Which? lists 10 Downing Street on com in security test
Consumer group Which? has said it uncovered “systemic security failures” on com after it was able to set up and accept payment for a fake listing for 10 Downing Street. The watchdog listed the property on the travel site on June 18, headlined “1 bedroom apartment in the heart of London”, with the exact address and a photo of the Prime Minister’s home. The listing also promised a four-minute walk to the Houses of Parliament.
Which? said the listing was set up within minutes and was configured so that users had to request a stay, preventing automatic booking. The watchdog opened a brief booking window so a researcher could test the system, and com processed a payment for a week-long stay. Which? said that more than six weeks later, the money had still not been refunded.
Fake review and messaging test
Which? also added a fake review to the listing, describing the stay as “exceptional” and joking about “hanging out with Larry The Cat”. Although com said the review would be checked by moderators, it appeared almost immediately. Researchers were also able to send an external link through com’s messaging system asking for credit card details, and the site did not flag or remove it, according to Which?.
Response from com
A com spokesperson told the BBC that the test was “not a true reflection of the experience of millions of listings or reviews published on our platform”. They said that because the listing was not “live” across the two months it was present, “some of our automatic fraud controls were not triggered to completely remove the closed listing”. The spokesperson added that “a range of checks and verification measures” help secure the site, and that AI helps “detect and remove the majority of fraudulent listings within 24 hours”.
Which? calls for action
Rory Boland, editor of Which? Travel, said com’s checks had been shown to be “unfit for purpose”. He said: “If com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily.” He added: “It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.”
Which? said it received dozens of complaints from people receiving scam messages on the platform and heard of hundreds of travellers arriving at properties to discover the listing was fake. It also said researchers trying to contact com were initially directed to an ineffective AI chatbot.
The listing was removed on August 27, after Which? made com aware. An Ofcom spokesperson said com is not in scope of future rules for paid-for fraudulent advertising under the Online Safety Act, which requires firms that have identified illegal content, including fraudulent material, on their sites to show they are committed to removing it.