Which? says fake 10 Downing Street listing exposes ‘unfit’ Booking.com checks

Consumer advocacy group Which? has sounded a stark warning about the security vulnerabilities of online travel giant Booking.com, revealing that its researchers were able to successfully create and maintain a fraudulent listing for 10 Downing Street, the official residence and principal workplace of the UK Prime Minister. This audacious test, designed to probe the efficacy of Booking.com’s fraud detection and verification systems, exposed significant shortcomings, leading Which? to declare the platform’s checks "unfit for purpose." The implications of such a breach are particularly concerning for holidaymakers, who are increasingly reliant on online platforms for travel arrangements and are at risk of losing substantial sums to sophisticated scams.

In a detailed exposé, Which? outlined how its investigative team managed to list the iconic address as a potential holiday rental. Astonishingly, not only did the fake listing evade immediate detection, but researchers were also able to book a bogus stay at the Prime Minister’s residence. To further underscore the laxity of the platform’s review processes, a fabricated review was left, humorously noting "hanging out" with Larry the cat, the esteemed resident feline of Number 10, as a particular highlight. The fact that such an obvious fabrication, centered on a globally recognized landmark not remotely available for commercial rental, could persist on the platform for an extended period has raised serious questions about Booking.com’s commitment to user safety.

The consumer watchdog revealed that the fraudulent listing remained active for two months before it was eventually removed. This prolonged period of apparent invisibility to Booking.com’s security mechanisms is particularly alarming. When approached for comment, a spokesperson for Booking.com, speaking to the BBC, attempted to downplay the findings, stating that the "limited test is not a true reflection of the experience of millions of listings or reviews published on our platform." They attributed the extended presence of the fake listing to the fact that it was not "live" on their site for the entire two-month duration, suggesting that "some of our automatic fraud controls were not triggered to completely remove the closed listing."

The Booking.com spokesperson elaborated on the technicalities, explaining that the listing was only visible and available for booking requests during a narrowly defined 20-minute window, strategically opened by Which? researchers to facilitate their test. This limited availability, they argued, prevented certain automated fraud detection systems from fully engaging. Despite this technical explanation, the core issue of a fake listing for such a prominent and improbable location persisting for an extended period remains a significant concern. The company did reiterate its commitment to security, highlighting "a range of checks and verification measures" and the deployment of technologies like AI, which they claim help them "detect and remove the majority of fraudulent listings within 24 hours."

However, Rory Boland, Travel Editor at Which?, was unequivocal in his condemnation of Booking.com’s security protocols. He stated that the results of their investigation unequivocally demonstrated that the platform’s checks had been shown to be "unfit for purpose." Boland’s critique was sharp and direct: "If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily." He further emphasized the potential harm to consumers, adding, "It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links."

This incident is not an isolated event; Booking.com has faced prior criticism regarding its security measures and the quality of its customer service. The latest revelations from Which? add further weight to these ongoing concerns, suggesting a systemic issue rather than a one-off lapse. During the brief 20-minute window when the fake 10 Downing Street property was made accessible for booking requests, Which? reported that an astonishing 14 individuals attempted to secure a stay. This high volume of interest, even for a clearly fictitious listing, highlights the persistent demand for accommodation and the vulnerability of travelers to appealing but fraudulent offers.

Crucially, only the booking request originating from a researcher known to be affiliated with Which? was accepted. This selective acceptance, while part of the investigative process, also hints at how scammers might operate, potentially targeting specific individuals or employing methods to bypass initial automated rejections. Furthermore, the investigation uncovered another critical security flaw: the fake listing’s associated communication within Booking.com’s messaging system included a request for the researcher to click an external link to confirm payment details. This is a classic phishing tactic, and legitimate booking platforms typically block such external links to protect users from scams. However, in this instance, Which? reported that Booking.com failed to flag or remove this suspicious external link, demonstrating a significant gap in their protective measures.

In response to this specific point, Booking.com stated that they provide "visible reminders to not click on links customers are not confident about, and booking confirmations also provide further guidance, including details of the agreed payment schedule." While these general reminders exist, the failure to actively intercept or flag a direct request to click an external link for payment confirmation, especially within a presumably secure booking system, raises questions about the effectiveness of these passive warnings.

The fabricated review left by the Which? team, which humorously declared, "It was unbelievable that Booking.com let us stay at 10 Downing Street – the home of the UK PM!", also seemingly bypassed the platform’s content moderation systems, despite bearing all the hallmarks of a jest. This suggests that the filters for both user-generated content and listing authenticity are not robust enough to distinguish genuine experiences from deliberately fabricated ones. The listing was ultimately removed by the platform on August 27th, but only after Which?’s investigation brought it to light and highlighted the severe security vulnerabilities it exposed. The extended timeframe and the nature of the breaches suggest that Booking.com needs to urgently re-evaluate and significantly enhance its fraud detection and verification processes to regain the trust of its millions of users. The potential for financial loss and reputational damage for both consumers and the platform itself remains a significant threat.