Consumer Group Creates Fake 10 Downing Street Listing on Booking.com, Citing Security Flaws

Fake Listing Created

The consumer group Which? reported that its researchers were able to create a fraudulent listing for 10 Downing Street, the UK Prime Minister's residence, on Booking.com. The listing advertised a "1 bedroom apartment in the heart of London" with images of the iconic front door. Researchers successfully booked a stay and left a fake review mentioning "hanging out" with Larry the cat.

Booking.com's Response

Booking.com stated that the listing was not "live" for the majority of the two months it was present, which prevented some automatic fraud controls from being triggered. The company added that its systems, including AI, typically detect and remove most fraudulent listings within 24 hours. They also mentioned that a range of checks and verification measures are in place to secure the site.

Criticism from Which?

Which? Travel editor Rory Boland stated that Booking.com's checks were "unfit for purpose." He argued that if the platform's AI cannot identify 10 Downing Street as a non-rental property, it indicates a vulnerability that scammers can exploit. Which? highlighted that 14 people requested to book the fake property during a 20-minute window when it was made visible.

Security Implications

The consumer group also noted that its researchers were sent a message within Booking.com's system asking them to click an external link to confirm payment details, a common phishing tactic. This incident raises concerns about the platform's ability to protect users from fraudulent listings and potential financial losses.