Fake accommodation scams! Which? has conducted an extreme experiment
Researchers at Which? successfully set up a fake accommodation listing on Booking.com at the British Prime Minister's address, received a payment and published a fabricated review. The test raises uncomfortable questions about how effectively the automated checks of major OTA platforms can actually stop fraudulent properties before they reach consumers.
A fake apartment at 10 Downing Street, one of the most famous and best-guarded addresses in the United Kingdom, managed to pass through the Booking.com system. On 18 June, researchers from the consumer organisation Which? posted a listing for a “one-bedroom apartment in the heart of London”, using the real address and a photograph of the British Prime Minister's residence.
Although it was a clearly impossible tourist accommodation, the platform accepted the listing, and during the brief period when booking was enabled, as many as 14 users enquired about a stay. Which? then made a test booking for a week from another account, and Booking.com processed the payment.
The problem didn't end with the fake advert
The test also affected other parts of the system. Researchers published a fake 10/10 review, which appeared almost immediately after the message stating that it would be checked by moderators. Through Booking.com's messaging system, they also sent an external URL requesting credit card details. According to Which?, that attempt was not automatically blocked either.
Booking.com rejects the conclusion that the test represents a typical experience on the platform. The company states that it uses a combination of checks, verification procedures and artificial intelligence, and that it removes the majority of fake listings within 24 hours. It also claims that some automated mechanisms were not activated because the property was not open for bookings for most of the period.
Trust is becoming an operational problem for OTA platforms
For the tourism industry, the case is more important than the unusual experiment itself. Booking.com advises users to be cautious with new properties, external links and payment requests outside the defined process, while at the same time stating that its checks stop most fake properties before they affect travellers.
That is precisely why Downing Street is an interesting test: if the automated system does not recognise the British Prime Minister's address, the question is how easily it can identify a more convincing fake apartment in Dubrovnik, Split, Belgrade or Tirana. We believe that the people in charge of security on online platforms are constantly improving their defences, but this experiment has shown how much both travellers and we in the industry must look out for safety.
Source: Which?
