DSA and Online Fraud: What Your Platform Risks After Booking.com

The European Commission has opened a formal investigation into Booking.com over paid ads not labeled as advertising, fraudulent listings and phishing. If you run a platform or marketplace, this case concerns you too.

What should you do right now if you run a platform or marketplace?

Start an audit on three fronts: content moderation, anti-phishing protection and ad transparency. Waiting for an investigation to arrive is already too late.

The Booking.com case isn't travel news. It's a clear signal for anyone running a digital platform with users in the European Union: the Digital Services Act (DSA, the EU regulation on digital services) is enforced through formal proceedings, not informal warnings.

The right question isn't "are we as big as Booking?" It's: "would our practices hold up in an audit?"

What exactly did the EU Commission do, and why now?

The Commission has opened formal proceedings against Booking.com for three possible DSA violations: fraudulent listings, phishing that exploits booking data and paid ads not identifiable as such.

The European Commission's official press release describes three specific areas of investigation. First: fraudulent or non-compliant ads and accommodations published on the platform. Second: phishing scams (attempts to steal data through fake emails or messages) that exploit users' booking data. Third: listings promoted through payment to appear higher in search results, without users knowing they were advertising.

The DSA has applied to all online platforms in the EU since February 17, 2024, with the exception of micro and small businesses. For platforms with more than 45 million monthly users in the EU, the so-called VLOPs (very large online platforms), it has been in force since August 2023, as clarified by the European Commission.

This isn't the first time the DSA has had concrete consequences. In December 2025, X (formerly Twitter) received a €120 million fine for dark patterns (design practices that deceive users), shortcomings in its ad repository and obstacles to researcher access, as reported by Gli Stati Generali. The Booking.com case is the second major formal proceeding.

Is phishing really that serious a problem for Italian platforms?

Yes. Data from 2025 shows that over 9 million Italians fell victim to a scam while planning their vacations, and booking portals are scammers' preferred channel in 53% of cases.

Phishing tied to travel platforms isn't a theoretical risk. In summer 2025, over 9 million Italians experienced a scam or attempted fraud while planning their vacations, with estimated losses of around €560 million, according to Torino Cronaca.

In May 2025, Check Point Research detected a 55% increase in new travel-related domains compared with the previous year: out of more than 39,000 newly registered domains, 1 in 21 was malicious or suspicious, as documented by Hacker Journal. Many of these domains clone the interfaces of Booking.com and Airbnb to trick users.

The problem extends to the infrastructure level as well. Starting in February 2025, a Russian actor registered more than 4,300 domains to impersonate booking platforms, with a peak of 511 domains in a single day, according to Matrice Digitale / Netcraft.

DMARC is a technical protocol that stops fraudulent emails from appearing to come from your domain. According to BitMat / Proofpoint, as of July 2026, 30% of the main Italian travel sites have no DMARC measures in place, and only 45% use the highest level of protection. This means that more than half of Italian travelers are exposed to email fraud that appears to come from legitimate platforms.

What exactly does the DSA say about ad transparency?

Article 26 of the DSA requires platforms to clearly label every ad and to inform users in real time about who paid for it and why it is being shown to them.

The point about ads hits digital marketers most directly. Article 26 of the DSA states that every promotional content item must be immediately identifiable as such, indicating who paid for it and why that ad is being shown to that specific user. The European Commission's DSA Observatory explains this clearly.

In the Booking.com case, the problem is that listings paid to rank higher in the results were not recognizable as advertising. A user searching for a hotel couldn't tell whether the first result was the most relevant or simply the one that paid the most.

There's another layer of complexity that marketing teams often overlook. In September 2025, the EDPB (European Data Protection Board) adopted Guidelines 3/2025, which clarify how the DSA and GDPR overlap: the DSA requires real-time information about ads, while the GDPR requires disclosure before data is collected. This creates a technical knot that calls for coordination between legal, marketing and development teams, as explained by PPC Land. The issue is similar to the one we already covered regarding default settings in AI-powered ad campaigns, where compliance is often ignored until a penalty arrives.

Three real-world scenarios: what changes for an e-commerce store, a B2B portal and a professional firm?

The impact of the DSA varies widely depending on the type of platform. Here are three illustrative cases to help you see where to act first.

Illustrative examples: the numbers and situations are meant to show the reasoning, they are not real customer data.

The most underestimated case is that of the professional firm or small business with a contact form. You aren't directly subject to the heaviest DSA obligations, but your contact data can be used by scammers to build credible phishing campaigns. Protecting your email domain with DMARC is a simple technical measure that drastically reduces this risk.

What tools and measures are available to get compliant?

Measures fall into three categories: technical anti-phishing protection, content governance and advertising transparency. Each one requires different tools.

The California law on streaming ads, analyzed in a dedicated article, shows how advertising transparency rules are converging globally. This isn't a European quirk: it's a direction the market is taking everywhere.

What are the real risks of not complying?

Penalties can reach up to 6% of annual global turnover. But the reputational risk and the loss of user trust can be even more costly.

The €120 million fine on X (formerly Twitter) showed that the EU Commission isn't stopping at big American platforms. The proceeding against Booking.com, a company based in the Netherlands, confirms that European platforms are in the crosshairs too.

The risk isn't just financial. A platform linked to fraud or phishing loses users' trust quickly, and rarely wins it back. For a marketplace or a booking portal, reputation is the product.

It's worth remembering that similar penalties for non-compliance have already been issued under the GDPR as well: the €8.6 million RTB fine and the €825 million Uber fine show that European regulators are enforcing the rules with growing consistency.

Why has the DSA become urgent right now?

The DSA has applied in full to all platforms since February 2024, but the first formal proceedings are only arriving now. The grace period is over.

For almost two years, the Commission worked mainly with the largest platforms, gathering data and opening informal dialogues. The proceeding against X in late 2025 and the one against Booking.com in October 2026 mark a change of pace: systematic enforcement has begun.

The context is made worse by the explosion of digital fraud. Check Point Research data shows a 55% rise in malicious travel domains in 2025 alone. Scammers adapt fast; platforms that don't keep up become unwitting tools for fraud.

How do you actually get started with a DSA audit for your platform?

Start by mapping the three risk areas identified in the Booking.com case, then set priorities based on your platform's actual exposure.

What mistakes do companies make most often when complying with the DSA?

The most common mistake is treating the DSA as a purely legal issue and handing it to the legal department without involving the tech and marketing teams.

The Booking.com case makes this clear: the alleged violations aren't errors in contracts or privacy policies. They're design problems (unlabeled ads), technical architecture problems (unblocked phishing) and operational process problems (fraudulent listings left up). These can only be solved with several teams working together.

How can you tell if your platform is truly compliant?

Each of the three risk areas has measurable indicators. Tracking them regularly is more useful than an annual audit.

So, is the DSA a real problem for your platform?

Worth it if you run a marketplace, a portal with third-party listings or a platform with paid ads, and you have users in the EU: the DSA applies to you, and the three areas of the Booking.com investigation are probably relevant. Start with the technical audit within 30 days.

Somewhere in between you have an e-commerce store with your own products and some form of sponsored ranking: the ad labeling requirement still applies. Check your UI and your anti-phishing email setup as a minimum priority.

Not yet if you're a micro or small business (under 50 employees and €10 million in revenue) with no third-party listings: the DSA's heaviest obligations don't apply. Still, protecting your email domain with DMARC is worth it regardless of the regulation.

How we see it at SHM

For us, the Booking.com case confirms something we often see in web architecture and digital integration projects: regulatory compliance gets treated as a legal problem, when it's almost always a design and process problem. Unlabeled ads aren't a contractual oversight; they're an interface problem. Unblocked phishing isn't a gap in the privacy policy; it's a technical configuration problem.

We believe that simplifying digital, making it transparent, safe and understandable for users, is the highest form of expertise. And here, it's also the smartest form of risk management.

If you run a platform or marketplace and want to know where you're exposed, we can help with a structured audit. Our strategic AI integration and web security services cover exactly the technical areas the DSA puts under scrutiny. If you need to train your team in-house on the topic, our business process automation training also covers content governance workflows. You can find more insights on digital regulation and technology in the Project management and technology section.

Frequently Asked Questions

The DSA doesn't ask platforms to be perfect. It asks them to show they're genuinely trying, with documented systems and verifiable processes.