On 21 October 2026 the European Commission opened formal proceedings against Booking.com under the Digital Services Act, the first such investigation into the travel platform. The Commission will assess whether the company failed to diligently assess or effectively mitigate risks related to fraudulent listings and phishing scams, and whether it breached transparency rules by not clearly labeling as advertisements the listings whose providers paid for a higher ranking in search results.
Why a platform probe is an email story
The second focus of the investigation matters most to anyone who runs email. The Commission is examining phishing scams that exploit Booking.com’s reservation and guest data, and how that data is shared with accommodation providers. A senior EU official quoted by AFP said regulators suspect the platform is not sufficiently protecting the data of private and business users, which “makes the system vulnerable for this kind of phishing.”
That is the mechanics of modern phishing in one sentence. A scam email that knows your booking reference, your dates, your hotel name and your full name does not need to be clever, it just needs to arrive. When reservation data leaks or flows too freely, attackers get the raw material for messages that look exactly like the real thing, down to payment demands sent hours before check-in.
What regulators said
The three areas of the investigation are fraudulent and non-compliant listings, phishing scams exploiting reservation and guest data, and paid-for boosted listings not clearly identifiable as advertisements. EU tech chief Henna Virkkunen said Europeans should be able to book their holidays without fear of being scammed. Booking.com said it is cooperating fully and that security, trust and the protection of personal information are top priorities. As a very large online platform it faces DSA fines of up to six percent of global turnover, and even a ban for serious and repeated breaches. There is no legal deadline for concluding the probe.
The lesson for every sender
The case is about a travel platform, but the underlying failure mode is universal. When your brand name is used in messages you did not send, your customers blame you, not the attacker. The defenses are the same whether you run a marketplace, a bank or a bakery. Authenticate every legitimate source with SPF, DKIM and DMARC, move your DMARC policy from p=none to quarantine and then reject so forged mail actually gets stopped, read your aggregate reports to see who is failing authentication as you, and lock down how customer data flows to partners and third parties. A DMARC record that only monitors while attackers exploit your customer data is an alibi, not a defense.
If a brand as large as Booking.com now has to answer to regulators for how phishing abuses its data, the question for your organization is simple. Do you know who is sending email as your domains today, and does your policy reject it? Excello Mail maps every sending source for you and takes your domains to p=reject without breaking legitimate mail. Sign up for free to Excello Mail and see what your DMARC reports have been trying to tell you.