The Impossible Listing: 10 Downing Street Appeared on Holiday Rental Site
In what sounds like the plot of a digital thriller, a consumer advocacy group has demonstrated just how vulnerable major booking platforms truly are—by creating and exposing a completely fabricated property listing for the Prime Minister’s residence. Which? found it possible to generate a bogus stay at 10 Downing Street on Booking.com, then watched as the company dragged its feet before finally taking the item down, leaving travellers to navigate a confusing and potentially dangerous landscape. The incident, uncovered by the UK watchdog, highlights a troubling gap in automated fraud detection and raises urgent questions about how quickly illegal listings on travel websites are being scrubbed when they appear.
Which?’s researchers spent several weeks crafting a convincing fake entry, complete with whimsical descriptions and even a satirical review praising a supposed “hanging out” experience with a fictional resident cat named Larry. Despite the glaring red flags—such as advertising a “prime city centre location” just meters from Big Ben—the listing remained visible for nearly two months. By the time the site deleted it on 27 August, fourteen potential bookers had attempted to claim the impossible accommodation, and only one of those requests was processed through official channels. Booking.com’s own spokesperson claimed the system would normally flag suspicious items within twenty-four hours, yet the delay suggests either lax monitoring or an unwillingness to confront the severity of the situation.
Gaps in Booking.com’s Security Safeguards
When Which? first presented the case, the bookings giant argued that their advanced verification measures should have prevented the listing from ever appearing. They pointed to AI-powered detection tools designed to identify deceptive properties and removed lists rapidly once flagged. However, the consumer group retorted that these protections are woefully inadequate against determined bad actors. In the instance of the 10 Downing Street listing, Which? reported that automatic fraud controls failed to act immediately, allowing the item to circulate undisturbed until after it had already garnered attention from researchers inside the system.
During the testing window—which spanned from 18 June to 27 August—the organisation granted access to its researchers to attempt booking the nonexistent property. Only the booking request made by a recognised investigator was successfully processed, while the other thirteen attempts were blocked. This selective enforcement, according to Which? editors, reveals more than a technical oversight—it reflects a systemic failure to treat high-risk listings with the urgency they demand. The group’s spokesperson noted that the listing was never live on the main site during the observation period, meaning some of the automated safeguards were simply inactive, too passive to trigger an immediate response when confronted with blatantly false information.
The controversy goes deeper than a mere software malfunction. If Booking.com can publish a false advertisement for the headquarters of the UK government—and receive little meaningful recourse from the company—the implications ripple outward to affect millions of occasional travellers who rely on these platforms for legitimate stays. Phishing schemes, reservation hijacking, and outright financial theft are not abstract threats; they are real costs borne by ordinary people who trust the convenience of online booking. The recent incidents involving tourist scams and data breaches underscore a pattern of vulnerability that demands immediate regulatory attention.
What It Means for Travellers and Platforms Alike
The fallout from the 10 Downing Street episode serves as a stark reminder that the digital infrastructure underpinning modern travel is only as robust as the vigilance of the organisations that run it. For frequent flyers and short-term visitors alike, the scenario illustrates exactly why the Online Safety Act is gaining momentum in Parliament—it mandates that companies must demonstrate a commitment to removing illegal and harmful content quickly once they become aware of it. While Booking.com points to its continuous investment in anti-fraud technology, the delay in action here casts doubt over whether their systems are truly ready for the scale of threats facing the industry today.
Consumers deserve better than a slow-moving defence mechanism when their personal finances or holiday plans are at stake. Which? has called on regulators to enforce stricter penalties for platforms that ignore fraud warnings, arguing that the current framework leaves victims exposed for far too long. Meanwhile, the bookings giant insists it will continue to refine its algorithms and hopes that its proactive measures will prevent similar scenarios from recurring. Yet the evidence of a deliberate gap between detection and removal suggests that good intentions alone will not suffice. The responsibility now lies not just with Booking.com, but with policymakers who must hold tech giants accountable for the experiences of their users.
—
Why it Matters
The ability to post a fake listing for the Prime Minister’s residence—and leave a complimentary review—demonstrates that the stakes of platform credibility extend far beyond corporate reputation; they touch upon the fundamental trust that enables billions of global journeys each year. When a website publishes a bogus accommodation for a landmark of national significance, it opens a door for scammers to lure unsuspecting individuals toward phishing links, financial theft, or worse. The 10 Downing Street case is a vivid example of how easily a single lapse in moderation can cascade into widespread harm, amplifying the cost of negligence for everyone involved.
