Fake 10 Downing Street Booking.com listing exposes major security flaws

A fake holiday rental listing for 10 Downing Street was reportedly set up on Booking.com within minutes, with consumer watchdog Which? saying the experiment exposed serious weaknesses in the platform’s fraud prevention and verification systems.

The listing was created by Which? Travel researchers on 18 June and presented 10 Downing Street as a “1 bedroom apartment in the heart of London”. It used the exact address of the UK prime minister’s official residence and a photograph of its recognisable black front door. The property description claimed it was in a “prime city-centre location” and just a four-minute walk to the Houses of Parliament.

The researchers deliberately set the property so that guests had to request a stay rather than being able to book automatically. They then briefly opened the booking window for around 20 minutes so a Which? representative could make a test reservation.

During that short period, 14 people reportedly contacted the listing asking whether they could stay at the property. The Which? researcher’s booking for a week-long stay was accepted, and Booking.com processed a payment. According to Which?, the money had still not been refunded more than six weeks after the listing was created.

The experiment also tested the platform’s review and messaging systems. On 11 August, Which? added a fake 10/10 review describing the supposed stay as “exceptional” and referring to “hanging out with Larry the cat”, the cat associated with 10 Downing Street. Although Booking.com indicated that the review would be checked by moderators, Which? said it appeared almost immediately. 

Researchers also used Booking.com’s internal messaging system to send an external link asking the supposed guest to enter credit card details to confirm the booking. Which? said the link was not blocked, despite Booking.com having told the watchdog that it could restrict URLs in messages when fraudulent activity was suspected. 

The fake listing remained online until 27 August, around six weeks after it was created. Which? said the investigation had uncovered “systemic security failures” and called on Ofcom to investigate Booking.com’s compliance with its obligations under the Online Safety Act. 

According to Which?, under Booking.com’s policies, hosts are not required to provide photo ID or proof of ownership until three months after a listing goes live.

Rory Boland, editor of Which? Travel, said: “If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily.” He added that the consequences for holidaymakers could be serious, with travellers potentially losing thousands of pounds to fake listings and phishing links.

“Booking.com’s checks are clearly unfit for purpose, and the Prime Minister must now urge Ofcom to use the Online Safety Act to crack down on irresponsible online platforms that leave consumers wide open to fraud,” Boland added.

Booking.com disputed the significance of the test, saying it was “not a true reflection of the experience of millions of listings on our platform. The property added by Which? was not visible to customers or ‘live’ for the time period referenced.” The company said it uses verification measures and artificial intelligence to detect and remove most fraudulent listings within 24 hours, but argued that some automatic controls were not triggered because the fake property was not continuously open and bookable.

Ofcom said platforms have existing legal duties to swiftly remove illegal user-generated content once they become aware of it, adding that “Booking.com is not in scope of future rules that will apply to paid-for fraudulent advertising, and any change to that would be a matter for Government.”