Consumer Watchdog Exposes Security Flaws on Booking.com via Fake 10 Downing Street Listing

Consumer group Which? has accused Booking.com of having security checks that are unfit for purpose after researchers successfully created a fake listing for 10 Downing Street. The listing, which described a one bedroom apartment at the Prime Minister's address, was uploaded on 18 June and remained on the platform until 27 August. During a 20 minute window when the listing was open to the public, 14 people requested to stay at the property. Which? reported that they were able to accept a booking for a researcher, post a fake review mentioning Larry the cat, and send an external link requesting payment details through the site's messaging system without being flagged.

Booking.com responded by stating that the test was limited and not a true reflection of the experience for millions of users. A spokesperson explained that because the listing was not live for the entire two month period, some automatic fraud controls were not triggered. The company maintained that it uses AI and verification measures to remove the majority of fraudulent listings within 24 hours. Which? Travel editor Rory Boland argued that if the system cannot identify the UK's most famous address as a fake rental, scammers can easily exploit the platform to defraud holidaymakers. The watchdog has called on Ofcom to use the Online Safety Act to crack down on the platform.

While both reports cover the same events, they differ in their framing. The center leaning coverage focuses on the specific failure of the AI systems and the regulatory implications of the Online Safety Act. The center left leaning coverage frames the incident as a sign of systemic security failures and emphasizes the potential for devastating financial consequences for consumers.