking-under-investigation-preventing-fraud-requires-verifiable-controls", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.isecauditors.com/hubfs/isec_logo.png" }, "name" : "Internet Security Auditors, S.L." } } ```