Menu Menu
[gtranslate]

Booking.com vulnerability exposed by fake Downing Street listing

Researchers from consumer group ‘Which?’ say they’ve successfully listed 10 Downing Street on Booking.com as part of a security test. The property was ‘available’ for two months before being removed. 

Fancy a stay on Downing Street? Consider yourself a future Prime Minister and need to trial run your accommodation? We’ve got you covered.

Well, not really, but consumer group ‘Which?’ says it successfully listed 10 Downing Street on popular property and travel agency ‘Booking.com’ for two months before it was removed, suggesting major security issues on the platform. The address was available via request, and ‘Which?’ says 14 people got in touch in a 20-minute window.

The listing mentioned a four-minute walk to the Houses of Parliament and included a fake review describing a stay as ‘exceptional.’ Larry the Cat, the residential feline that’s seen Prime Ministers come and go for over 15 years, also received an honorary shout-out. Good stuff.

All jollies aside, the listing being so obviously fake, yet still passable by ‘Booking.com’s’ security checks, implies some worrying flaws in the website’s infrastructure. ‘Which?’ said that property platforms should do more to enforce strict censorship and remove fraudulent content as part of the Online Safety Act.

Editor of ‘Which? Travel,’ Rory Boland, spoke to The Guardian. ‘If ‘Booking.com’s’ so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily,’ they said.

It comes after customers previously accused ‘Booking.com’ of failing to protect them from cyber-criminals.

In response, the platform said that this one-off test was not a fair assessment of its security processes. ‘This […] is not a true reflection of the experience of millions of listings on our platform. The property added by ‘Which?’ was not visible to customers or ‘live’ for the time period referenced,’ a spokesperson commented.

‘We use a range of checks, verification measures and artificial intelligence, which help us to detect and remove the majority of fraudulent listings within 24 hours,’ they added.

So, the jury is out on what can be done to improve safety standards for now. Perhaps the biggest story here is that Larry the Cat hasn’t actually been having a rota of temporary guests, which could be the biggest loss.

Enjoyed this? Click here for more Gen Z-focused culture stories.

Accessibility