Booking.com security vulnerabilities investigation

The consumer watchdog Which? exposed security vulnerabilities on Booking.com by successfully creating a fraudulent rental listing for 10 Downing Street, the official residence of the British Prime Minister. The fake advertisement, described as a ‘one-bedroom apartment in the heart of London’, utilized real photographs and the building’s exact address.

During a 20-minute window where the listing was visible to the public, 14 people submitted inquiries or booking requests. Researchers were also able to post a review mentioning the Prime Minister’s cat, Larry. The investigation revealed that the fraudulent listing remained active on the platform for nearly two months before being removed.

Which? criticized the platform’s verification processes, noting that Booking.com does not require identity verification from hosts until three months after a listing goes live. The watchdog also highlighted the platform’s failure to block external phishing links sent through its internal messaging system.

In response, a Booking.com spokesperson stated that the test did not faithfully reflect the experience of millions of legitimate listings and noted that certain automatic fraud controls were not triggered because the listing was not ‘live’ across the entire site during the testing period. The company maintained that it uses AI and various measures to detect and remove the majority of fraudulent listings within 24 hours.