Booking.com's AI fails to spot fake 10 Downing Street listing, Which? reveals

Consumer protection researchers at Which? managed to do something that should have been impossible: they listed 10 Downing Street as a holiday rental on Booking.com, complete with photographs of the prime minister's front door and a description calling it a "prime city centre location" with one bedroom. The listing stayed live for two months. During a 20-minute window when Which? opened it to test the platform's defenses, fourteen people attempted to book a stay at the UK's most famous address.

The experiment was designed to expose how Booking.com's fraud detection systems actually work in practice. What Which? found was a cascade of failures. The fake listing itself passed through the platform's automated checks. A bogus review that one of the researchers posted—claiming it was "unbelievable that Booking.com let us stay at 10 Downing Street"—also made it through, despite reading like an obvious joke. Most troubling, when the researcher received a message through Booking.com's internal system asking them to click an external link to "confirm payment details," the platform did not flag or remove the link. That kind of message is a textbook phishing attempt, the sort of thing booking sites are specifically designed to catch and block.

Booking.com did not remove the listing until August 27, two months after it was uploaded on June 18. In a statement to the BBC, the company characterized the test as a "limited" exercise that did not represent "the experience of millions of listings or reviews" on its platform. A spokesperson explained that because Which?'s listing was not continuously "live" during those two months—it was only visible during the 20-minute testing window—some of Booking.com's automatic fraud controls "were not triggered to completely remove the closed listing." The company also noted that it uses "a range of checks and verification measures" and that AI technologies "help us detect and remove the majority of fraudulent listings within 24 hours."

Rory Boland, Which?'s travel editor, rejected that framing. "If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily," he said. The real consequences, he emphasized, fall on travelers. Holidaymakers risk losing thousands of pounds to bogus listings and the phishing links that follow. The test was not funny, Boland argued, because the stakes are genuine.

Which? is now calling for stricter enforcement of the Online Safety Act, which requires platforms to remove illegal content—including fraudulent material—once they become aware of it. The group wants Ofcom, the regulator that enforces the act, to use that power to pressure booking sites into faster removal of false listings. An Ofcom spokesperson acknowledged to Which? that platforms "have existing legal duties that mean they must take it down swiftly once they become aware of it." The question now is whether that duty will be enforced with any real teeth. Booking.com is not the first booking platform to face criticism over security and customer service, and the test suggests that the gap between what these companies claim their systems can do and what they actually catch remains dangerously wide.