Fake 10 Downing Street listing exposes 'unfit' Booking.com, says consumer group

Consumer watchdog Which? discovered it was possible to create a fraudulent listing for 10 Downing Street on the travel booking website Booking.com. The UK regulator's researchers not only managed to book a fake stay at the iconic location, but they also left a phony review expressing excitement about hypothetically meeting the prime minister's cat. Despite clear indications that the listing was artificial, Booking.com did not remove the listing for two months after it was uploaded.

A representative from Booking.com stated that this limited test does not accurately represent the overall experience of the millions of listings and reviews on their platform. They explained that because Which?'s listing was not live on their site for the entire two-month period, some of their automated fraud controls did not trigger to completely remove the listing.

Booking.com emphasized that they have various checks and verification measures in place, including AI technologies, to detect and eliminate fraudulent listings within 24 hours.

However, Rory Boland, the Travel editor for Which?, criticized these measures as "unfit for purpose." He argued that if Booking.com's sophisticated AI systems cannot identify that 10 Downing Street is not a holiday rental, then it is unsurprising that scammers can exploit the platform so easily. Boland emphasized the significant risks for holidaymakers who could potentially lose thousands of pounds to fraudulent listings and phishing links.

This incident is not the first time Booking.com has faced criticism over its security efforts and customer service. Which? previously uploaded a similar listing to the site, which received 14 booking requests in just 20 minutes, with only one request from a known Which? researcher being accepted. During this short timeframe, Which? also sent the researcher a suspicious external link via Booking.com's system, which the platform did not flag or remove.

Booking.com addressed this issue by stating that they provide visible reminders to customers not to click on links they are unsure about, and booking confirmations offer additional guidance, including details of the agreed payment schedule. The fake review left by Which? also managed to bypass Booking.com's checks, despite its obvious characteristics of a joke.

The listing itself was eventually removed from the platform on August 27th. Booking.com acknowledged that fraud affects many industries, and 80% of UK adults believe scams are becoming more sophisticated. They stated that they continue to strengthen their defenses against these threats. Meanwhile, Which? called for more stringent measures to compel booking sites to swiftly remove false listings under the Online Safety Act (OSA), which requires firms to demonstrate their commitment to removing illegal content once it has been identified.

Boland suggested that Ofcom, the regulatory body enforcing the OSA, should be encouraged to use the Act to crack down on irresponsible online platforms.