Stranded at Spoons: Booking.com sending customers to pub as it continues to ignore fake listings, Which? finds
Wetherspoons staff have been turning away up to 20 tourists on a daily basis as scammers use their pub address at a London landmark for a fake Booking.com holiday apartment, Which? has found.
Earlier this month, the consumer champion was able to set up a fake listing for 10 Downing Street on Booking.com, highlighting the security failings on the platform. Since then, Which? has been alerted to several reports from consumers of similar fraudulent listings on the platform set up by real scammers.
In one example, the address of a well-known Wetherspoons pub near Tower Bridge, The Liberty Bounds, is being used for a listing for a “block of luxury apartments” on the booking platform.
In August, Paul Dawson, 55, from Loughborough, booked a one-night stay for himself and his wife and daughter at The London Crown apartments to watch a musical in the West End. He booked via Booking.com and paid around £73. However, two days after booking he received an email from The London Crown containing a link to a fake Booking.com page, which asked for his bank details.
Paul contacted Booking.com with suspicions but the platform told him that he would need to visit the fake apartment and wait until after 7pm before it would relocate him. This was despite Paul explaining to them that he’d since discovered the address shown in the listing was actually The Liberty Bounds pub.
He told Which?: “I explained to the support staff that I had autistic children and the idea of turning up at a clearly non-existent property at 10.30pm would have been catastrophic. This did not change their response that I needed to go to the property. They said that if it was not possible to check in then I could contact them again and they would find an alternative.”
Other booking platforms - such as Airbnb or Expedia - would not allow a scammer to send a clickable link demanding bank details in this way. Which? has repeatedly demonstrated how common this is for fake listings and has asked Booking.com to take action to shut down this glaring security gap.
Paul was not the first to report the property. The listing for the London Crown apartments was still visible on Booking.com on 23 September, with over 250 negative reviews from August and September along with a handful of - likely fake - positive reviews. Many of the reviews from customers say that they told Booking.com that it was a scam but had been ignored.
One customer said: “I reported it to Booking.com three days before check-in but they refused to do anything.”
Another customer, from Spain, complained that she and her friend had been left stranded. “Two girls alone in London at two o’clock in the morning with no accommodation,” she wrote.
Another foreign tourist reported that her group of eight was left without anywhere to stay at midnight.
Staff at The Liberty Bounds pub say they turn away up to 20 distressed tourists a day and have to tell them they have been scammed.
Wetherspoons told Which? that Booking.com urgently needs to adopt more robust procedures to prevent fraudulent listings like this from appearing in the first place. The listing briefly disappeared after the pub chain reported the scam to Booking.com on 10 August, but quickly popped up again. Booking.com blocked bookings in August but the listing remained on the site, and victims claim to have been scammed and have left reviews as recently as 21 September.
Booking.com also has an AI trip planner called Dot, which allows users to ask questions. On The London Crown listing page a Which? researcher asked, “Is this a real property, or is it a scam?”. It replied: “The London Crown is a legitimate property located in the center of London. It offers various amenities such as free WiFi, free bikes, and free private parking. It is conveniently located near Longleat Safari Park and Longleat House, with London City Airport just 10 km away. Based on the detailed description and amenities listed, the London Crown appears to be a real and well-equipped property.”
Dot failed to recognise that Longleat Safari Park is more than hundred miles from London.
Which? found that one reason the fake apartment listing reached so many people was that the platform allowed it to join a special programme intended to boost visibility on the site. Next to a reassuring ‘thumbs up’ symbol it stated that the property is part of the Preferred Plus Programme which ‘is committed to providing outstanding service and excellent value. It will pay us a higher commission if you make a booking’.
The fake apartment’s admission to the prestige scheme suggests Booking.com’s vetting processes are woefully inadequate.
Which? was also made aware of a property listed as ‘Apartments near Big Ben’.
The address was given as Portcullis House, which - far from being a luxury apartment - is part of the House of Commons estate, where hundreds of MPs work. Many customers showed up to the premises, only to be turned away by armed security guards.
Booking.com told Which? that in both cases, listings for legitimate properties had been targeted by a sophisticated phishing attack, allowing criminals to hijack the listings.
Ofcom has powers under the Online Safety Act to investigate platforms that host user-generated scams, but the regulator has been slow to use them. Which? is urging the regulator to investigate the compelling evidence of scams on Booking.com and to take strong action so that the business might finally start to take customer security seriously.
Rory Boland, Editor of Which? Travel said:
“Not only does Booking.com refuse to take scams seriously, but its requirement that guests turn up to properties, even when it has been advised the property doesn’t exist, is utterly reckless. It’s frightening, humiliating, and risks people’s safety.
“Instead of taking action when fraudulent listings are reported, Booking.com prefers to let its customers bear the financial and safety risks.
“Ofcom must show it will use its powers to get tough with irresponsible online platforms that leave consumers wide open to fraud.”
ENDS
Notes to Editors
The consumer champion has sent six case studies to Booking.com in the last couple of weeks, including the stories above.
Screenshots
Right of Replies:
A spokesperson for Booking.com said:
“Our investigation indicates that both properties - which are legitimate and have hosted guests - were targeted by a sophisticated phishing attack. The attack affected the properties’ own computer systems and gave cybercriminals temporary, unauthorised access to the accommodation's Booking.com account.
“We take incidents like this extremely seriously, and suspended bookings at both properties, as well as supporting affected customers.”
A spokesperson for Wetherspoons said:
“It is clearly unacceptable for people to be defrauded in such a flagrant manner. This is upsetting for the pub team, as there is little they can do to help, but even more so for the people who have been misled and have lost money as a result.
“Booking.com urgently needs to adopt more robust procedures to prevent fraudulent listings like this appearing in the first place.”
About Which?
Which? is the UK’s consumer champion, empowering people to make confident choices and demand better. Through our research, investigations and product testing, we provide trusted insight and expert recommendations on the issues that matter most to consumers.
Fiercely independent, we put people over profit - shining a light on unfair practices, influencing policy and holding businesses to account to make life simpler, fairer and safer for everyone.
The information in this press release is for editorial use by journalists and media outlets only. Any business seeking to reproduce information in this release should contact the Which? Endorsement Scheme team at endorsementscheme@which.co.uk.