Fake 10 Downing Street listing on Booking.com highlights security failures

by | Sep 11, 2026 | Financial

Fake 10 Downing Street listing on Booking.com highlights security failures

A consumer watchdog organization successfully set up a fraudulent listing on the accommodation booking platform Booking.com purporting to offer the British prime minister’s official residence as a one-bedroom apartment. The listing, created on 18 June by researchers from Which?, included the property’s exact address and an authentic photograph. The property was described as being located in central London with convenient proximity to Parliament.\n\nThe researchers structured the listing to require booking requests rather than allowing automatic reservations. When a test booking window was opened, payment for a week-long stay was processed by the platform, though the funds remained unrefunded more than six weeks later. The watchdog also posted a fraudulent review describing the fictional stay as “exceptional” and referencing the residence’s well-known cat, Larry. The fake review appeared on the site almost immediately despite assurances from Booking.com that it would undergo moderation review.\n\nAdditionally, researchers used the platform’s internal messaging system to send links requesting credit card information, exploiting a gap in Booking.com’s security protocols. The watchdog claimed the platform possessed the technical capability to block such external URLs but had not implemented this safeguard. The listing remained active until 27 August, approximately six weeks after its creation.\n\nWhich? characterized the findings as evidence of “systemic security failures” and called for investigation by Ofcom, the UK communications regulator. A Booking.com representative responded that the test did not reflect typical platform operations and that the property was not visible to customers. The company stated it employs automated fraud detection systems that typically identify and remove suspicious listings within 24 hours. An Ofcom spokesperson confirmed that platforms have legal obligations regarding removal of illegal user-generated content.

Article Attribution | Read More at Article Source

Article summary produced by Claude AI