Fake 10 Downing Street Listing Exposes Booking.com Security Gaps, Which? Says

Consumer group Which? says it created a fake listing for 10 Downing Street on Booking.com and was able to request and book a bogus stay at the UK prime minister’s address.

The listing, uploaded on 18 June, advertised a “1 bedroom apartment in the heart of London” using images of the famous front door. It described the property as being on 10 Downing Street and 400 metres from Big Ben. During a 20-minute window when customers could request a stay, 14 people asked to book it. Only a Which? researcher’s request was accepted.

Which? said the platform also allowed a message asking the researcher to click an external link to confirm payment details. The link was not flagged or removed. A fake review mentioning “hanging out” with Larry the cat also passed the site’s checks, according to the group.

Which? said Booking.com did not remove the listing until 27 August, two months after it was uploaded. Booking.com said the test was limited and not representative of millions of listings or reviews. It said automatic fraud controls were not fully triggered because the listing was not live throughout that period, while AI and other checks help remove most fraudulent listings within 24 hours.

Which? Travel editor Rory Boland called the checks “unfit for purpose” and said more should be done under the Online Safety Act. Ofcom said platforms have legal duties to swiftly remove illegal user-generated content once they become aware of it.