Bogus 10 Downing Street listing exposes Booking.com security failings, watchdog warns

Booking.com has been accused of “systemic security failures” by Which? After the consumer watchdog successfully created a fake listing on the platform for 10 Downing Street.

The fake listing, which was created on 18 June and headlined ‘1 bedroom apartment in the heart of London’, featured an image and the precise location of the prime minister’s home, as well as promising guests a four-minute walk to the Houses of Parliament. The consumer watchdog was also able to leave a fake review of the property, where it rated the stay as exceptional and described “hanging out with Larry the Cat” as a highlight of the trip.

Settings on the fraudulent listing were configured so that users had to request a stay rather than booking automatically, with the reservation window briefly opened so that Which? researchers would complete a trial run of booking a stay at the fake accommodation.

Which? said that one of its researchers was able to book a week-long stay during this trial run, which the platform processed and has still not refunded more than six weeks later, despite the fraudulent listing being removed from Booking.com on 27 August.

Rory Boland, Editor of Which? Travel said: “If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily.

“It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.

“Booking.com’s checks are clearly unfit for purpose, and the Prime Minister must now urge Ofcom to use the Online Safety Act to crack down on irresponsible online platforms that leave consumers wide open to fraud.”

A Booking.com spokesperson said: “This limited test is not a true reflection of the experience of millions of listings on our platform. The property added by Which? was not visible to customers or ‘live’ for the time period referenced.

“We use a range of checks, verification measures and artificial intelligence, which help us detect and remove the majority of fraudulent listings within 24 hours.”