Full Breakdown
Fake 10 Downing Street Listing Exposes Booking.com Security Gaps
9/2/2026, 12:02:02 PM
Core Event: Prime Minister’s Residence Advertised as a Holiday Let
Researchers from the consumer watchdog Which? The listing displayed the iconic front door and claimed a four-minute walk to the Houses of Parliament. It was set to “request-only” status, but the window was opened for 20 minutes to allow a test reservation for a week at the end of July. Within that period 14 people inquired about availability. The advert remained live for six weeks before Booking.com removed it on 27 August.
Background & Context
The Platform Operators (Due Diligence and Reporting Requirements) Regulations introduced in 2024 require accommodation platforms to verify listings to curb tax evasion and fraud. Booking.com’s own policy, however, allowed a new host to operate for three months without providing photo ID or a National Insurance number. Which? noted that the platform only requested identity verification 20 months after the fake listing was first created.
Data & Statistics
- Listing creation time: roughly 15 minutes.
- Inquiries in the first 20 minutes: 14.
- Advertised rate: £55 per night.
- Duration on the platform: six weeks (from 18 June to 27 August).
- Booking.com’s internal rule: host ID not required until three months after a listing goes live.
- Refund email received by Which? on 31 August; amount and fees not confirmed.
Official Statements & Responses
Booking.com said its platform employs “advanced machine-learning models” and “fraud detection” tools that protect users. A spokesperson explained that the test listing “was not open and bookable,” so automatic fraud controls were not triggered.
Which? Which? also reported that, despite notifying Booking.com that the listing was fraudulent, the platform only cancelled the stay and sent a refund email on 31 August, leaving the refund amount uncertain.
Criticism & Opposition
The incident has been described as evidence of “systemic security failures” across Booking.com’s platform. Consumer-rights advocates argue that the ability to post external URLs through the site’s messaging system, combined with delayed verification, creates a fertile environment for scammers.
Conflicting Reports & Gaps
Which? states that it has not received a full refund for the test booking and is still out of pocket for the £55 nightly charge plus any associated fees. Booking.com’s email on 31 August confirmed a cancellation but did not specify whether the full amount would be returned, leading to uncertainty about the final financial outcome for the tester.
Verbatim Quotes
- “If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily.” — Rory Boland, editor of
What’s Next
Which? has called on Ofcom, the UK communications regulator, to investigate Booking.com’s security procedures.
