Consumer group Which? managed to set up a fake holiday rental listing for 10 Downing Street on travel platform Booking.com, leaving a bogus review praising resident mouser Larry the cat before the page was eventually taken down.

The watchdog carried out the sting to test the website's verification and scam prevention systems. Researchers were able to list the Prime Minister's official London residence as a one-bedroom rental, complete with photos of the famous black front door and a description advertising it as "a prime city centre location".

Despite the clear signs that the property was not a legitimate holiday home, Which? said the listing remained on the platform for two months before Booking.com removed it on 27 August.

During the test, Which? opened a 20-minute window allowing members of the public to view the property and request a stay. In those 20 minutes, 14 people asked to book the address. Only a reservation submitted by a Which? researcher was accepted.

The investigation also tested the platform's messaging defences against phishing. Watchdog staff sent a message inside Booking.com's system asking the researcher to click an external link to confirm payment details. Booking sites typically block external links to stop scammers stealing financial data, but Which? said Booking.com failed to flag or remove the message.

A fabricated review left on the profile also bypassed moderation. It read: "It was unbelievable that Booking.com let us stay at 10 Downing Street - the home of the UK PM!" Although Booking.com sent an automated note saying moderators would review the comment, it was published on the live listing shortly afterwards.

Rory Boland, travel editor at Which?, described the site's vetting process as "unfit for purpose". He said: "It would be laughable that we were able to list the UK's most famous address for rent, if the consequences weren't so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links."

Booking.com disputed the watchdog's conclusions, telling the BBC that the exercise did not represent its standard service. "This limited test is not a true reflection of the experience of millions of listings or reviews published on our platform," a spokesperson said.

The company pointed out that customers could only view the property during the brief 20-minute window arranged by Which?. It also noted that it provides "visible reminders to not click on links customers are not confident about, and booking confirmations also provide further guidance, including details of the agreed payment schedule."

The spokesperson added: "Fraud affects many industries, and 80% of UK adults believe scams are becoming more sophisticated," saying the travel giant is continuing to strengthen its platform defences.

Which? is now calling on communications regulator Ofcom to enforce the Online Safety Act to "crack down on irresponsible online platforms that leave consumers wide open to fraud". Under the Act, platforms are required to show they are committed to taking down fraudulent and illegal material once identified. An Ofcom spokesperson confirmed to Which? that platforms "have existing legal duties that mean they must take it down swiftly once they become aware of it".

What remains unclear is how many other fraudulent listings manage to slip through moderation systems before being spotted by customers. I'll be following this one — check back for updates.