A major consumer group says it has exposed “dangerous fraud failings” at Booking.com after it created a fake listing for No.10 Downing Street.

Consumer group Which? said it was able to advertise the British’ PM’s address as holiday accommodation on the giant travel website for months – raising concerns about Booking.com’s safeguards.

The British consumer group listed the property on June 18, with the headline “1 bedroom apartment in the heart of London” and featuring the exact address and a photo “of the most famous front door in Britain, 10 Downing Street”.

It set the listing so bookings had to be approved rather than automatic. The organisation’s travel team opened the booking window very briefly so one of its representatives could do a test booking, and it was then closed again.

“Within this time, 14 people got in touch to ask if they could stay at the Prime Minister’s home,” Which? said on Wednesday (British time).

The fake listing used a real photo of the British PM’s residence. Image: Which?

It said Booking.com also processed a payment from a Which? researcher using a different account for a week-long stay at the fake listing.

“The money has still not been refunded, more than six weeks after it was set up,” it said.

It said a fake review was also added on August 11 – giving the accommodation an “exceptional” rating of 10/10.

“After writing the review, Booking.com sent a message saying that it would be ‘checked by our team of moderators’ – but the review appeared almost immediately despite obviously being a joke, including a reference to how enjoyable it was hanging out with Larry the Cat,” Which? said.

It said – despite the obviously fake listing and setting themselves up as a host on the same day – its travel team used Booking.com’s own mailing system to send an external URL asking the Which? representative from the other account to enter credit card details to confirm the booking.

Competitors such as Airbnb automatically block external web links in messages to protect users from phishing scams, but Booking.com failed to intercept the link. Booking.com told Which? that it  does have the ability to block URLs being sent through the messaging system, if it suspects fraudulent activity.

Which? said its listing for Downing Street wasn’t removed until August 27 – after it had given Booking.com a final opportunity to comment on the investigation.

“If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily,” Which? Travel editor Rory Boland said.

“It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.”

Boland called for a crackdown on “irresponsible online platforms that leave consumers wide open to fraud”.

A Booking.com spokesperson said Which?’s limited test wasn’t a true reflection of the experience of millions of listings or reviews on its platform.

“The property added by Which? was not visible and ‘live’ for the time period referenced*, and as it was not open and bookable, some of our automatic fraud controls were not triggered to completely remove the closed listing.”

Booking.com’s defence refers to the two months in which the listing was online. It was open and bookable initially, but Which? had ensured it couldn’t be booked by genuine customers.

“We can confirm that we use a range of checks and verification measures to help protect our platform, alongside technologies including artificial intelligence,” the Booking.com spokesperson said.

“Together, these measures help us detect and remove the majority of fraudulent listings within 24 hours. We also have tools in place to help protect the integrity of our reviews program.”

They said 80 per cent of British adults believed scams were becoming more sophisticated.

“We recognise this challenge and continue to strengthen our defences, helping protect our accommodation partners and customers. This includes tools that limit links in partner-to-guest messages – which have proved effective with professional scammers moving to other channels,” they said.

Booking.com also has visible reminders to not click on links that customers are not confident about, and booking confirmations also provide further guidance.