Fake 10 Downing Street listing exposes 'unfit' Booking.com, says consumer group

5 hours ago

Liv McMahonTechnology reporter

Reuters 10 Downing Street. The black door featuring the "10" lettering and letterbox is closed, with Larry the Cat sat on the doorstep in front of it.

Consumer group Which? says it was able to create a fake listing for 10 Downing Street on travel giant Booking.com.

The UK watchdog said its researchers were able to book a bogus stay at the prime minister's address - as well as leave a fake review noting "hanging out" with resident mouser Larry the cat as a highlight.

It said despite clear signs it was fake, Booking.com did not remove the listing until two months after it was uploaded.

"This limited test is not a true reflection of the experience of millions of listings or reviews published on our platform," a Booking.com spokesperson told the BBC.

They said because Which?'s listing was not "live" on its site across the two months it was present, "some of our automatic fraud controls were not triggered to completely remove the closed listing".

People could only see the listing and request to book the property during a 20-minute window opened by Which? so its researchers could try to book it.

Booking.com's spokesperson added "a range of checks and verification measures" help secure the site, and technologies such as AI "help us detect and remove the majority of fraudulent listings within 24 hours".

But Which? Travel editor Rory Boland said its checks had been shown to be "unfit for purpose".

"If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily," he said.

"It would be laughable that we were able to list the UK's most famous address for rent, if the consequences weren't so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links."

It is not the first time the site has faced criticism over its security efforts and customer service.

'Prime city centre location'

Which?'s listing, uploaded to Booking.com on 18 June, advertised a "1 bedroom apartment in the heart of London".

It used images of the iconic 10 Downing Street front door, listed at its address - with a description referring to the one bedroom space as "a prime city centre location".

A description for the property said it was 'situated on 10 Downing Street' and only a short walk of '400 metres' to Big Ben

Which?/Booking.com The Booking.com listing page, with a picture of the front door of Number 10 Downing Street. It is headlined: "1 bedroom apartment in the heart of London". Underneath an address of "10 Downing Street, London" is listed. Below the image are labels saying "the entire place is yours" and 215 square foot size. — A description for the property said it was 'situated on 10 Downing Street' and only a short walk of '400 metres' to Big Ben

In the 20 minutes that Which? permitted customers to request a stay at its fake 10 Downing Street property, it said 14 people asked to do so.

Only the booking request from a person known to be a Which? researcher was accepted.

The watchdog's team also sent the researcher a message within Booking.com's system asking them to click an external link to confirm their payment details - something booking sites typically block to prevent customers being scammed.

But Which? said that in this instance, Booking.com did not flag or remove the external link it sent.

Booking.com said it had "visible reminders to not click on links customers are not confident about, and booking confirmations also provide further guidance, including details of the agreed payment schedule".

The fake review left by Which? also seemingly passed the site's checks, despite bearing all the hallmarks of a joke.

"It was unbelievable that Booking.com let us stay at 10 Downing Street - the home of the UK PM!" it said.

The listing itself was removed by the platform on 27 August.

According to Which?, Booking.com said in a message the review would be checked by its moderators but it was added to the listing soon after

Which?/Booking.com A screengrab of a review left for the fake Which? listing on Booking.com. It has been rated 10 - Exceptional, with 10/10 across Staff, Facilities, Cleanliness, Comfort, Value for money and Location categories. A review posted on 11 August 2026 by a user called Trevor says "It was unbelievable that Booking.com let us stay at 10 Downing Street - the home of the UK PM". Beneath it, besides a smiley face emoji, it identifies an upside as "Hanging out with Larry the Cat". Below that, next to a sad face emoji, it reads "Some guy was moving in during our stay - but it was fine". — According to Which?, Booking.com said in a message the review would be checked by its moderators but it was added to the listing soon after

Some customers have previously accused the firm of failing to protect them from falling victim to cyber-criminals.

"Fraud affects many industries, and 80% of UK adults believe scams are becoming more sophisticated," said Booking.com's spokesperson - adding it was continuing to strengthen its defences in the face of this challenge.

Which?, meanwhile, said more should be done to force booking sites to swiftly remove false listings under the Online Safety Act (OSA).

The Act requires firms which have identified illegal content, including fraudulent material, on their sites to show they are committed to removing it.

Boland said Ofcom, which enforces the OSA, should be encouraged use it to "crack down on irresponsible online platforms that leave consumers wide open to fraud".

"For illegal content generated by users, platforms have existing legal duties that mean they must take it down swiftly once they become aware of it," an Ofcom spokesperson told Which?.