The consumer group is calling for an Ofcom investigation after researchers created a fake rental at the Prime Minister’s address and processed a booking.

Booking.com is facing questions over its fraud controls after Which? Travel created a fictitious listing for 10 Downing Street and successfully took payment for a stay.

Researchers built the page on 18 June, describing the property as a one bedroom apartment in central London and using both the address and a photograph of the Prime Minister’s residence. According to Which?, the listing took only minutes to set up. During a twenty minute window it drew enquiries from 14 people, and the platform went on to process a payment from a Which? researcher for a week long booking. More than six weeks later, the money had not been returned.

The investigation also found the researchers could publish a fabricated maximum score review, which appeared almost immediately, and could send external payment links through the platform’s own messaging system without those links being intercepted.

Booking.com does not require hosts to supply photo identification or evidence of ownership until three months after a listing goes live. The fake page remained accessible until 27 August, when it was taken down following a final right of reply.

Rory Boland, editor of Which? Travel, said the episode would be “laughable” were the consequences for holidaymakers not so serious, pointing to the thousands of pounds travellers stand to lose to bogus listings and phishing links.

Which? has asked Ofcom to examine the company’s compliance with the Online Safety Act, which obliges platforms to guard against fake listings and act quickly on fraudulent content.

Booking.com rejected the findings, arguing the exercise did not reflect the experience of the millions of genuine listings on its platform. It said the property was never fully live and bookable, which meant some automatic fraud controls did not activate, and stated that its combination of verification checks and artificial intelligence removes most fraudulent listings inside 24 hours.

Ofcom said platforms are already required to remove illegal user generated content promptly once alerted, but confirmed Booking.com falls outside forthcoming rules covering paid for fraudulent advertising.