A UK consumer watchdog called Which? recently discovered a significant vulnerability in the online booking platform Booking.com. The group managed to create a fake listing for 10 Downing Street, the official residence of the UK Prime Minister, and successfully booked a "stay" there, even leaving a humorous review about "hanging out" with Larry the cat, the prime minister's famous pet. Despite the listing being clearly fake, it remained on the platform for two months before being removed. Booking.com explained that the test was not representative of the overall user experience on the platform. They stated that the listing was not "live" for most of the time it was present, meaning that some of their automated fraud detection systems were not activated. The listing was only visible and bookable during a 20-minute window opened by Which? for testing purposes. During that time, 14 people requested to book the fake property, but only the request from a known Which? researcher was accepted. The watchdog also found that Booking.com did not block a suspicious external link sent to the researcher to confirm payment details, something that most booking sites typically prevent to protect users from scams. While Booking.com claimed they have measures in place, such as visible reminders and booking confirmations, to help users avoid scams, Which? criticized the platform’s systems as "unfit for purpose." The group's Travel editor, Rory Boland, said that if even a clearly fake listing like 10 Downing Street could pass through, it highlighted how easily scammers could exploit the platform. The fake listing, which was uploaded on 18 June, described a "1 bedroom apartment in the heart of London" with images of the iconic Downing Street front door and claimed to be in a "prime city centre location." The listing was finally removed on 27 August. Which? is urging the government to use the Online Safety Act (OSA) to ensure platforms like Booking.com remove fraudulent content more quickly. The OSA requires companies to take down illegal content once they become aware of it. An Ofcom spokesperson confirmed that platforms have legal duties to remove such content swiftly, and the watchdog is calling for stronger enforcement to protect consumers from online fraud.