News
Which? reported that Booking.com let a fake listing use Portcullis House as its address, sending paying guests to be refused entry by armed guards.
Reported by
Which?According to Which?, a fake holiday listing on Booking.com used the address of Portcullis House, an office block belonging to the House of Commons, and sent real customers to its door. Armed security guards had to turn them away.
The listing, called 'Apartments near Big Ben', used photos of a genuine flat and gave its address as Portcullis House. That building is part of the House of Commons estate, where hundreds of MPs work. Booking.com does not appear to have checked the address against the listing before it went live.
The scam depends on one gap: nobody at Booking.com checked whether the address on the listing matched a real, bookable property. A criminal gang typed in a false address next to real photos, and the platform published it.
Guests paid, then received a message from the 'owner' asking them to confirm the booking by filling in a form with their bank details. That request is usually the point where a guest gets suspicious. Several reviewers under the listing said this was the moment they realised something was wrong.
What happens next is the part that turns a bad listing into a serious problem. Guests who contacted Booking.com to cancel were told they could not get a refund unless they travelled to Westminster and tried to check in in person. Some did. They found armed guards at the entrance, and no apartment. One reviewer described driving down from Manchester and spending the night in the car with four children after being turned away.
Another listing, seemingly from the same gang, sent victims to a Wetherspoons pub instead. Dozens of people, perhaps hundreds, are believed to have turned up looking for a room that never existed.
The tell here is not subtle once it arrives: a genuine holiday booking should never require a guest to send bank details through a separate form after paying through the platform. That request is the point to stop, not the point to travel to the address and check. Which? Travel had already shown Booking.com's weak host checks earlier in the year, when it listed 10 Downing Street as a holiday let to demonstrate how little verification happens before a listing goes live.
The Portcullis House listing existed before that story ran. Bookings on it have since been blocked, but the listing stayed visible on the platform for months.
The step that let this work was never verifying the address. Everything that followed, the payment, the bank details request, the trip to Westminster, followed from that one unchecked line in a listing form.
