How a Fake 10 Downing Street Listing Exposed Booking.com's Weak Security

Booking.com's Fraud Gap: A Fake Listing That Shouldn't Have Passed

When Which? set out to test Booking.com's fraud prevention systems, they didn't expect to find such a glaring loophole. They uploaded a fake listing for 10 Downing Street — the official residence of the UK Prime Minister — and somehow it made its way through their verification process.

The listing was a parody: an ad for a '1 bedroom apartment in the heart of London', complete with images of the iconic front door, describing it as a 'prime city centre location' just 400 meters from Big Ben. It also included a fictional review that mentioned 'hanging out' with Larry the cat — a nod to the real-life mouser who is said to keep the premises pest-free.

Yet despite these obvious signs, Booking.com did not remove the listing until two months later, when it was finally taken down on August 27th. And even then, it only happened after Which? made a public inquiry and highlighted its presence on the site.

'This limited test is not a true reflection of the experience of millions of listings or reviews published on our platform,' said a Booking.com spokesperson in response to the report.

While the company cited its automated fraud controls as being in place, they were apparently ineffective in flagging this particular listing. The site only activated these checks after a manual review — and even then, it took weeks to remove the fake content.

What This Means for Travelers

For users like myself, who've used Booking.com over the years, the implications are troubling. If someone can list 10 Downing Street as a vacation rental — a property that doesn't exist as a private accommodation — it's hard to believe that legitimate scammers won't find similar loopholes.

What's more alarming is that the fake listing was active for only 20 minutes, during which time Which? researchers were able to collect data from interested parties. Out of those 14 people who tried to book the property, only one was a known researcher, yet they still managed to get the system to accept their request.

And that's not all — Which? reported that Booking.com allowed them to send messages containing links to external payment sites, which should have been blocked by standard security protocols. These are the kinds of red flags that usually trigger warnings on reputable booking platforms, but in this case, they were ignored.

The Human Element and AI Missteps

Booking.com's own representatives say their AI tools help detect fraudulent listings within 24 hours. But in reality, it seems like these systems are still falling short — especially when dealing with well-known public figures or iconic locations.

Rory Boland, Travel Editor at Which?, wasn't impressed by what he saw: If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily.

It's worth noting that AI alone isn't enough to prevent fraud. There needs to be a combination of real-time monitoring, robust human oversight, and rapid response mechanisms. And clearly, Booking.com is not yet delivering on all fronts.

A Broader Problem in Online Safety

This incident also points to a larger issue within the online travel industry — specifically, how companies like Booking.com are held accountable for the content they host. The UK's Online Safety Bill (OSA) places responsibility on platforms to act swiftly upon identifying illegal or harmful content, but enforcement is inconsistent.

Ofcom, the regulatory body responsible for enforcing the OSA, told Which? that platforms have existing legal duties that mean they must take it down swiftly once they become aware of it. But when platforms fail to act quickly enough, users end up footing the bill — both financially and emotionally.

According to a recent study by the UK's National Cyber Security Centre (NCSC), over 80% of adults believe scams are becoming more sophisticated. That means companies like Booking.com must evolve their security systems accordingly — or risk losing public trust entirely.

Why This Matters Beyond the Travel Industry

The fake 10 Downing Street listing isn't just about hotels and bookings; it's a symbol of how easily digital platforms can be manipulated. In our increasingly connected world, where people rely on online reviews and third-party vendors for everything from accommodation to food delivery, platforms must take responsibility for maintaining trust.

This is particularly true in cases like this one, where the content is so obviously absurd — yet still made its way onto the site. It raises serious questions about how vulnerable people are when it comes to protecting themselves online.

As someone who has traveled extensively using platforms like Booking.com, I know firsthand how convenient they can be. But now, I'm questioning whether that convenience comes at too high a cost — especially when user safety is compromised.

What Should Happen Next?

Which? has called for stronger enforcement of the Online Safety Act to ensure platforms like Booking.com are held accountable for removing false or fraudulent content immediately. This isn't just about one listing — it's about establishing accountability across the board.

For Booking.com, this is a wake-up call. Their current fraud detection systems need to be re-evaluated and updated, especially considering that public figures, landmarks, and institutions should be protected from exploitation by scammers.

At the same time, travelers must remain vigilant. While these incidents are rare, they do happen — and when they do, it's essential to know how to identify potential fraud early on. That means double-checking addresses, avoiding suspicious links, and reporting any questionable listings immediately.

In short, we all have a role to play in ensuring online safety remains a priority. And until platforms like Booking.com start taking these issues seriously, the risk of falling victim to scams will continue to rise.