Consumer group Which? has pulled off the ultimate power move: listing 10 Downing Street as a holiday rental on Booking.com, complete with a glowing review about hanging out with Larry the cat. The UK watchdog's researchers managed to book a bogus stay at the PM's residence, and the listing stayed up for two months despite being obviously fake.

Booking.com, in a statement that probably involved a lot of defensive blinking, said the test wasn't a 'true reflection' of the platform's experience. They noted that because the listing wasn't 'live' during those two months, their 'automatic fraud controls' weren't triggered to remove the closed listing. In other words, they only catch fraud when it's actively happening, which is... not how fraud works.

But Which? Travel editor Rory Boland wasn't having it. 'If Booking.com's so-called sophisticated AI systems can't spot that 10 Downing Street is not a holiday rental, then it's no wonder scammers can exploit the platform so easily,' he said. 'It would be laughable that we were able to list the UK's most famous address for rent, if the consequences weren't so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.'

The fake listing, uploaded on 18 June, advertised a '1 bedroom apartment in the heart of London' with images of the iconic front door. During a 20-minute window when Which? allowed bookings, 14 people requested to stay. Which? also sent a message within Booking.com's system asking the researcher to click an external link to confirm payment details - a classic scam move that booking sites are supposed to block. Booking.com didn't flag it.

The fake review, which read 'It was unbelievable that Booking.com let us stay at 10 Downing Street - the home of the UK PM!' also passed muster. The listing was finally removed on 27 August.

Booking.com's spokesperson cited fraud as an industry-wide issue, noting that '80% of UK adults believe scams are becoming more sophisticated.' Which? argues that the Online Safety Act (OSA) should be used to force booking sites to remove false listings swiftly. An Ofcom spokesperson confirmed that platforms have legal duties to take down illegal content once aware.

This isn't the first time Booking.com has faced criticism over security. But hey, at least they're consistent. And if you're planning a holiday, maybe stick to hotels that actually exist, and definitely don't click any links from Larry the cat.