Booking.com's fraud checks only look at listings that are already live

A British consumer group listed the prime minister's residence on Booking.com in minutes and took a payment for it. Airbnb checks who you are before your listing goes live. Booking.com says it may.

by Markus Busch

The test took minutes. On June 18, researchers at Which?, the British consumer organization, built a Booking.com listing for 10 Downing Street — the prime minister's official residence, and one of the most photographed doors on earth. They used the real address and a real photograph of it. They called it a one-bedroom apartment in the heart of London. Booking.com processed a payment from one of the researchers for a week-long stay; six weeks later the money had not come back. A fabricated ten-out-of-ten review went live almost immediately. The page came down on August 27, after Which? gave the company a final chance to respond.

Nothing in that sequence required an address in London.

The listing is only the front door. Inside a twenty-minute window, fourteen people inquired about the apartment — real travelers, asking real questions about a real address. The researchers then used Booking.com's own messaging system to send payment links pointing off the platform, and nothing stopped them. Put that in order and you have the whole fraud: a page anyone can build in an afternoon, inquiries it gathers by itself because the address is genuine, and a message channel that carries a stranger's payment link to the person who trusted the page.

Now read what the two platforms publish. Airbnb requires identity verification before a listing goes live, and since June 2023 has required it of every primary host worldwide, blocking the calendars of hosts who don't complete it. No verification, no bookings. Booking.com's own sign-up page says it may ask you to verify your property before you start accepting bookings.

May. That sits on a global page, and it governs your listing in Scottsdale exactly as it governs one in Mayfair.

What Booking says. The company calls the exercise not "a true reflection" of a platform carrying millions of listings, and adds a specific objection: the fake page was never continuously open and bookable, so some of its automatic fraud controls never fired. Which? has an interest of its own — it is campaigning for a regulator to open an investigation. Neither point accounts for the researcher's money, still gone six weeks after it was taken.

Why it stays open. That objection explains more than it means to. Controls that fire on listings which are open and bookable are controls that watch pages already published — already collecting inquiries, already reachable by a traveler with a card. Airbnb put its check in front of publication and took the cost that comes with it: a host who will not verify is a host who never lists. Booking.com put its check behind publication. The distance between those two decisions is where 10 Downing Street sat for ten weeks.

Nobody has failed to fix this. It is working the way it was built.

A check at the gate costs a platform listings. A check after publication costs the traveler who booked before it ran.

Enjoying this analysis? Hospitality.today delivers daily insights on hotel distribution, AI trends, and travel commerce — straight to your inbox. Subscribe for free at Hospitality.today →