Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.
Already a member?
Log in
Booking.com has been accused of failing to address fraudulent listings after directing customers to a Wetherspoons pub instead of accommodation.
Consumer group Which? said staff at The Liberty Bounds near Tower Bridge turned away up to 20 tourists daily after scammers listed the Wetherspoons venue as a “block of luxury apartments”.
The watchdog highlighted vulnerabilities by creating a fake listing for 10 Downing Street earlier this month following reports of similar fraudulent accounts.
In August, Paul Dawson, 55, from Loughborough, booked a £73 one-night family stay via Booking.com at The London Crown apartments for a West End trip.
Two days later, a message containing a link to a fake Booking.com site requested his bank details.
When Mr Dawson raised concerns, explaining that the address was actually a Wetherspoons pub, the platform insisted he visit the location and wait until after 7pm before relocation assistance could be provided.
He told Which?: “I explained to the support staff that I had autistic children and the idea of turning up at a clearly non-existent property at 10.30pm would have been catastrophic.
“This did not change their response that I needed to go to the property. They said that if it was not possible to check in then I could contact them again and they would find an alternative.”
The London Crown listing remained active on September 23 with over 250 negative reviews from August and September alongside a few suspicious positive ratings, Which? said.
Many reviews stated customers had alerted Booking.com to the scam without success.
One customer said: “I reported it to Booking.com three days before check-in but they refused to do anything.”
Another customer, from Spain, complained that she and her friend were left stranded, writing: “Two girls alone in London at two o’clock in the morning with no accommodation.”
Which? also queried Booking.com’s AI trip planner, Dot, asking on the listing page: “Is this a real property, or is it a scam?”.
It replied: “The London Crown is a legitimate property located in the centre of London. It offers various amenities such as free WiFi, free bikes, and free private parking. It is conveniently located near Longleat Safari Park and Longleat House, with London City Airport just 10 km away. Based on the detailed description and amenities listed, the London Crown appears to be a real and well-equipped property.”
Dot failed to spot that Longleat Safari Park is more than 100 miles from London.
Which? was also alerted to a listing titled “Apartments near Big Ben” using the address of Portcullis House, part of the Parliamentary estate housing hundreds of MPs.
Booking.com told Which? that both cases involved legitimate property listings hijacked by cybercriminals through a sophisticated phishing attack.
Which? Travel editor Rory Boland said: “Not only does Booking.com refuse to take scams seriously, but its requirement that guests turn up to properties, even when it has been advised the property doesn’t exist, is utterly reckless. It’s frightening, humiliating and risks people’s safety.
“Instead of taking action when fraudulent listings are reported, Booking.com prefers to let its customers bear the financial and safety risks.
“Ofcom must show it will use its powers to get tough with irresponsible online platforms that leave consumers wide open to fraud.”
Booking.com said: “Our investigation indicates that both properties – which are legitimate and have hosted guests – were targeted by a sophisticated phishing attack. The attack affected the properties’ own computer systems and gave cybercriminals temporary, unauthorised access to the accommodation’s Booking.com account.
“We take incidents like this extremely seriously, and suspended bookings at both properties, as well as supporting affected customers.”
An Ofcom spokesman said: “Fraud online can have serious consequences for victims and platforms have clear legal duties to take down illegal content generated by users once they become aware of it.
“More broadly, we’ve shown that we’ll use our enforcement powers against platforms that fail to comply with the Online Safety Act, and have already launched investigations into over 100 sites.”
