Overview
- Which? tested Booking.com in late September and showed scammers could create convincing fake listings, including a demonstration listing for 10 Downing Street.
- A customer, Paul Dawson, paid for a one‑night stay at a listing called The London Crown in August, received a phishing link asking for bank details, and said Booking.com told him to go to the listed address before it would arrange relocation.
- Staff at The Liberty Bounds Wetherspoons near Tower Bridge reported turning away as many as 20 tourists a day after fraudsters used the pub’s address to pose as a block of apartments.
- Booking.com says investigations point to a sophisticated phishing attack that temporarily hijacked legitimate property accounts, and the company says it suspended bookings and supported affected customers.
- Which? found the London Crown listing remained visible in late September with more than 250 negative reviews and said Booking.com’s AI assistant Dot failed to flag obvious errors, while Ofcom has warned it may use powers under the Online Safety Act to enforce removals.