You keep the cottage page tidy. You answer the messages. Then someone else is inside the same login, the pin on the map is a Wetherspoon in Tower Hill, and guests are standing in Trinity Square with a confirmation that has your channel on it.
That is the Which? report of 25 September 2026. It is not a from-scratch fake listing. Booking.com says criminals phished the owner’s own systems and used a real partner account. The reviews, the address and the money all moved while the cottage was still the account on file.
What guests walked into
Staff at The Liberty Bounds, the Wetherspoon on Trinity Square near Tower Bridge, have been turning people away who arrived expecting a block of “luxury apartments” sold as The London Crown. Which? said one reviewer put the number at about 20 a day.
The chain told the watchdog it reported the listing on 10 August. Bookings for early September were still being taken after that date. Which? said the page was still visible on 23 September, with more than 250 poor reviews from August and September and a handful of positive ones it treated as likely fake. The BBC checked later the same week and found the page still up, with bookings frozen and a line saying the property was not taking reservations.
Paul Dawson, 55, from Loughborough, paid £73 in August for one night for himself, his wife and their daughter while they were in London for Hamilton. Two days later an email from “The London Crown” sent him to a page that looked like Booking.com and asked for bank details. He did not pay. He told the platform the pin on the map was the pub. Support still told him to go to the address and wait until after 7pm before it would move him.
“I explained to the support staff that I had autistic children and the idea of turning up at a clearly non-existent property at 10.30pm would have been catastrophic,” he told Which?. “This did not change their response.” The family stayed at a Premier Inn on Goodge Street.
A review Which? quoted from a guest who had planned an August stay: they reported it three days before check-in and said the platform refused to do anything. Another, from Spain: “Two girls alone in London at two o’clock in the morning with no accommodation.”
The second listing, and whose account it was
Which? said a second page, “Apartments near Big Ben,” used the address of Portcullis House on the parliamentary estate. Booking.com told the magazine both pages belonged to real properties that had hosted guests and had been hit by a phishing attack on the owners’ own systems, giving criminals temporary access to the Booking.com accounts. It said it had suspended bookings at both and was supporting affected customers.
Which? said one of the hijacked accounts belonged to a Somerset cottage owner, and that a second cottage from the same owner was also compromised. The company’s “legitimate property” line is about those cottages, not about the pub or Portcullis House.
The watchdog’s AI trip planner test on The London Crown page asked whether the property was a scam. The tool, Dot, called it legitimate and placed it near Longleat Safari Park, more than 100 miles from Tower Hill.
This is not the No. 10 test
The episode follows Which?’s 2 September report that its researchers listed 10 Downing Street as a one-bed flat in June, took a test payment and posted a 10/10 review about Larry the cat. That listing stayed up until 27 August.
That case was a from-scratch fake. The Tower Hill pages were different: criminals used a real partner login. For you that is the sharper warning. A hijacked extranet can take money in your name, rewrite the address and bury the listing under one-star reviews while guests are told to turn up anyway.
Wetherspoon said it flagged the problem as soon as it knew, that the page came back after it was taken down, and that Booking.com needs tighter checks before a listing like this goes live. Which? has asked Ofcom to look at the platform under the Online Safety Act. Booking.com says the cases are not typical of millions of listings.
The guest-facing pattern (a real stay, then a card link) is the same hole as the partner-login warning. This time they also moved the pin.
What you do on the dashboard
Change the Booking.com password. Turn on the extra login check. Do not tap payout or “verify your property” links from email.
Open the live listing and read the address against the one on the deeds. If reviews suddenly mention a pub, a locked door or a page asking for a card, treat the account as compromised. Ring partner support on a number from the extranet, not from the email.
Tell arriving guests, in a note you send, that you will never ask for a bank detail off the confirmation. Give them a number that is actually yours.
You do not have to delete the big-site listing tomorrow. Most owners will not. Keep it for discovery if it still earns the cut. Take the repeats, and anyone who will listen, on a page you control. A booking that lands on a site you own does not sit behind that shared login. That is the job StayLocal is built for. A starting property site is here: cottage.demo-sites.uk.
The partner-terms piece is still the contract on that channel. This is the extra risk you carry for being in it.
Key sources
- Which?, 25 September 2026, “Houses of Parliament used in new Booking.com scam”: The London Crown at The Liberty Bounds, Apartments near Big Ben at Portcullis House, Somerset owner accounts phished, 10 August Wetherspoon report, 250-plus poor reviews, Dot planner test, Dawson quote, Booking.com phishing statement.
- BBC East Midlands, 25 September 2026: Dawson, £73, Hamilton, Premier Inn Goodge Street, listing still visible with bookings frozen when checked.
- The Sun, MyLondon and GB News same-day pickups of the Which? report.
- Booking.com boustatement via Which? and MyLondon: sophisticated phishing of partner systems, temporary access to the Booking.com account, bookings suspended, customers being supported.
- Which?, 2 September 2026: 10 Downing Street test listing from June, test payment, Larry the cat review, page removed 27 August.