Glaring gaps in Booking.com's security have been exposed by a Which? investigation, after researchers were able to set up and accept payments for a fake listing for 10 Downing Street.
Despite Booking.com claiming to use advanced AI and multiple security controls, Which? Travel set up the fake listing for the world-famous building in minutes.
Under Booking.com's own policies, hosts are not required to provide photo ID or proof of ownership until three months after a listing goes live.
Booking.com has seen many complaints of users receiving scam messages on the platform and hundreds of people arriving at properties to discover that a listing they booked was fake.
To make matters worse, when customers have tried to contact Booking.com for help, they have initially been directed to an ineffective AI chatbot.
On June 18, a Which? researcher listed a property on Booking.com, titled '1 bedroom apartment in the heart of London', including the exact address and a photo of the most famous front door in Britain, 10 Downing Street.
The listing was set up so users had to request a stay – meaning bookings required approval as opposed to being accepted automatically.
Consumer champions at Which? set up a fake Booking.com listing - with 10 Downing Street as an address available for customers to 'book'
The Which? Travel team opened the booking window very briefly so a representative could do a test booking, and then it was closed again.
But even within this short time, 14 people got in touch to ask if they could stay at the Prime Minister's home.
Booking.com even processed a payment from a Which? researcher using a different account for a week-long stay at the fake listing.
The money has still not been refunded, more than six weeks after it was set up.
The consumer champion then added a fake review on August 11, giving it 10/10, an 'exceptional' rating.
After writing the review, Booking.com sent a message saying that it would be 'checked by our team of moderators'.
However, the review appeared almost immediately, including a reference to how enjoyable it was hanging out with 'Larry The Cat'.
Despite only becoming a host on that same day, and the listing itself being fake, the Which? Travel team were able to use Booking.com's own mailing system to send an external URL asking the Which? representative from another account to enter credit card details to confirm the booking.
While competitors such as Airbnb automatically block external web links in messages to protect users from phishing scams, Booking.com failed to intercept the link.
Booking.com told Which? that it has the ability to block URLs being sent through the messaging system, if it suspects fraudulent activity.
In this instance, however, it failed to do so.
Booking.com even processed a payment from a Which? researcher attempting to book a stay at the listing, shown above
The listing was not removed until August 27, after Which? had given Booking.com a final opportunity to comment on the investigation.
Which? previously investigated Booking.com in October 2024. In a similar turn of events, a fake listing was created within 15 minutes.
It took a full 18 months for Booking.com to require proof of identity for the listing, despite the platform claiming to take verifying accommodation seriously, with multiple checks before listings become bookable.
When Which? did not provide this information, the listing was finally blocked – 20 months after it was first set up.
Under the Online Safety Act, Booking.com is legally required to have measures in place to mitigate against consumers encountering fake listings in the first place.
For any listings that bypass these security controls, Booking.com is obliged to act swiftly, removing any forged accommodation options.
Yet despite Which? investigations uncovering countless examples of fraud over the past year, Office of Communications (Ofcom), the regulator responsible for enforcing the Act, has done little to hold the booking site to account.
The fact that the most famous front door in Britain, 10 Downing Street, was not flagged when the listing was set up raises serious questions
Rory Boland, editor of Which? Travel said: 'If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily.
'It would be laughable that we were able to list the UK's most famous address for rent, if the consequences weren't so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.
'Booking.com's checks are clearly unfit for purpose, and the Prime Minister must now urge Ofcom to use the Online Safety Act to crack down on irresponsible online platforms that leave consumers wide open to fraud.'
A spokesman for Booking.com said: 'This limited test is not a true reflection of the experience of millions of listings or reviews published on our platform.
'The property added by Which? was not visible and 'live' for the time period referenced, and as it was not open and bookable, some of our automatic fraud controls were not triggered to completely remove the closed listing.
'Of the other examples shared by Which? not all listings have been proven to be fraudulent.
'We can confirm that we use a range of checks and verification measures to help protect our platform, alongside technologies including artificial intelligence.
'Together, these measures help us detect and remove the majority of fraudulent listings within 24 hours. We also have tools in place to help protect the integrity of our reviews programme.
Booking.com has seen many reported scams in recent months
'Fraud affects many industries, and 80 per cent of UK adults believe scams are becoming more sophisticated.
'We recognise this challenge and continue to strengthen our defences, helping protect our accommodation partners and customers. This includes tools that limit links in partner-to-guest messages - which have proved effective with professional scammers moving to other channels.
'There are visible reminders to not click on links customers are not confident about, and booking confirmations also provide further guidance, including details of the agreed payment schedule. Our Help Centre explains how customers can reach our Customer Service team, including local phone numbers.'
A spokesman for Ofcom said: 'For illegal content generated by users, platforms have existing legal duties that mean they must take it down swiftly once they become aware of it.
'Booking.com is not in scope of future rules that will apply to paid-for fraudulent advertising, and any change to that would be a matter for Government.'