Overview
- Which? created a fake Booking.com listing for 10 Downing Street that accepted a test payment on June 18, 2026, showing a booking could be set up and paid for without upfront owner ID checks.
- A fake 10/10 review that referenced ‘Larry the Cat’ was posted on August 11, 2026, and the listing remained on the site until Booking.com removed it on August 27, 2026 after Which? raised the issue.
- Which? used Booking.com's messaging system to send an external URL asking for card details, demonstrating that the platform did not block potentially phishing links while competitors such as Airbnb block external links.
- Booking.com said the listing was not visible and not fully live so some automated fraud controls did not trigger, and its rules do not require hosts to provide photo ID or proof of ownership until three months after a listing goes live.
- Ofcom reminded platforms they must swiftly remove illegal user-generated content once aware, consumer groups are calling for stronger enforcement and faster refunds, and the case could prompt closer regulatory scrutiny of accommodation sites.