A consumer watchdog has said it uncovered “systemic security failures” on Booking.com after it was able to set up and accept payment for a fake listing for 10 Downing Street.
On June 18, Which? listed a property on the travel site headlined “1 bedroom apartment in the heart of London” with the exact address and a picture of the Prime Minister’s home.
The listing – which was allegedly set up within minutes – also promised a four-minute walk to the Houses of Parliament.
It was set so that users had to request a stay and were not able to reserve and pay automatically, with the booking window opened briefly so that a representative could do a test before it was closed again.
According to Which?, Booking.com processed a payment for a week-long stay from a researcher.
It said that more than six weeks after it was set up, the money had still not been refunded.
A fake review was also uploaded to the site describing the stay as “exceptional” and making a reference to how enjoyable it was “hanging out with Larry The Cat”, Which? said.
Despite Booking.com sending a message saying that the review would be checked by a team of moderators, the consumer watchdog said it was added almost immediately.
The team of researchers were also able to use Booking.com’s mailing system to send an external URL asking the representative for credit card details to confirm the booking, Which? said.
The watchdog claimed the travel site had told them that it has the ability to block URLs being sent through the messaging system if it suspects fraudulent activity, but it had not done so.
According to Which? the listing was finally removed on August 27, some six weeks after it went live.
Rory Boland, editor of Which? Travel said: “If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily.
“It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.
“Booking.com’s checks are clearly unfit for purpose, and the Prime Minister must now urge Ofcom to use the Online Safety Act to crack down on irresponsible online platforms that leave consumers wide open to fraud.”
Booking.com is a digital travel site which enables users to book accommodation – including holiday rentals and hotels – as well as flights, car rentals and attractions.
It was founded in 1996 and now offers more than 28 million total reported accommodation listings, according to its website.
Which? said it has received “endless reports from consumers with dozens of complaints of receiving scam messages on the platform and hundreds of people arriving at properties to discover that the listing was fake”.
The watchdog said its investigation “uncovered systemic security failures across the platform”.
It urged Ofcom to launch an investigation into “Booking.com’s compliance and take robust action to stop the platform from continuing to break the rules”.
A Booking.com spokesperson said: “This limited test is not a true reflection of the experience of millions of listings on our platform. The property added by Which? was not visible to customers or ‘live’ for the time period referenced.
“We use a range of checks, verification measures and artificial intelligence, which help us detect and remove the majority of fraudulent listings within 24 hours.”
It said that as the property was not open and bookable, some of its automatic fraud controls were not triggered to completely remove the fraud listing.
The travel site said that fraud affects many industries, adding that it recognised this challenge and continues to strengthen defences to help protect customers and accommodation partners.
Booking.com said there are visible reminders to not click on links customers are not confident about, with booking confirmations providing further guidance, including details of the agreed payment schedule.
According to Which?, under Booking.com’s policies, hosts are not required to provide photo ID or proof of ownership until three months after a listing goes live.
An Ofcom spokesperson said: “For illegal content generated by users, platforms have existing legal duties that mean they must take it down swiftly once they become aware of it.
“Booking.com is not in scope of future rules that will apply to paid-for fraudulent advertising, and any change to that would be a matter for Government.”