Booking.com's security measures have been called into question following an undercover investigation by consumer group Which?. Researchers were able to create a fake listing for 10 Downing Street, the official residence of the UK Prime Minister, and even accept payments for it, highlighting apparent gaps in the platform's security controls.
Despite Booking.com's assertions of employing advanced AI and multiple security checks, the Which? Travel team reportedly set up the fraudulent listing for the iconic London address within minutes. Under the platform's policies at the time of the investigation, hosts were not required to provide photo identification or proof of ownership for up to three months after a listing became active.
This vulnerability has been a recurring issue, with numerous user complaints detailing scam messages and guests arriving at destinations only to find their booked accommodation was fake. When customers have sought assistance, they have often been initially directed to an AI chatbot that proved ineffective.
On June 18, a Which? researcher created a listing titled '1 bedroom apartment in the heart of London,' using an image of 10 Downing Street. The listing was configured to require booking approval rather than immediate acceptance. Within a brief period during which the booking window was open for a test, 14 individuals expressed interest in staying at the fictional property.
Further demonstrating the security lapse, Booking.com processed a payment from a Which? researcher for a week-long stay at the fake listing. As of more than six weeks after the initial setup, the payment had not been refunded. The consumer group also posted a fake review on August 11, rating the non-existent property 10/10, which appeared on the platform almost immediately after being submitted, despite a claim that reviews are checked by moderators.
In another critical security failing, the Which? team used Booking.com's internal messaging system to send an external URL to a representative from another account, requesting credit card details to confirm the booking. Unlike competitors such as Airbnb, which automatically block external links to prevent phishing scams, Booking.com's system failed to intercept this link. The company stated it has the capability to block such URLs if fraudulent activity is suspected, but did not do so in this instance.
The fake listing for 10 Downing Street was not removed until August 27, after Which? provided Booking.com with an opportunity to comment. This incident echoes a previous investigation in October 2024, where a similar fake listing was created in just 15 minutes. In that case, it reportedly took 18 months for Booking.com to require proof of identity for the listing, and it was only blocked 20 months after its creation when the information was not provided.
Under the UK's Online Safety Act, platforms like Booking.com are legally obligated to implement measures to prevent consumers from encountering fake listings and to swiftly remove any fraudulent accommodation options that bypass these controls. However, Which? notes that the regulator, the Office of Communications (Ofcom), has taken limited action against the booking site despite uncovering numerous examples of fraud.
Rory Boland, editor of Which? Travel, stated, "If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily." He added that the consequences are "devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links." Boland urged the Prime Minister to encourage Ofcom to enforce the Online Safety Act against irresponsible online platforms.
In response, a Booking.com spokesperson commented, "This limited test is not a true reflection of the experience of millions of listings or reviews published on our platform." The company suggested that because the fake property was not fully visible or bookable, some automatic fraud controls were not triggered. They asserted that their platform uses a range of checks, including artificial intelligence, to detect and remove the majority of fraudulent listings within 24 hours and have tools to protect review integrity. Booking.com also noted that 80 percent of UK adults believe scams are becoming more sophisticated and that they are continuously strengthening their defenses.
Ofcom stated that platforms have existing legal duties to swiftly remove illegal content generated by users once they are aware of it. They clarified that Booking.com is not currently within the scope of future rules for paid-for fraudulent advertising, and any changes to this would be a government matter.