Where to next?
Discover inspiring destinations, recommended by our in-house travel experts. Know the best places to go, who to book with and how to pay less.
Join Which? TravelHouses of Parliament used in new Booking.com scam
Westminster base for hundreds of MPs used in fake luxury flat listing
Trevor Baker has almost 20 years experience as a travel writer, having lived in Spain before becoming an award-winning investigative journalist.
The world’s-biggest accommodation booking platform is still failing to stop fraudsters scamming its customers.
Armed security guards at an office block belonging to the House of Commons have had to turn away Booking.com customers after criminals used the address to set up a scam listing on the world’s largest accommodation booking platform.
Incredibly, when some customers became suspicious after receiving a request for bank details, Booking.com told them to go to Westminster and look for the supposed ‘apartment’.
Many did just that, and found themselves being turned away by security guards with guns.
House of Commons - and Wetherspoons - on Booking.com
It’s a bizarre echo of the investigation Which? Travel carried out this summer, where we demonstrated how poor Booking.com’s checks on hosts are by listing 10 Downing Street as a holiday let.
The Portcullis House listing was created prior to the publication of our story and, despite bookings being blocked, it has been visible on the platform for months.
Criminals used photos of a genuine flat to create what they called ‘Apartments near Big Ben’.
Booking.com doesn’t appear to have carried out even the most basic checks on the renamed listing. The address was given as Portcullis House, which - far from being a luxury apartment - is part of the House of Commons estate, where hundreds of MPs work.
Another scam, seemingly created by the same criminal gang, saw dozens, perhaps hundreds, of victims turning up at a Wetherspoons pub.
Booking.com tells customers to visit fake listing - or no refund
At Portcullis House, many victims realised that it was a scam as soon as the supposed owner got in touch to say they needed to confirm their booking by filling in a form with their bank details.
But, according to reviews under the listing, despite it being an obvious scam, Booking.com refused to refund them or offer an alternative genuine apartment stay unless they travelled to Westminster and physically tried to check in.
One review said: ‘Booking.com told me I could not cancel or I would have to pay for the fake property. I was advised to show up and then call Booking.com when I have no place to stay. Apparently, then at 7pm I would be given a place to stay. I refused to do this and booked another property which exists.’
Another person reported that they went to Portcullis House and found that, ‘many other customers were waiting outside the property to check in but no apartment exists'.
One reviewer says they drove down from Manchester and ended up having to spend the night in their car with four children.
Reviews of ‘Apartment near Big Ben’
How Booking.com allows scammers to contact customers
We spoke to one victim of the scam, Tony Walker. He says it charged £243 for a three-night stay, with payment due on arrival.
Immediately after booking, though, he received a chat message through the app asking for his bank details and warning that he would lose the booking if he didn’t provide them.
Initially, he did as he was asked but then, realising the deal was too good to be true for a luxury flat in Westminster, he panicked.
‘In the middle of the night I had this sudden moment of “what have I done?”’ he says. He then put the details of his booking into AI, which warned that ‘Portcullis House is a highly secure building used strictly by Members of Parliament, not holiday apartments’.
‘I thought I was going to get up the next morning and find that all the money in my account had gone!’
Alarmed, he told the bank to freeze his account and then tried calling Booking.com but says, ‘they wouldn’t admit that it’s a scam. They said that there’s an investigation going on’.
Other booking platforms - such as Airbnb or Expedia - would not allow a scammer to send a clickable link demanding bank details in this way.
Which? has repeatedly shown how easy it is to send a weblink through Booking.com’s messaging system, despite the fact that it says it can block them.
Booking.com fails to check listings
While it’s easy to understand how travellers could have fallen for the superficially convincing apartment, there’s no excuse for Booking.com itself being fooled.
The URL of the listing references a village in Somerset, and it appears that the scammers had hacked the account of a legitimate holiday cottage - then changed the name, photos and address.
It’s astonishing that they were able to do this without being blocked by Booking.com - or without it picking up inconsistencies. The phone number given had an area code for California, and the postcode was for Westminster Pier.
Hundreds turn to scam Wetherspoons listing
Another cottage owned by the same Somerset owner also appears to have been hacked - with devastating consequences for hundreds of Booking.com customers.
This time scammers used the address of a well-known London Wetherspoons pub, and advertised them as the London Crown apartments.
‘We were going to a musical in London, so I booked a one-night stay for myself, my wife and our daughter via Booking.com,’ explains Paul Dawson, who contacted us after seeing our previous stories about holiday scams.
Two days after booking, he received an email from ‘the London Crown’ containing a link to a fake Booking.com page, asking for his bank details. Luckily, he was suspicious.
He contacted Booking.com and - astonishingly - it told him, again, that he’d need to visit the phoney apartment and wait until after 7pm before it would relocate him. This was despite explaining to them that he’d since discovered the address shown in the listing was actually a Wetherspoons pub near Tower Bridge called The Liberty Bounds.
‘I explained to the support staff that I had autistic children,’ he says, ‘and the idea of turning up at a clearly non-existent property after the musical had finished at 10.30pm would have been catastrophic. This did not change their response that I needed to go to the property. They said that if it was not possible to check in then I could contact them again and they would find an alternative.’
Left stranded outside Wetherspoons
At the time of writing the listing has over 250 angry reviews and a handful of positive reviews - some for the original Somerset cottage.
Many said they’d told Booking.com that it was a scam - but had been ignored. ‘I reported it to Booking.com three days before check-in,’ said one person who had planned to stay in August. ‘But they refused to do anything.'
One young customer from Spain complained that she and her friend had been left stranded. ‘Two girls alone in London at two o’clock in the morning with no accommodation,’ she wrote.
Staff at The Liberty Bounds had to inform numerous distraught Booking.com customers - one reviewer said 20 a day - that they’d been scammed.
Wetherspoons told us that it reported the scam to Booking.com on 10 August. Despite this, many of the people who were tricked had bookings for the first weeks of September. One person left a review on 17 September complaining that they’d been defrauded of €340 and still had not received a response to their complaint from Booking.com.
‘It is clearly unacceptable for people to be defrauded in such a flagrant manner,’ it said. ‘This is upsetting for the pub team, as there is little they can do to help, but even more so for the people who have been misled and have lost money as a result.
It added: ‘Booking.com urgently needs to adopt more robust procedures to prevent fraudulent listings like this appearing in the first place.’
Although Booking.com stopped the listing being bookable in August, it has yet to remove either of the fraudulent listings.
Booking.com boosts fraudsters - and takes higher commission
One reason the fake pub listing reached so many people was that it was part of a special programme intended to boost visibility on the site.
Next to a reassuring ‘thumbs up’ symbol, the scam had a message from Booking.com: ‘This property is part of our Preferred Plus Programme. It is committed to providing outstanding service and excellent value. It will pay us a higher commission if you make a booking.’
It’s reported that members of the programme have to pay 23% commission - rather than the standard 15%. In return, they typically get over 50% more bookings than standard owners.
We don't know whether the original account owner joined before they were hacked - or the scammer joined after taking over the account. Either way, the scammers were able to reap the benefits of being on Preferred Plus.
Booking.com’s AI helper tells guests to book fraudulent listing
The Booking.com website has an AI trip planner called Dot, which allows users to ask questions.
On the London Crown listing page, we asked it, ‘Is this a real property, or is it a scam?’
It replied: ‘The London Crown is a legitimate property located in the center of London. It offers various amenities such as free WiFi, free bikes, and free private parking. The accommodation includes features like a spa bath, hot tub, and a free shuttle service. Each unit is equipped with air conditioning, a seating area, a flat-screen TV with streaming services, and a fully equipped kitchen. Additional amenities include wine or champagne, fruits, and chocolates or cookies.'
The AI tool for ‘Apartments near Big Ben’ also said that was genuine.
‘The London Crown reviews’ - and Booking.com AI’s dangerous mistake
Reporting Booking.com to Ofcom
Under the Online Safety Act, online services like Booking.com must assess the risk of illegal content, including fraud, appearing on their platforms.
Services are required to have measures in place to reduce the likelihood of users encountering such content, and to remove such content once they become aware of it.
Given the continuing prevalence of potentially fraudulent content on Booking.com, Which? believes that Ofcom should examine whether the platform is doing enough to meet its duties under the Act.
We reported our concerns to Ofcom earlier this year - and we’ll send this report to it as well.
Booking.com says properties ‘are legitimate’
Confusingly, when we contacted Booking.com about these scams, it insisted that the listings ‘are legitimate and have hosted guests’. Obviously, Portcullis House and the Liberty Bounds have not hosted guests.
We think Booking.com means the two holiday cottages in Somerset, whose listings were hijacked, were legitimate.
It said: ‘Our investigation indicates that both properties - which are legitimate and have hosted guests - were targeted by a sophisticated phishing attack. The attack affected the properties’ own computer systems and gave cybercriminals temporary, unauthorised access to the accommodation's Booking.com account.’
We take incidents like this extremely seriously, and suspended bookings at both properties, as well as supporting affected customers.’
We asked it if it would proactively contact the hundreds of people who were scammed on its platform. While its response above suggests that it is ‘supporting affected customers’, as recently as 20 September there were still reviews on the scam pub listing with complaints that victims had heard nothing from Booking.com.
