Editor's note: This brief was summarised by The Property AI Newsroom from a report by Guardian Property. Read the original article for full details.

Fake 10 Downing Street Listing on Booking.com Raises Security Concerns

A fake listing for 10 Downing Street was created and payment was accepted on Booking.com, according to an investigation by consumer watchdog Which?. The listing, described as a “1 bedroom apartment in the heart of London,” was set up by Which? researchers and remained online for six weeks.

The Which? team listed the property on 18 June, using the exact address and a photo of the prime minister’s residence. The listing required users to request a stay, rather than allowing automatic booking and payment. Which? reported that a payment for a week-long stay was processed by Booking.com, and the money had not been refunded more than six weeks later.

A fake review was also uploaded, referencing “hanging out with Larry the cat.” Which? stated that despite Booking.com’s message that reviews would be checked by moderators, the review appeared almost immediately. The researchers also used Booking.com’s messaging system to send an external URL requesting credit card details, and Which? said the platform did not block the message, despite claiming it could block suspicious URLs.

The listing was removed on 27 August, six weeks after it was created. Which? said its investigation revealed “systemic security failures across the platform” and called for Ofcom to investigate. Booking.com responded that the test was not representative of the experience of millions of listings on its platform, and said the property was not visible or “live” for the referenced period. The company stated it uses various checks, verification measures, and artificial intelligence to detect and remove most fraudulent listings within 24 hours. Booking.com also said that because the property was not open and bookable, some automatic fraud controls were not triggered.

Ofcom commented that platforms have legal duties to remove illegal user-generated content once it is known, but Booking.com is not currently within the scope of future rules on paid-for fraudulent advertising.

This incident highlights the importance of robust verification and fraud prevention measures for online property listings, which is relevant for UK letting agents and inventory clerks monitoring the integrity of digital platforms.