Which? Says It Rented Out 10 Downing Street on Booking.com for Ten Weeks Before the Listing Was Pulled

Which? Travel, a UK consumer watchdog, says it built a fake holiday rental listing for 10 Downing Street on Booking.com and the platform let it sit live for weeks, took a payment, and approved a fake five-star review in what the group calls a demonstration of "systemic security failures."

According to Which?, a researcher created the listing on June 18, headlined "1 bedroom apartment in the heart of London." It used the real Downing Street address, a photo of the Prime Minister's famous black front door, and a pitch promising a four-minute walk to the Houses of Parliament. Which? says the whole setup took minutes.

The group configured the listing so guests had to request a stay rather than book instantly, then opened the booking window for a short period so a researcher could test it. Which? says 14 different people tried to book the Prime Minister's residence during that window before it closed again.

Booking.com then processed a payment for a week-long stay from the Which? researcher, according to the group, and as of its report the money had not been fully refunded. Which? says it only received an email in late August referencing a possible cancellation and refund, without clarity on whether the platform would keep a fee.

Which? also posted a fake review on August 10 rating the stay 10 out of 10, describing it as "exceptional" and referencing time spent "hanging out with Larry the Cat," the real cat that lives at Downing Street as Chief Mouser. Booking.com's system told the reviewer it would be checked by a moderation team. Which? says it appeared on the site almost immediately.

The listing itself was not removed until August 27, roughly ten weeks after it went up on June 18. The BBC's reporting on the incident correctly describes this as "two months." Both The Independent and Perspective Media described the same gap as "six weeks," which does not match the June 18 to August 27 timeline any outlet, including Which?, actually laid out.

Which? Travel editor Rory Boland didn't mince words. "If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily," he said. Boland called the episode a real threat to ordinary travelers, saying scam listings put people at risk of losing "thousands of pounds" to fake bookings and phishing links, and he called on the Prime Minister to push Ofcom to use the Online Safety Act against platforms with weak controls.

Which? also flagged a second gap in Booking.com's defenses: its researchers used the platform's own internal messaging system to send the tester an external link requesting payment card details, something legitimate booking platforms typically block because it's a classic phishing tactic. Which? says Booking.com had told them it can detect and block such links when fraud is suspected. It didn't happen here.

Booking.com pushed back on how representative the test was. A company spokesperson told the BBC that "this limited test is not a true reflection of the experience of millions of listings or reviews published on our platform." The spokesperson said the listing was never actually "live" or visible to the public outside Which?'s brief testing windows, and because it stayed in a closed state, "some of our automatic fraud controls were not triggered to completely remove the closed listing." Booking.com said it uses "a range of checks, verification measures" plus AI tools that catch and remove the majority of fraudulent listings within 24 hours, and pointed to visible warnings telling guests not to click unfamiliar links.

A listing that's technically dormant and only briefly opened to the public through a controlled test isn't the same as an active scam preying on the general public around the clock. Booking.com processes an enormous volume of listings globally. If the platform's automated review pipeline is built around active-listing signals, a test rigged to stay mostly closed could genuinely dodge some triggers by design, not just by negligence.

But Which? says this isn't its first rodeo with Booking.com. The group ran a similar test in October 2024, setting up a fake rental with no ownership verification required. That listing wasn't blocked until 20 months later, after new UK rules, the Platform Operators (Due Diligence and Reporting Requirements) Regulations, forced Booking.com to start asking for photo ID and a National Insurance number. Notably, that regulation exists mainly to catch landlords dodging taxes, not to stop fraud. Catching scammers was supposed to be a side benefit. Which?'s own account notes that for the Downing Street listing this year, no identity checks were carried out at all, meaning the newer rules didn't even come into play this time.

Booking.com has not announced any changes to its verification timeline in response to this specific test, and Ofcom has not announced any investigation. Whether Which?'s researcher gets a full refund for the fake week at 10 Downing Street, or whether Booking.com keeps a service fee on a booking everyone agrees was fraudulent, remains an open question as of this reporting.