Booking.com faces a new EU investigation: what travellers should preserve when a reservation becomes a scam

An investigation, with no finding yet

On 21 October 2026, the European Commission opened formal proceedings concerning Booking.com under the Digital Services Act. The announced concerns include fraudulent or unlawful listings, phishing involving reservation information, and whether paid visibility is identified transparently. Opening proceedings means the regulator is examining possible breaches; it does not establish that every allegation is proven.

For travellers, including people arranging accommodation before relocating to Georgia or another country, the practical issue is how to document the transaction and identify the responsible parties. A regulatory investigation can examine platform systems, while an individual dispute may turn on a particular listing, payment, cancellation clause or misleading message.

Three legal relationships can overlap

A booking can involve the accommodation provider’s obligations, the platform’s own service and information duties, and the payment provider’s rules for a disputed transaction. Those relationships should be examined separately. The company whose name appears on a card statement may not answer every question about who promised the room or sent a suspicious request.

For example, a message that correctly names the hotel and arrival date can still lead to a fraudulent payment page. Preserve the original communication and verify a new payment request through an independently accessed official channel. Accurate reservation details make the message persuasive; they do not establish that the payment destination is authorised.

What the DSA can contribute

The Digital Services Act establishes duties for online intermediary services, with additional obligations for very large platforms. The Commission’s inquiry concerns the platform’s management of risks and transparency. It is therefore different from a court deciding whether a particular guest is owed compensation under a booking contract.

The Commission’s guide to DSA user rights explains mechanisms including reporting illegal content, complaints to the relevant Digital Services Coordinator and seeking compensation for damage caused by a DSA infringement. Those routes have conditions. Article 54 is not an automatic payment scheme triggered by the announcement of an investigation.

Cross-border scope needs a factual check

A Georgian passport or Georgian bank account alone does not determine which consumer law or court will govern a dispute. Relevant facts include where the service is offered to the recipient, the contracting entities, residence, the accommodation location and the contract. The DSA’s EU territorial scope should be assessed before assuming that every booking worldwide carries identical remedies.

The same caution applies to deadlines. A bank’s dispute window, a contractual complaint process and a court limitation period can run independently. Waiting for the Commission to conclude its proceedings may leave an individual traveller with less time to pursue another available remedy.

Create an evidence file while records are available

• Save the listing, booking confirmation, price breakdown and cancellation terms.
• Keep messages, sender details, suspicious links and payment records without redistributing personal data unnecessarily.
• Report the incident through the platform’s official channel and obtain a reference.
• Ask the payment provider promptly about the applicable dispute process.

Record the requested outcome precisely: restoring a reservation, removing a false charge, recovering a payment or correcting a misleading listing. Keep each response with its date. Our analysis of phishing and payment disputes explains why payment authorisation and fraud allegations require their own evidence.

The legal value of the October announcement is that platform safeguards are under formal examination. A strong individual claim still needs a clear account of the loss, the relevant duty and the evidence connecting the two. Neither a refund nor a regulatory penalty can be inferred from the opening of proceedings.

Legal check date

Sources and law checked on 21 October 2026. Later developments are not reflected automatically. Application of the rules depends on the individual facts.