Booking.com faces criticism over fake listings sending tourists to pub

Booking.com has been criticised for its handling of fake property advertisements after travellers were directed to a Wetherspoons pub instead of luxury apartments they had booked. The consumer organisation Which? reported that staff at The Liberty Bounds pub, located near Tower Bridge, were turning away as many as 20 tourists each day because scammers had used the pub's address for listings advertising high-end accommodation.

Which? also demonstrated the ease with which fake listings could be created, successfully setting up a fraudulent advertisement for 10 Downing Street on Booking.com. This action followed reports from consumers about similar fraudulent listings generated by actual scammers.

Customer experiences with fake bookings

In August, Paul Dawson, a 55-year-old from Loughborough, booked a one-night stay for himself, his wife, and daughter at The London Crown apartments for a visit to London. After paying £73, Mr Dawson received an email two days later containing a link to a fake Booking.com page, which requested his bank details. He informed Booking.com of his suspicions, but was told he needed to visit the non-existent property and wait until after 7pm before they would arrange alternative accommodation. This was despite him explaining the address was actually a pub and that he had autistic children, for whom arriving at a non-existent property late at night would be problematic.

Reviews for The London Crown apartments on Booking.com, visible on September 23, included over 250 negative comments from August and September, alongside a small number of seemingly fake positive reviews. Many customers reported that they had informed Booking.com about the scam days before their check-in, but claimed the platform had refused to act. One traveller from Spain described being left stranded with her friend in London at 2am with no place to stay.

AI trip planner's inaccuracies

Booking.com's artificial intelligence trip planner, Dot, also displayed inaccuracies. When asked by a Which? researcher if a listing for The London Crown was a scam, Dot responded that it was a legitimate property in central London, offering amenities like free WiFi and parking. The AI incorrectly stated the property was near Longleat Safari Park and Longleat House, and that London City Airport was 10 km away, despite Longleat being over a hundred miles from London.

Which? also noted a listing for "Apartments near Big Ben" that provided an address within Portcullis House, part of the Houses of Parliament estate.

Booking.com's response

Booking.com stated that both The London Crown and the Portcullis House listing were for legitimate properties that had been targeted by a sophisticated phishing attack. The company explained that this attack gave cybercriminals temporary, unauthorised access to the accommodation providers' Booking.com accounts. Booking.com confirmed that it takes such incidents seriously, had suspended bookings at both properties, and was supporting affected customers.

Rory Boland, Which? Travel editor, described Booking.com's requirement for guests to attend properties even when advised they do not exist as "utterly reckless" and stated it risks people's safety. He urged Ofcom to take action against online platforms that leave consumers vulnerable to fraud.

An Ofcom spokesman commented that online fraud has serious consequences and platforms have legal duties to remove illegal user-generated content once aware of it. The regulator has initiated investigations into over 100 websites for failing to comply with the Online Safety Act.