Booking.com accused of security failures after fake 10 Downing Street listing

A consumer watchdog investigation has revealed that a fake listing for 10 Downing Street was successfully created on Booking.com. Researchers from Which? set up the listing on 18 June as a one bedroom apartment in the heart of London, using the exact address and a photo of the prime minister's home. The watchdog reported that the site processed a payment for a week long stay, which had not been refunded more than six weeks later. Additionally, a fake review mentioning Larry the cat was uploaded and appeared almost immediately despite a message from the site stating it would be moderated.

Which? researchers also used the platform's mailing system to send an external URL requesting credit card details. The watchdog claimed that Booking.com failed to block the URL despite having the ability to do so. The listing remained on the site until 27 August. Rory Boland, the editor of Which? Travel, stated that the incident demonstrates how scammers can exploit the platform because its AI systems failed to recognize that the prime minister's residence is not a holiday rental. The watchdog has urged Ofcom to investigate what it described as systemic security failures.

Booking.com responded by stating that the test was not a true reflection of the experience for millions of users. A spokesperson claimed the property was not visible to customers or live for the referenced period, and that some automatic fraud controls were not triggered because the property was not open and bookable. Ofcom noted that while platforms must remove illegal content once known, Booking.com is not currently in scope for future rules regarding paid for fraudulent advertising.