Which? Lists 10 Downing Street as Fake Rental Listing on Booking.com

Consumer protection body Which? managed to list 10 Downing Street, the UK Prime Minister's official residence, as a fake holiday rental listing on the Booking.com platform. Researchers used a photo of the famous black door and the full address in the listing they created on 18 June. The platform allowed 14 people to attempt a stay in the test booking window.

As a more serious security flaw, Which? researchers were able to complete a real payment transaction for a one-week stay; the money has not been refunded for over six weeks. The experiment continued with the addition of a fake review; a five-star review about Larry the cat was immediately approved and published on the platform. Furthermore, a message containing a phishing link was able to be sent despite the system's obligation to block it.

The fake listing was removed on 27 August, six weeks after its creation. Which? claimed that Booking.com has "systemic security failures" in its fake accommodation detection systems, leaving real holidaymakers vulnerable to fraud. The body asked Ofcom to investigate Booking.com's obligations under the Online Safety Act. Booking.com, for its part, claimed the experiment did not reflect a genuine user experience, that the listing was not actually visible and bookable, and therefore automated fraud controls were not triggered.