Fake 10 Downing Street listing exposes ‘unfit’ Booking.com, says consumer group

Consumer Watchdog Books a Stay at 10 Downing Street on Booking.com — and Waits Two Months Before It Gets Pulled

Constantvpn.com – Imagine listing the British prime minister’s official residence as a one-bedroom holiday let, complete with photos of its famous black front door, and watching the platform accept the posting without a single automated alert firing. That is precisely what happened when researchers at consumer advocacy group Which? uploaded a fabricated rental listing for 10 Downing Street to Booking.com on 18 June. The platform did not take the listing down until 27 August — roughly two months later — after Which? publicly flagged the issue.

The episode has reignited debate over how effectively major online travel agencies police their own marketplaces, particularly as holidaymakers across the UK and beyond continue to fall prey to fraudulent listings, phishing links, and so-called “reservation hijacking” schemes that can cost thousands of pounds in a single booking.

The Fake Listing and Its Absurd Details

Which? described the property as a “1 bedroom apartment in the heart of London,” using photographs of the iconic Downing Street entrance. The listing’s copy described the space as “a prime city centre location” and noted it was “situated on 10 Downing Street,” just “400 metres” from Big Ben. The tone was deadpan, but the platform’s verification systems did not appear to register any anomaly.

During a deliberately opened 20-minute window in which the listing was visible to the public and booking requests could be submitted, 14 people attempted to reserve the property. Only the request from a Which? researcher was accepted. Within that same window, the watchdog’s team also sent the researcher an in-platform message containing an external hyperlink, asking them to click through to “confirm payment details” — a tactic commonly associated with phishing. Booking.com did not flag, block, or remove the external link.

The researchers additionally left a fake review on the listing. It read, in part:

“It was unbelievable that Booking.com let us stay at 10 Downing Street — the home of the UK PM!”

The review also referenced “hanging out” with Larry, the cat famously resident at Number 10, as a highlight of the stay. Despite bearing every hallmark of a joke, the review passed the platform’s moderation checks and was attached to the listing shortly after Which? submitted it. Booking.com later told the watchdog in a message that the review would be reviewed by moderators, but it remained visible.

Booking.com’s Response

A Booking.com spokesperson told the BBC that the Which? listing was not “live” across the two months it sat on the site, meaning “some of our automatic fraud controls were not triggered to completely remove the closed listing.” The spokesperson added that the platform employs “a range of checks and verification measures” and that technologies including AI “help us detect and remove the majority of fraudulent listings within 24 hours.”

On the external-link issue, the spokesperson pointed to “visible reminders to not click on links customers are not confident about” and noted that booking confirmations “provide further guidance, including details of the agreed payment schedule.”

On the broader fraud landscape, the spokesperson acknowledged that “fraud affects many industries, and 80% of UK adults believe scams are becoming more sophisticated,” while stating the company was “continuing to strengthen its defences in the face of this challenge.”

Which? Calls the Systems “Unfit for Purpose”

Rory Boland, Which? Travel editor, was blunt in his assessment. He said the checks had been shown to be “unfit for purpose” and pressed the point with a pointed rhetorical question:

“If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily.”

Boland went further, warning that the consequences for ordinary travellers are far from laughable:

“It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.”

Regulatory Context: The Online Safety Act and Ofcom

The Which? test lands against a backdrop of tightening UK regulation. The Online Safety Act (OSA), now being enforced by communications regulator Ofcom, obliges platforms that host user-generated content to demonstrate active commitment to removing illegal material — including fraudulent listings — once they become aware of it. An Ofcom spokesperson told Which? that “for illegal content generated by users, platforms have existing legal duties that mean they must take it down swiftly once they become aware of it.”

Boland urged Ofcom to use its OSA powers more aggressively:

“Ofcom, which enforces the OSA, should be encouraged to crack down on irresponsible online platforms that leave consumers wide open to fraud.”

The distinction matters. A listing that sits dormant for two months without triggering automated removal, while simultaneously allowing an external phishing link to circulate inside the platform’s own messaging system, raises questions about whether current verification architectures are calibrated to the scale of the threat. For millions of travellers who book accommodation through these marketplaces each year, the gap between a platform’s stated AI capabilities and its demonstrated performance on even the most obviously implausible listing is not an academic concern — it is a direct financial and safety risk.

Which? has called for stronger enforcement mechanisms that compel booking platforms to remove false listings swiftly, arguing that voluntary moderation alone has proven insufficient when the stakes involve consumers’ savings and personal data. Until regulators close that gap, the next “10 Downing Street” may not be a watchdog’s experiment but a holidaymaker’s lost deposit.