A CONSUMER WATCHDOG managed to list 10 Downing Street as a holiday rental on Booking.com, take a booking and give the British prime minister’s home a glowing 10-out-of-10 review.

Which? Travel created the bogus listing as part of an investigation into security measures on the accommodation website, saying the experiment exposed serious gaps that could be exploited by scammers.

The listing, created on 18 June, advertised a “1-bedroom apartment in the heart of London” and included both a photograph of the famous black front door and the exact address of 10 Downing Street.

Which? Travel said it deliberately chose one of the world’s most recognisable addresses because it believed the listing was so obviously fake that Booking.com’s security systems would stop it from going live. They didn’t.

The magazine said the listing was created without its researcher having to provide proof that they owned the property or even prove their identity. Under Booking.com’s own rules, the magazine said, the researcher did not have to provide proof of ID until three months after the listing went live.

The listing was set up so that prospective guests had to request a stay rather than being able to book automatically.

However, Which? said 14 people inquired about staying at the property within just 20 minutes of it being opened for bookings.

“If you live abroad, you may have no clue this is the Prime Minister’s home – it’s just a bargain in central London,” the watchdog said.

A week at Downing Street

The investigation went further when a member of the Which? team was able to make and pay for a week-long booking at the address through Booking.com.

Which? said Booking.com subsequently cancelled the stay on 31 August, more than two months after the listing was created, and contacted it about a refund.

The watchdog said it was unclear from the email whether it would receive the entire amount back.

Which? also tested whether the account could be used to send potential guests away from Booking.com’s website.

Despite having only registered as a host that day, its researcher was able to use Booking.com’s messaging system to send an external link asking for credit card details to confirm a booking.

The watchdog highlighted this as particularly concerning because scammers can use external links to direct victims to fraudulent websites designed to steal money or financial information.

Which? said Booking.com has previously stated that it uses “sophisticated AI systems” to detect fraud, questioning why those systems did not recognise an image of one of the most photographed buildings in the world.

An ‘exceptional’ stay

The watchdog then took the experiment one step further by leaving a fake review of its fake holiday.

“It was unbelievable that Booking.com let us stay at 10 Downing Street – the home of the UK PM!” the 10-out-of-10 review said.

To make the joke even more obvious, the reviewer said their favourite part of the stay was Hanging out with Larry The Cat. Alamy Stock Photo Alamy Stock Photo

Despite Booking.com’s system saying the review would be checked by its moderation team before publication, Which? said it appeared within minutes.

The perfect score meant the prime minister’s residence was subsequently rated “exceptional” on Booking.com.

The account was eventually deleted on 27 August, around two months after it had been created.

Which? Travel editor Rory Boland said the findings would be funny were it not for the potential consequences for people using the website.

“It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links,” Boland said.
Booking.com said the experiment did not reflect the experience of the vast majority of properties advertised on its platform.

It said it uses a range of checks, verification measures and AI-powered technology and detects and removes most fraudulent listings within 24 hours.

The company also said the Downing Street property was not visible to customers for the entire period highlighted by Which?, as the researchers had closed it for bookings for much of that time.

It said some automatic fraud controls were therefore not triggered and that it continues to strengthen protections as scams become more sophisticated.

“We can confirm that we use a range of checks and verification measures to help protect our platform, alongside technologies including artificial intelligence,” a statement from Booking.com said.

“Together, these measures help us detect and remove the majority of fraudulent listings within 24 hours. We also have tools in place to help protect the integrity of our reviews programme.”