No.10 Downing Street put on Booking.com
Key Points
- Which? Travel listed the Prime Minister's residence as a one-bedroom flat on Booking.com without any identity checks
- 14 people enquired within 20 minutes and Booking.com processed payment for a week-long stay
- The host account sent an external payment link through Booking.com's own messaging system
- A 10/10 fake review went live within minutes despite a promised moderation check
- Booking.com deleted the account on 27 August, around two months after it was created
Consumer group Which? listed 10 Downing Street as a one-bedroom holiday flat on Booking.com and took paid bookings within hours, without the platform running a single identity check.
The advert, titled “1 bedroom apartment in the heart of London”, carried the address “10 Downing Street, London” and a photo of the Prime Minister’s front door. It promised guests a four-minute walk to the Houses of Parliament.
Which? Travel’s Editor set up the listing as the latest in a series of tests of Booking.com’s security. The magazine said it expected the platform to block a listing for the Prime Minister’s official residence and that it went live instead.
14 people asked about the flat’s availability in the first 20 minutes, according to the magazine. Which? kept the listing set to require host approval so that genuine holidaymakers could not book it.
The Which? team then paid Booking.com for a week’s stay at No.10, and the platform processed the payment without intervening. Booking.com did not cancel the stay or send a refund email until 31 August, roughly two months after the money went through.
The magazine said the refund email did not make clear whether it would receive the full amount or whether Booking.com would retain a fee or commission. It added that the platform held its money for two months in the meantime.
The listing also let the editor send an external web link through Booking.com’s own messaging system, asking the guest to enter credit card details to confirm the booking. Which? has repeatedly reported that scammers use the same messaging channel to send links to fraudulent payment sites.
Airbnb routinely blocks hosts from sending web links through its messaging system, the magazine said. Booking.com told Which? it can block URLs in messages where it suspects fraud, but it did not do so in this case.
Which? also posted a 10/10 review of its fake stay, praising the chance to hang out with Larry the Cat. Booking.com said the review would go to its moderation team before publication, but it went live within minutes and gave No.10 an “exceptional” rating on the platform.
Booking.com deleted the account on 27 August, around two months after Which? created it.
The test followed an earlier Which? listing set up in October 2024, which took about 15 minutes to create and asked for no proof of ownership or identity. Booking.com did not request photo ID and a National Insurance number for that listing until 18 months later, and blocked it after 20 months when Which? declined to provide them.
Those checks came in under the Platform Operators (Due Diligence and Reporting Requirements) Regulations, introduced in 2024 to make sure holiday accommodation owners pay tax. Under Booking.com’s own rules, a new host does not have to supply proof of ID until three months after a listing goes live.
Which? said its inbox is full of cases from Booking.com scam victims. It cited one customer who found 44 unauthorised transactions totalling almost £4,000 on a credit card after his account was hacked, and another who lost more than £900 on a listing that no longer existed and received £208 back after the magazine intervened.
“While the Which? team was able to create a test listing and make a reservation using accounts under their control, this does not reflect the experience of the vast majority of listings on our platform,” Booking.com said in response to the investigation.
The platform said it uses advanced machine learning models, fraud detection and platform integrity measures to protect users, and that it is investing in new tools to protect the integrity of its reviews.
It added that the listing was not live for the full two months because Which? only opened it for bookings briefly, which meant some of its automatic fraud controls did not trigger.
“We advise customers to only make payment through approved channels and not to engage with requests to pay externally,” Booking.com said.
