Fake 10 Downing Street Listing Fools Booking.com

British consumer group Which? says it created a fake Booking.com listing for 10 Downing Street — the prime minister's official residence — in a matter of minutes, and that the travel site accepted a booking and processed a payment for a week-long stay.

The watchdog says the listing, headlined "1 bedroom apartment in the heart of London," went up on June 18 and was not removed until August 27.

Which? calls the result proof of "systemic security failures" at one of the world's largest travel platforms. Booking.com says the exercise was a "limited test" that is "not a true reflection of the experience of millions of listings or reviews published on our platform."

What the watchdog did

The listing used a photograph of the famous black door of Number 10 and gave the actual address, according to Which? and the BBC. The description called it "a prime city centre location," said it was "situated on 10 Downing Street," and advertised a short walk to Big Ben — 400 metres, per the BBC's account of the page. The Independent reported the ad also promised a four-minute walk to the Houses of Parliament.

Which? set the property to require a booking request rather than instant confirmation, and opened the listing to the public for only a 20-minute window. In those 20 minutes, the watchdog says, 14 people asked to stay at the prime minister's house. Only the request from a Which? researcher was accepted.

Booking.com then processed payment for a week-long stay from that researcher, Which? said. More than six weeks later, according to the Independent, the money had not been returned.

Researchers also tested the site's anti-phishing controls by messaging the "guest" through Booking.com's own system with an external link asking for credit card details to confirm the booking. Which? says the platform did not flag or block it, even though Booking.com had told the group it can block URLs when it suspects fraud.

A review was posted on the fake page on August 11 under the name Trevor, rating the stay 10 out of 10 — "Exceptional." It read: "It was unbelievable that Booking.com let us stay at 10 Downing Street - the home of the UK PM!" The highlight listed was "Hanging out with Larry the Cat," the residence's resident mouser. The downside: "Some guy was moving in during our stay - but it was fine." Which? says Booking.com messaged that moderators would check the review, then published it soon after.

Which? also says that under Booking.com's own policies, hosts are not required to provide photo ID or proof of ownership until three months after a listing goes live.