Which? set up a fake 10 Downing Street listing on Booking.com on 18 June, and the platform processed payment for a week-long stay tied to it. The listing was presented as a 1 bedroom apartment in the heart of London, using the exact address and a picture of the prime minister’s home.
Users had to request a stay rather than reserve and pay automatically. A Which? researcher carried out a test during the brief booking window, and the money had still not been refunded more than six weeks after the payment was set up.
Rory Boland’s criticism
Rory Boland, the editor of Which? Travel, said: "If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily." Which? said its investigation had uncovered systemic security failures across the platform and urged Ofcom to investigate.
The fake review added to the listing described the stay as exceptional and mentioned hanging out with Larry the cat. Which? said the review was added almost immediately after Booking.com said it would be checked by a team of moderators, and it said the company also did not block an external URL sent through its messaging system to ask for credit card details to confirm the booking.
Booking.com response
A Booking.com spokesperson said: "This limited test is not a true reflection of the experience of millions of listings on our platform. The property added by Which? was not visible to customers or ‘live’ for the time period referenced." The spokesperson also said: "We use a range of checks, verification measures and artificial intelligence, which help us detect and remove the majority of fraudulent listings within 24 hours."
The company said some automatic fraud controls were not triggered because the property was not open and bookable. The listing was removed on 27 August.
Ofcom and Booking.com
An Ofcom spokesperson said: "Booking.com is not in scope of future rules that will apply to paid-for fraudulent advertising, and any change to that would be a matter for government". The regulator also said platforms have legal duties obliging them to take down illegal content generated by users once it is known.
The unanswered issue is how a listing using the exact address of 10 Downing Street, a picture of the home and a promise of a four-minute walk to the Houses of Parliament could pass Booking.com’s checks, generate a paid booking and stay in place for more than six weeks before removal.
