10 Downing Street listed as fake rental on Booking.com

Consumer protection organization Which? successfully bypassed security measures on Booking.com by posting a fake listing for 10 Downing Street, the official residence of the British Prime Minister. The listing, titled ‘one-bedroom apartment in the heart of London’, used real photographs of the building and its exact address.

During a 20-minute test period, 14 people submitted booking requests. The researchers were able to successfully book the property and even post a review mentioning Larry, the Prime Minister’s cat. The investigation highlighted significant security vulnerabilities, including the platform's failure to block external phishing links sent through its internal messaging system and a three-month window allowed for identity verification that enables fraudulent listings to remain active.

The fake advertisement remained on the platform for nearly two months before being removed. In response, Booking.com stated that the test does not faithfully reflect the experience of millions of legitimate listings and noted that they provide visible warnings to customers regarding suspicious links.