Consumer group Which? has accused Booking.com of having security checks that are "unfit for purpose" after successfully creating a fake listing for 10 Downing Street on the platform. Researchers used images of the famous front door to advertise a "1 bedroom apartment" at the prime minister's address, and the listing remained live for two months before Booking.com removed it, raising concerns about how easily fraudsters could exploit the site and put holidaymakers at risk of scams.

The listing, uploaded on 18 June and taken down on 27 August, was only bookable during a 20-minute window Which? opened for testing, during which 14 people attempted to request a stay. A fake review mentioning Downing Street's cat Larry was also approved, and a suspicious external payment link sent to the researcher went unflagged, despite such links typically being blocked. Booking.com said the test did not reflect the experience of genuine listings, that its automatic fraud controls were not fully triggered because the listing was not "live" throughout, and that AI helps it remove most fraudulent listings within 24 hours. Which? is calling for stronger enforcement under the Online Safety Act to compel booking sites to remove fraudulent content more swiftly.