Scam hotel booking sent family to Wetherspoon pub

A scam hotel booking sent a family to a Wetherspoon pub

Wetherspoon staff have been turning away as many as 20 tourists a day after scammers used the pub’s address as a fake Booking.com holiday apartment, Which? has found.

A theatre-goer became the victim of a "sophisticated phishing attack" after booking a "luxury" London apartment, only to learn that the address was actually a Wetherspoon pub.

Paul Dawson, from Loughborough in Leicestershire, paid £73 for a one-night stay for his family through Booking.com at The London Crown apartments so they could see the musical Hamilton in the West End.

A few days later, he said he discovered that the address listed was in fact The Liberty Bounds pub, a Wetherspoon near Tower Bridge.

Consumer protection group Which? said Wetherspoon staff had been sending away up to 20 tourists a day after scammers used the pub’s address for a listing described as a "block of luxury apartments".

Which? also said it had been alerted to a property advertised as "Apartments near Big Ben", with the address given as Portcullis House, part of the House of Commons estate where hundreds of MPs work.

Booking.com told Which? that in both cases, legitimate property listings had been targeted by a "sophisticated phishing attack, allowing criminals to hijack the listings".

Wetherspoon said it had notified Booking.com about the scam "as soon as it came to their attention".

Dawson, 55, made the booking in August. Two days later, he said he received an email from The London Crown with a link to a fake Booking.com page asking for his bank details.

Dawson told Which? he contacted Booking.com to raise his concerns, but said the platform told him he would need to go to the "fake apartment" and wait until after 7pm before it would move him.

This was despite Mr Dawson explaining that he had since found out the address shown in the listing was actually The Liberty Bounds pub.

He told Which?: "I explained to the support staff that I had autistic children and the idea of turning up at a clearly non-existent property at 10.30pm would have been catastrophic.

"This did not change their response, that I needed to go to the property. They said that if it was not possible to check in then I could contact them again and they would find an alternative."

Dawson said the family eventually stayed at the Premier Inn in Goodge Street.

Which? said the London Crown apartments listing had 250 negative reviews from August and September, along with a small number of likely fake positive reviews.

The information was still visible, but the page displayed the message: "We're sorry, but this property isn't taking reservations on our site right now".

Wetherspoon said the listing was removed, only for it to return, "though it now appears that the ability to book has been blocked".

"We have again notified them [Booking.com], asking for the listing to be permanently removed.

"It is clearly unacceptable for people to be defrauded in such a flagrant manner.

"This is upsetting for the pub team, as there is little they can do to help, but even more so for the people who have been misled and have lost money as a result.

"Booking.com urgently needs to adopt more robust procedures to prevent fraudulent listings like this appearing in the first place."

Many of the reviews from customers said they had told Booking.com it was a scam but had been ignored.

One customer said: "I reported it to Booking.com three days before check-in but they refused to do anything."

Another customer, from Spain, said she and her friend had been left stranded, writing: "Two girls alone in London at two o'clock in the morning with no accommodation."

Booking.com also has an AI trip planner called Dot, which lets users ask questions. On the London Crown listing page, a Which? researcher asked: "Is this a real property, or is it a scam?".

It replied: "The London Crown is a legitimate property located in the centre of London. It offers various amenities such as free wifi, free bikes, and free private parking. It is conveniently located near Longleat Safari Park and Longleat House, with London City Airport just 10km away. Based on the detailed description and amenities listed, the London Crown appears to be a real and well-equipped property."

Dot failed to recognise that Longleat Safari Park was more than 100 miles (160km) from London, in Wiltshire.

"Apartments near Big Ben" and The London Crown apartments were both targeted by the phishing attack, Booking.com said.

"The attack affected the properties' own computer systems and gave cybercriminals temporary, unauthorised access to the accommodation's Booking.com account," a spokesperson said.

"We take incidents like this extremely seriously, and suspended bookings at both properties, as well as supporting affected customers."

An Ofcom spokesperson said: "Fraud online can have serious consequences for victims and platforms have clear legal duties to take down illegal content generated by users once they become aware of it.

"More broadly, we've shown that we'll use our enforcement powers against platforms that fail to comply with the Online Safety Act, and have already launched investigations into over 100 sites."