Consumer watchdog was able to list 10 Downing Street as a holiday rental on booking.com

A UK consumer watchdog successfully listed 10 Downing Street on Booking.com as a holiday rental for two months, allowing a test booking and generating a glowing review. The listing, created by Which? Travel, was intended to expose vulnerabilities in Booking.com's security systems. The fake listing, which included the exact address and a picture of the iconic black door, was uploaded on 18 June and remained active until 27 August. The watchdog set up the listing as part of an investigative effort to assess the effectiveness of Booking.com's anti-fraud measures. It was designed to be highly conspicuous, using one of the world's most recognizable addresses to test whether the platform's automated systems would flag it as suspicious. Despite the obvious nature of the listing, Booking.com allowed it to go live without requiring the researcher to provide proof of ownership or identification. According to the watchdog, such documentation was not necessary until three months after the listing was posted. The listing was configured so that potential guests had to request a stay rather than making a booking automatically. Within 20 minutes of the listing becoming available, 14 individuals inquired about staying at the property. A member of the Which? team was then able to complete a week-long booking, paying for the stay through the platform. However, the booking was later canceled on 31 August, and the watchdog received an email regarding a refund, though it was unclear whether the full amount would be returned. In addition to the booking, the watchdog conducted further tests to evaluate the platform's ability to prevent fraudulent activity. It discovered that the account could be used to send potential guests to external links requesting credit card details. This raised concerns about the risks posed by scammers exploiting such features to deceive users and steal personal information. To amplify the impact of the experiment, Which? Travel left a fake review of its fake listing, giving it a perfect score of 10 out of 10. The review humorously claimed that the stay at 10 Downing Street was an exceptional experience, highlighting the presence of "Larry the Cat." Despite Booking.com's systems indicating that the review would be reviewed by a moderator before publication, it appeared on the platform within minutes. As a result, the prime minister's residence was subsequently rated as "exceptional" on Booking.com. The account associated with the fake listing was eventually removed on 27 August, approximately two months after it was created. Which? Travel editor Rory Boland emphasized that while the findings were amusing, the implications for real users were alarming. He warned that the ease with which the watchdog was able to create a fraudulent listing underscored the potential dangers faced by travelers, who could lose substantial amounts of money to scams or fall victim to phishing attempts. A Booking.com spokesperson responded to the incident, stating that the "limited test does not reflect the experience of millions of listings and reviews on our platform." She explained that the property added by Which? was not "live" or visible to customers during the period referenced and that some automatic fraud controls were not triggered because the property was closed. The company reiterated its commitment to protecting users through a combination of checks, verification processes, and AI-driven technologies, noting ongoing efforts to enhance security against increasingly sophisticated scams.