Imagine browsing for a short-term rental in London and stumbling across an available room at the most famous address in British politics. Sounds absurd? That is precisely what consumer watchdog Which? managed to pull off, creating a fraudulent listing for 10 Downing Street on Booking.com and leaving it sitting on the platform, unchallenged, for two full months. The stunt, reported by the BBC, has reignited serious questions about whether the travel industry’s biggest platforms are doing nearly enough to protect ordinary holidaymakers from losing their savings to bogus properties.
The Stunt That Shocked the Industry
Which? researchers built a listing for the UK Prime Minister’s official residence and successfully submitted it to Booking.com, one of the world’s largest online travel agencies. For good measure, they also added a fake review. The highlight of the fictional stay? “Hanging out” with Larry the Cat, the celebrated Downing Street mouser who has outlasted multiple prime ministers and earned a devoted following in his own right.
The listing remained on the platform for approximately two months. Which? says that despite what it describes as obvious red flags, Booking.com’s systems did not automatically flag and remove it during that period. The group opened a 20-minute booking window so its own researchers could attempt to reserve the property, and during that brief window, the listing was both visible and bookable to anyone who happened across it.
Which? Travel editor Rory Boland did not mince words in his assessment. As reported by the BBC, Boland said the platform’s fraud controls had been shown to be “unfit for purpose,” adding that if sophisticated AI systems cannot identify that the Prime Minister’s official address is not a holiday rental, it is little wonder scammers find the platform easy to exploit. He acknowledged the darkly comic nature of the exercise, but was quick to point out that the real-world consequences for deceived travellers are anything but funny, with victims potentially losing thousands of pounds to fake listings and phishing schemes.
Booking.com’s Defence
The company pushed back, and its argument is worth understanding rather than dismissing outright. A spokesperson told the BBC that the Which? listing was never “live” on the site during the two-month window, meaning it was in a closed state for the vast majority of that time. Because of this, the spokesperson said, certain automatic fraud controls were never fully activated. The implication is that the platform’s systems are calibrated to target active, live listings rather than dormant ones sitting in the back end.
Booking.com also pointed to its wider infrastructure, noting that a combination of checks, verification processes, and AI-powered detection tools removes the majority of fraudulent listings within 24 hours of them going live. The company stressed that Which?’s test was a narrow and controlled experiment, not representative of how the platform handles millions of legitimate listings and reviews every day.
That defence has some logic to it. Platforms of Booking.com’s scale process an almost unimaginable volume of new content daily, and no automated system, however well designed, achieves a perfect record. The question, however, is not whether the company handles fraud well most of the time. It is whether the gaps in its system are wide enough for determined criminals to exploit at scale.
Why This Matters Beyond a PR Embarrassment
The Downing Street listing is, admittedly, a theatrical example. No scammer is realistically going to list Number 10 and expect tourists to hand over a deposit. But the point Which? is making is not about that specific property. It is about whether the underlying verification systems are robust enough to catch the far less obvious fake listings that genuinely deceive travellers every year.
Holiday rental fraud has grown steadily as a category of consumer crime. Victims typically pay upfront for accommodation that either does not exist, belongs to someone else, or has been listed without the real owner’s knowledge. By the time they arrive at their destination, the money is gone and their holiday is in ruins. In some cases, families have turned up at properties only to find them occupied by the actual residents, who have no idea their home appeared on a booking platform.
The financial damage can be severe. Deposits and full payment demands are common in the short-term rental market, and losses of several thousand pounds per booking are not unusual. For families saving all year for a holiday, that kind of loss is not an inconvenience. It is a genuine crisis.
The Bigger Picture for Online Travel Platforms
Booking.com is not uniquely vulnerable to this kind of fraud. The challenge of fake listings affects the broader short-term rental and online travel sector, touching platforms across the industry. But Booking.com’s scale makes it a natural focal point. With hundreds of millions of listed properties in countries around the world, even a small percentage of fraudulent content represents an enormous number of potential victims.
Consumer groups and regulators have been pressing for stronger verification standards for years. The argument is straightforward: if a platform profits from connecting travellers with properties, it carries a meaningful responsibility to ensure those connections are legitimate. At present, the burden of loss tends to fall on the traveller rather than the platform, which critics argue creates a structural incentive to underinvest in fraud prevention.
The UK’s Which? has a long history of running exactly these kinds of investigative tests to demonstrate gaps between what companies claim and what they deliver. Its findings carry weight with both consumers and policymakers, and this particular exercise is likely to resurface in regulatory conversations about how online platforms should be held accountable for the content they host.
What Travellers Can Do Right Now
While the debate over platform responsibility continues, travellers are largely left to protect themselves. A few practical habits go a long way. Always pay through the platform’s official payment system rather than transferring money directly to a landlord or host. Be suspicious of any listing that redirects you to external websites for booking or payment. Cross-check addresses using mapping tools before committing any money. And if a deal looks significantly cheaper than comparable properties in the same area, treat that as a warning sign rather than a bargain.
Reading reviews carefully also helps, though as the Which? test demonstrated, fake reviews can be posted with relative ease. Look for reviewers with a history of other reviews across the platform, and be wary of profiles that appear to have been created specifically to leave a single glowing comment.
The Which? findings are a sharp reminder that the convenience of online booking comes with real risks, and that platforms are not infallible gatekeepers. Larry the Cat may have notional overnight guests on his profile now, but the holidaymakers who lose real money to fraudulent listings are dealing with consequences that no amount of feline charm can fix.
So here is the question worth sitting with: if a listing for the most scrutinised address in British public life can slip through an AI-powered fraud detection system for two months, what does that say about the protection genuinely vulnerable travellers can expect when they book their next holiday online?
