A consumer advocacy group, Which?, has revealed that it successfully created a fake listing for 10 Downing Street, the official residence of the UK prime minister, on the travel booking platform Booking.com. The organization reported that the bogus listing remained on the site for two months before being removed.
Which? stated that its researchers were able to book a fictitious stay at the prime minister's address and even posted a fake review. The review humorously noted "hanging out" with Larry the cat, the resident feline, as a highlight. Despite what the group described as clear indicators of its falsity, the listing was not taken down until two months after it was uploaded.
A spokesperson for Booking.com commented that the "limited test" by Which? was "not a true reflection of the experience of millions of listings or reviews published on our platform." They explained that because the listing was not actively live on the site for the entire two-month period, some automatic fraud detection systems were not triggered to remove the closed listing. Users could only view and request to book the property during brief 20-minute windows that Which? researchers intentionally opened.
Booking.com further stated that its platform employs "a range of checks and verification measures" and utilizes technologies such as AI to detect and remove the majority of fraudulent listings within 24 hours. However, Rory Boland, Which? Travel editor, criticized the platform's systems, stating they were "unfit for purpose." He argued that if Booking.com's sophisticated AI could not identify that 10 Downing Street is not a holiday rental, it makes it easier for scammers to exploit the platform. Boland expressed concern that such vulnerabilities could lead to significant financial losses for holidaymakers falling victim to bogus listings and phishing attempts.
This incident is not the first time Booking.com has faced scrutiny regarding its security protocols and customer service.