A UK consumer watchdog, Which?, created a fake listing for 10 Downing Street on Booking.com, which remained for two months and accepted a payment, highlighting alleged systemic security failures on the travel platform.
The incident highlights potential vulnerabilities in online booking platforms' security and AI systems, raising questions about consumer protection against fraudulent listings and phishing attempts.
Consumer group Which? has revealed it successfully created a fake listing for 10 Downing Street on the travel platform Booking.com, raising concerns about the site's security measures. Researchers from Which? uploaded a bogus listing for the UK Prime Minister's residence, complete with images and a description advertising it as a 'prime city centre location'. The listing remained on the platform for two months before being removed on August 27.
During a 20-minute window when the listing was accessible, 14 people reportedly requested to book the fake property. Which? also noted that a message containing an external link, designed to phish for payment details, was not flagged by Booking.com.
A Booking.com spokesperson stated that the test was not representative of the platform's usual experience, explaining that because the listing was not 'live' for the entire period, some automatic fraud controls were not triggered. The company added that its AI typically detects and removes most fraudulent listings within 24 hours.
Rory Boland, Travel Editor at Which?, criticized Booking.com's systems, stating that if they cannot identify 10 Downing Street as not being a holiday rental, it allows scammers to exploit the platform easily. Which? is calling for stricter enforcement of the Online Safety Act, urging Ofcom to take action against platforms that fail to remove fraudulent content promptly.
An Ofcom spokesperson confirmed that platforms have legal duties to remove illegal content upon becoming aware of it.
Pick the topics you care about. Get only what matters, on your cadence.