Key facts
- Consumer group Which? successfully created a fake listing for 10 Downing Street on Booking.com.
- The fake listing remained on the platform for two months before being removed.
- Booking.com stated that its automatic fraud controls were not fully triggered because the listing was not live to the public.
- Which? argued that Booking.com's security systems, including AI, failed to detect the fraudulent listing.
- The consumer group also noted that a message with an external link, intended to scam users, was not flagged by Booking.com.
- Which? is urging for stronger action under the Online Safety Act to address such fraudulent listings.
Consumer group Which? has revealed it was able to create a fake listing for 10 Downing Street on the travel platform Booking.com, raising concerns about the site's security measures.
According to Which?, its researchers were able to upload a bogus listing for the UK Prime Minister's residence, complete with images of the iconic address and a description advertising it as a 'prime city centre location'. The listing remained on the platform for two months before being removed on August 27.
During a 20-minute window when the listing was accessible, 14 people reportedly requested to book the fake property. Which? also noted that a message containing an external link, designed to phish for payment details, was not flagged by Booking.com.
A Booking.com spokesperson told the BBC that the limited test by Which? was not representative of the platform's usual experience. They explained that because the listing was not 'live' for the entire two-month period, some automatic fraud controls were not triggered. The company stated that its AI technologies typically detect and remove the majority of fraudulent listings within 24 hours and that various checks and verification measures are in place.
However, Rory Boland, Travel Editor at Which?, criticized Booking.com's systems, stating, "If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily." He added that such issues could lead to holidaymakers losing significant amounts of money.
Which? is now calling for stricter enforcement of the Online Safety Act, urging Ofcom to take action against online platforms that fail to swiftly remove fraudulent content once identified. An Ofcom spokesperson confirmed that platforms have existing legal duties to remove illegal content promptly upon becoming aware of it.