A fake Booking.com listing for 10 Downing Street was created within minutes by consumer watchdog Which?, which said it uncovered "systemic security failures" on the travel site.
The listing described the Prime Minister's residence as a "1 bedroom apartment in the heart of London" and promised a four-minute walk to the Houses of Parliament. It featured the exact address and a picture of the property.
Payment processed for fake stay
Although the listing was set up so users had to request a stay before paying, Which? said a researcher had a payment processed for a week-long stay at the address. A fake review was also uploaded, referencing how enjoyable it was "hanging out with Larry The Cat".
The listing was removed on August 27, around six weeks after it went live, with the money spent on the fake booking still not refunded within that timeframe.
Which? urges Ofcom action
Rory Boland, editor of Which? Travel, said: "If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily."
He added: "It would be laughable that we were able to list the UK's most famous address for rent, if the consequences weren't so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.
"Booking.com's checks are clearly unfit for purpose, and the Prime Minister must now urge Ofcom to use the Online Safety Act to crack down on irresponsible online platforms that leave consumers wide open to fraud."
Booking.com response
A Booking.com spokesperson said: "This limited test is not a true reflection of the experience of millions of listings on our platform. The property added by Which? was not visible to customers or 'live' for the time period referenced.
"We use a range of checks, verification measures and artificial intelligence, which help us detect and remove the majority of fraudulent listings within 24 hours."
The company said that as the property was not open and bookable, some automatic fraud controls were not triggered to completely remove the fraud listing. It added that fraud affects many industries and that it continues to strengthen defences.
Booking.com, founded in 1996, now offers more than 28 million total reported accommodation listings, according to its website.
Which? said it has received "endless reports from consumers with dozens of complaints of receiving scam messages on the platform and hundreds of people arriving at properties to discover that the listing was fake" and urged Ofcom to launch its own investigation.
According to Which?, under Booking.com's policies, hosts are not required to provide photo ID or proof of ownership until three months after a listing goes live.
An Ofcom spokesperson said: "For illegal content generated by users, platforms have existing legal duties that mean they must take it down swiftly once they become aware of it.
"Booking.com is not in scope of future rules that will apply to paid-for fraudulent advertising, and any change to that would be a matter for Government."
