핵심 요약
- Which? researchers listed 10 Downing Street on Booking.com as a fake rental listing.
- The platform processed a test payment and the money has not been refunded for 6 weeks.
- A fake review and a message containing a phishing link were published bypassing system checks.
- Which? asked Ofcom to investigate Booking.com's Online Safety Act obligations.
숫자로 보기
Consumer protection body Which? managed to list 10 Downing Street, the UK Prime Minister's official residence, as a fake holiday rental listing on the Booking.com platform. Researchers used a photo of the famous black door and the full address in the listing they created on 18 June. The platform allowed 14 people to attempt a stay in the test booking window.
As a more serious security flaw, Which? researchers were able to complete a real payment transaction for a one-week stay; the money has not been refunded for over six weeks. The experiment continued with the addition of a fake review; a five-star review about Larry the cat was immediately approved and published on the platform. Furthermore, a message containing a phishing link was able to be sent despite the system's obligation to block it.
The fake listing was removed on 27 August, six weeks after its creation. Which? claimed that Booking.com has "systemic security failures" in its fake accommodation detection systems, leaving real holidaymakers vulnerable to fraud. The body asked Ofcom to investigate Booking.com's obligations under the Online Safety Act. Booking.com, for its part, claimed the experiment did not reflect a genuine user experience, that the listing was not actually visible and bookable, and therefore automated fraud controls were not triggered.
반응 남기기
이 기사에 대해 질문
답변은 이 기사만을 바탕으로 AI가 생성합니다.
자주 묻는 질문
- How was Which? able to list 10 Downing Street on Booking.com?
- Which? researchers created a fake listing titled '1 bedroom apartment in the heart of London' on 18 June using a photo of the famous black door and the full address.
- When did Booking.com remove this fake listing?
- The fake listing was removed from the platform on 27 August, six weeks after its creation.
- How did Booking.com respond to these allegations?
- Booking.com stated that the experiment did not reflect millions of listings and reviews, that the listing was not actually visible and bookable, and therefore automated fraud controls were not triggered.