- Which? listed 10 Downing Street as a fake holiday rental, complete with a photo of the famous front door.
- Booking.com processed a test payment and allowed a fake review praising the stay and Larry the cat.
- Which? says the experiment exposed “systemic security failures” that could leave genuine holidaymakers vulnerable to fraud.
Fancy spending a week at 10 Downing Street?
For a brief period, Booking.com appeared to have the perfect answer — and the listing even promised that Parliament was only a four-minute walk away.
There was just one small problem: 10 Downing Street is not a holiday rental.
Consumer watchdog Which? has accused Booking.com of “systemic security failures” after its researchers managed to list the Prime Minister’s official residence on the platform as a “1 bedroom apartment in the heart of London”.
The fake listing, created on June 18, used the exact Downing Street address and a photograph of the Prime Minister’s famous black door.
The researchers deliberately set it up so that guests had to request a stay rather than book instantly. When the booking window was briefly opened for testing, 14 people attempted to book the property.
More seriously, a Which? researcher was able to process an actual payment for a week-long stay.
The money had still not been refunded more than six weeks later, according to Which?.
Even Larry the cat got a five-star review
The experiment then became considerably more ridiculous.
Which? researchers added a fake review on August 11, giving the property an “exceptional” rating and praising the experience of “hanging out with Larry the cat” — the famous feline who lives at Downing Street.
Booking.com responded by saying the review would be checked by its moderation team.
According to Which?, the review appeared on the platform almost immediately.
The researchers also tested Booking.com’s messaging system, using a separate account to send an external web link asking for payment details to confirm the booking.
That is particularly significant because phishing links are a common tool used by scammers to steal customers’ financial information.
Which? said Booking.com had previously told it that the platform could block external URLs in messages where fraudulent activity was suspected. The watchdog said that protection did not prevent its test message from being sent.
The fake listing was eventually removed on August 27, more than six weeks after it was first created.
The joke stops being funny here
Which? said the experiment highlighted wider weaknesses in Booking.com’s systems for detecting fake accommodation and protecting customers from scams.
The watchdog pointed to an earlier investigation in 2024 in which it created another fake listing. It said Booking.com took 18 months to request proof of identity from the account behind that property, with the listing eventually blocked after the requested verification was not provided.
Rory Boland, editor of Which? Travel, said it would be “laughable” that researchers could rent out the UK’s most famous address if the consequences for holidaymakers were not potentially serious.
The watchdog has called on Ofcom to investigate whether Booking.com is meeting its obligations under the Online Safety Act.
Ofcom said platforms have existing legal duties to remove illegal user-generated content swiftly once they become aware of it. It also said Booking.com is not currently within the scope of future rules covering paid-for fraudulent advertising.
Booking.com, however, disputed Which?’s characterisation of the test.
The company said the experiment did not reflect the experience of millions of listings and reviews on its platform. It said the property was not genuinely visible and bookable for the period claimed and that some automatic fraud controls were therefore not triggered.
Booking.com also said it uses verification checks, artificial intelligence and other technology to detect fraudulent listings, claiming the majority are removed within 24 hours.
The company said it continues to strengthen its defences against increasingly sophisticated scams.
So, no — you probably cannot actually book 10 Downing Street for your next London break.
But the fact that Which? was able to make the Prime Minister’s home look bookable, process a test payment and get Larry the cat a five-star review has left Booking.com with a rather awkward question to answer: if researchers could fool the system this easily, how hard is it for an actual scammer?
