Fake 10 Downing Street listing exposes 'unfit' Booking.com, says consumer group

Consumer advocacy group Which? has criticized Booking.com as "unfit" after successfully creating a fictitious listing for 10 Downing Street on the travel platform.

The UK watchdog reported that its investigators were able to reserve a fabricated stay at the Prime Minister's official residence and even post a mock review, highlighting "hanging out" with Larry the cat, the resident mouser, as a memorable experience. Which? noted that despite clear indicators of its inauthenticity, Booking.com did not remove the listing until two months after it was initially uploaded.

A spokesperson for Booking.com informed the BBC that "This limited test is not a true reflection of the experience of millions of listings or reviews published on our platform." They explained that because the Which? listing was not "live" on their site for the entire two-month period, "some of our automatic fraud controls were not triggered to completely remove the closed listing." The listing was only visible and available for booking requests during a 20-minute window opened by Which? for its researchers to attempt a reservation.

The Booking.com spokesperson further stated that "a range of checks and verification measures" are in place to secure the site, and technologies like AI "help us detect and remove the majority of fraudulent listings within 24 hours."

However, Rory Boland, Which? Travel editor, asserted that Booking.com's checks have proven to be "unfit for purpose." He commented, "If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily." Boland added, "It would be laughable that we were able to list the UK's most famous address for rent, if the consequences weren't so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links." This incident is not the first time the platform has faced scrutiny regarding its security measures and customer service.

The Which? listing, uploaded on June 18, advertised a "1 bedroom apartment in the heart of London." It featured images of the iconic 10 Downing Street front door and listed its actual address, describing the one-bedroom space as "a prime city centre location." The property description stated it was "situated on 10 Downing Street" and a mere "400 metres" walk from Big Ben.

During the 20-minute window that Which? allowed booking requests for its fake 10 Downing Street property, 14 individuals attempted to book. Only the request from a known Which? researcher was accepted. The watchdog's team also sent the researcher a message within Booking.com's system, instructing them to click an external link to confirm payment details—a practice booking sites typically block to prevent scams. Which? reported that Booking.com did not flag or remove this external link.

Booking.com stated it has "visible reminders to not click on links customers are not confident about, and booking confirmations also provide further guidance, including details of the agreed payment schedule."

The fabricated review left by Which? also seemingly bypassed the site's checks, despite its clear humorous tone. It read, "It was unbelievable that Booking.com let us stay at 10 Downing Street - the home of the UK PM!" The listing itself was removed by the platform on August 27. According to Which?, Booking.com had indicated in a message that the review would be checked by moderators, but it was added to the listing shortly thereafter.

Some customers have previously accused the company of failing to protect them from cyber-criminals.

"Fraud affects many industries, and 80% of UK adults believe scams are becoming more sophisticated," said Booking.com's spokesperson, adding that the company is continuously strengthening its defenses against this challenge.

Which?, meanwhile, advocates for stronger measures under the Online Safety Act (OSA) to compel booking sites to promptly remove false listings. The Act mandates that companies identifying illegal content, including fraudulent material, on their platforms must demonstrate a commitment to its removal.

Boland urged Ofcom, the OSA's enforcement body, to utilize the Act to "crack down on irresponsible online platforms that leave consumers wide open to fraud." An Ofcom spokesperson told Which? that "For illegal content generated by users, platforms have existing legal duties that mean they must take it down swiftly once they become aware of it."