Booking.com Security Flaw Exposed: Fake Downing Street Listing Processed Payments
SingTao · 2 SOURCES1 day ago2 MIN
Summary
British consumer organization Which? has revealed a critical security flaw in Booking.com after researchers managed to create a fake accommodation listing for 10 Downing Street, the official residence of the British Prime Minister. The listing not only passed the platform's verification but also processed a test payment and enabled researchers to send external phishing links through the built-in messaging system. The investigation highlights systemic failures in the platform's fraud prevention measures.
Key Points
- Which? researchers created a fake listing on June 18, 2026, claiming to rent a one-bedroom apartment at 10 Downing Street using the famous black door photo
- The listing was set to require application approval, yet within 20 minutes of going live, 14 people inquired about the property
- Booking.com processed payment for the test booking, but the amount remained unrefunded more than six weeks later
- Researchers successfully posted a fake perfect 10/10 review and sent an external phishing link requesting credit card details, which was not blocked by the platform
- The fraudulent listing was only removed on August 27, approximately two months after creation, prompting Which? to call for Ofcom investigation
Why It Matters
This incident demonstrates that even the most recognizable address in British politics can bypass Booking.com's fraud detection systems, raising questions about the safety of millions of other listings on the platform. Hong Kong travelers who frequently use international booking platforms should be particularly cautious, as phishing links can be sent through seemingly legitimate platform channels, potentially compromising credit card information and personal data .
This incident demonstrates that even the most recognizable address in British politics can bypass Booking.com's fraud detection systems, raising questions about the safety of millions of other listings on the platform. Hong Kong travelers who frequently use international booking platforms should be particularly cautious, as phishing links can be sent through seemingly legitimate platform channels, potentially compromising credit card information and personal data .