Booking Holdings—UK watchdog Which? created a fraudulent 10 Downing Street listing on Booking.com that stayed live for six weeks and took a real payment
UK consumer group Which? set up a fake listing for the UK Prime Minister's residence at 10 Downing Street on Booking.com in minutes, using the real address and photo. The listing received 14 inquiries in a 20-minute window, had a fabricated 10/10 review published despite promised moderation, and Booking.com processed a payment for a week-long stay that remained unrefunded more than six weeks later. Which? also used Booking.com's internal messaging system to send an external phishing-style payment link requesting card details without triggering interception. The listing stayed live for about six weeks before removal on August 27, 2026; under Booking.com policy, hosts are not required to provide ID or proof of ownership until three months after a listing goes live. Booking.com disputed the test's methodology, and Which? urged UK regulator Ofcom to investigate the platform's compliance with the Online Safety Act.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Consumer Protection | -against | primary | -1.00 |
| Data Security | -against | secondary | -0.50 |
| Overall incident score = | -0.231 | ||
Score = avg(topic contributions) × significance (medium ×1) × confidence (0.62)× agency (negligent ×0.5)
Evidence (2 signals)
The Independent: Which? set up Downing Street listing on Booking.com to expose security gaps
The Independent reported Which?'s creation of a fraudulent 10 Downing Street listing on Booking.com, the payment it processed, the fake review posted despite moderation claims, and Booking.com's response disputing the test's representativeness.
Travel Weekly: Booking.com security questioned following Which? fake listing test
Travel trade outlet Travel Weekly reported Which?'s call for Ofcom to investigate Booking.com's Online Safety Act compliance following the fake Downing Street listing test, and Ofcom's confirmation that platforms have legal duties to swiftly remove illegal user-generated content once notified.