Where to next?
Discover inspiring destinations, recommended by our in-house travel experts. Know the best places to go, who to book with and how to pay less.
Join Which? TravelHow we listed 10 Downing Street as a holiday home on Booking.com
The scam-ridden platform failed to block a phony listing of the most famous address in the country
Trevor Baker has almost 20 years experience as a travel writer, having lived in Spain before becoming an award-winning investigative journalist.
One of the UK's most trusted travel journalists, our award-winning travel editor spent a decade writing guidebooks around the world. Since 2016, he has been recommending where to go, who to go with and championing passenger and holiday rights for Which?
When Keir Starmer was on the point of resigning this summer, he could have done without one more problem to worry about: his official flat being listed as a holiday home on Booking.com.
The advert, headlined '1 bedroom apartment in the heart of London', prominently listed '10 Downing Street, London' alongside a photo of the most famous front door in Britain. Just four minutes on foot to the Houses of Parliament, it promised.
The listing was set up by Which? Travel's editor as our latest attempt to test the security of Booking.com. We thought listing the Prime Minister's residence as a holiday let was so absurd and obviously a scam that Booking.com would stop it. It didn't. Instead, the listing went live and we were able to take bookings in just a few hours.
This article first appeared in Which? Travel magazine. We don't accept freebies from travel companies, airlines, or hotels, so you can be sure that our investigations, recommendations, and reviews are completely unbiased.
Fake listings on Booking.com
Over the past two years, we've essentially written the same article over and over again, warning of scams on Booking.com. But this year, at last, we started to think that the platform might be taking fraud more seriously.
The first time we set up a fake listing was in October 2024. It was far too easy. Creating the listing took about 15 minutes. At no point were we asked to prove that we owned the property, or indeed that I was a real person. In its response, Booking.com said: ‘We take the process of verifying accommodation listings seriously. While partners can register in less than 15 minutes, they are then exposed to multiple controls and checks during sign-up, after submission and before their listings become bookable.’
In fact, it took a full 18 months until Booking.com asked us for photo ID and a valid National Insurance number to prove our identity. When we didn't provide this, the listing was finally blocked – 20 months after it was first set up.
Booking.com can't even take much of the credit. The new checks were a response to laws introduced in 2024 that require accommodation platforms to verify their listings. The Platform Operators (Due Diligence and Reporting Requirements) Regulations were brought in not, primarily, to prevent scams, but to ensure that holiday accommodation owners pay their taxes. Making life harder for fraudsters should have been a fortunate side effect.
The Prime Minister’s house on Booking.com
But the fact that there were any checks at all – albeit 20 months late – made us optimistic that things might be changing. We were far too generous. 10 Downing Street was listed for rent on Booking.com without any identity checks whatsoever being carried out.
Immediately, it was a big hit. We ensured nobody could book without being approved, but a startling 14 people asked about its availability in the first 20 minutes. If you live abroad, you may have no clue this is the Prime Minister's home – it's just a bargain in central London.
Worse, Booking.com made no attempt to prevent us paying for a week's stay at 10 Downing Street. We’re still not sure if we will get all our money back. Despite us telling Booking.com that the listing is fraudulent, it wasn’t until 31 August that it cancelled the stay and we received an email about a refund. It’s not clear from the email whether we will receive a full refund, or if Booking.com will retain a fee or commission for the booking.
Even if it pays us back in full, it’s happily held on to the money for two months – and presumably earned interest on it. Some of its multi-billion-dollar revenue this year will – unbelievably – come from the money we paid it for a phoney week's stay at the home of the Prime Minister.
So what happened to the new identity checks we expected? It turns out that, under Booking.com's own rules, our editor didn't have to provide proof of ID until three months after the listing went live. How many victims could a fraudster prey on in that time?
Scam messages on Booking.com
The problem is not just that we were able to pay Booking.com for a holiday that doesn't exist. The real problem is what happened next.
We've repeatedly revealed how scammers have used Booking.com's own messaging system to send external links. When these links are clicked, they lead to fraudulent websites designed to trick people out of hundreds or thousands of pounds.
Yet, despite only setting himself up as a host that same day and the listing being so clearly fake, our editor was able to use Booking.com's own mailing system to send an external URL asking us to provide our credit card details to confirm the booking.
To the best of our knowledge, there's no other major booking site that would let somebody do that. Airbnb routinely blocks hosts from sending weblinks through its messaging system.
Booking.com has told us that it has the ability to block URLs being sent through the messaging system if it suspects fraudulent activity. But it didn't do so in our case nor in too many others.
It has also previously told us that it uses sophisticated AI systems to detect and combat fraud. So why did its AI not notice that the image on our listing was one of the world's most famous buildings and appears in thousands of photos across the web?
Booking.com said that the listing wasn’t live for the whole two months between us posting it and it finally being taken down. This is because we only briefly opened it up for bookings, to avoid confusing genuine holidaymakers. It also said some of its automatic fraud controls were not triggered to completely remove the closed listing.
Fake review on Booking.com
Bizarrely, Booking.com didn’t take the listing down – even when we told it what we’d done. We then went one step further and wrote a fake review of our fake stay. ‘It was unbelievable that Booking.com let us stay at 10 Downing Street – the home of the UK PM!’ we enthused in a 10/10 review.
To make sure Booking.com’s review moderators knew it was a joke, we added that our favourite part of the stay was ‘Hanging out with Larry The Cat’.
But although the platform said that the review would be ‘checked by our moderation team’ before being posted, it was published within minutes. Our 10/10 score meant that 10 Downing Street was now officially rated by Booking.com as ‘exceptional’. Booking.com finally deleted the account on 27 August – around two months after it was set up.
Booking.com scam victims
Its failure could be comical, if it wasn't for the fact that the many people scammed on Booking.com won't be laughing. Our inbox is filled with cases.
Antony Jewson, who was hit by 44 unauthorised transactions on a credit card – totalling almost £4,000 – after his Booking.com account was hacked, certainly isn't amused.
'What concerns me most,' he said, 'is how the fraudster was able to use the Booking.com account and payment details without any proper identity checks.' He was able to get the money back from the bank but says: 'We still have not received a proper response, explanation or update on the fraud investigation.'
Then there was John Dickson, who says he resorted to watching YouTube videos called things like How to contact Booking.com, after finding it impossible to speak with a human being. He and his friend had spent more than £900 on a listing that appeared no longer to exist – and then on last-minute hotel rooms. Booking.com refunded John Dickson £208 following our contact – although he's still out of pocket for his expenses.
Booking.com says it is investigating Antony's issue.
It made little attempt to defend itself over the embarrassment of a fake 10 Downing Street appearing on the platform. It said: ‘While the Which? team was able to create a test listing and make a reservation using accounts under their control, this does not reflect the experience of the vast majority of listings on our platform.’
It gave us a long list of checks, including 'advanced machine learning models', 'fraud detection' and 'platform integrity measures' that it said protect users. It also said it was investing in new tools to protect the integrity of its reviews, among other security measures.
Tellingly, however, it also said: ‘We advise customers to only make payment through approved channels and not to engage with requests to pay externally.’
It has to repeat this advice every time another scandal appears in the press, simply because an extraordinary number of fraudulent messages go through its platform. Our previous investigations suggest they might number in the millions.
Given our experiences over the past couple of years, we're yet to be convinced that Booking.com is taking fraud seriously at all. Perhaps, now it’s become personal, our new Prime Minister might take up the case.
