Consumer watchdog Which? published a test that it says exposed weaknesses in Booking.com’s verification and fraud-detection processes after setting up a fake holiday listing for 10 Downing Street. Which? says it created the listing on 18 June 2026 using the Downing Street address and an image of the official building under the headline “1 bedroom apartment in the heart of London.”

Which? set the listing to a “request to stay” setting rather than instant book, and briefly opened the booking window so a tester could complete a reservation. The organisation says 14 people enquired during that window and that Booking.com processed a payment from a Which? researcher for a week-long stay; Which? says the payment had not been refunded more than six weeks after the listing went live.

Which? also submitted a test review on 11 August 2026 — giving the listing 10/10 and joking about “hanging out with Larry the Cat” — and reported that the review appeared almost immediately despite Booking.com’s stated moderation processes.

Which? concluded that Booking.com’s verification and fraud-detection checks were “clearly unfit for purpose” and urged the Prime Minister to press Ofcom to use the Online Safety Act to require stronger action against the platform.

Booking.com rejected the characterisation that the test reflected typical platform conditions, saying the exercise was “not a true reflection of the experience of millions of listings or reviews published on our platform.” The company told Which? that the property was not visible or “live” for the time period referenced and that some automatic fraud controls were not triggered because the listing had not been open and bookable.

Which? says the fake Downing Street listing remained on Booking.com until it was removed on 27 August 2026, about six weeks after it was published. The watchdog also highlighted Booking.com’s policy that hosts are not required to provide photo identification or proof of ownership until three months after a listing goes live.

Ofcom weighed in on the issue, saying platforms have legal duties to remove illegal user-generated content swiftly once they are aware of it. Ofcom added that Booking.com is not in scope of forthcoming rules that will target paid-for fraudulent advertising.

The Which? investigation and its findings were reported by multiple UK and international outlets, including ITV, The Independent, The Irish Times and Yahoo, which repeated the watchdog’s substantive examples and Booking.com’s response.