A UK consumer watchdog just handed the short-term rental industry a live case study in exactly why cities have spent the last few years building registration-verification requirements instead of leaving listing quality to the platforms. The property in question: the British Prime Minister's actual residence.

What Happened

A UK consumer group set out to test how well Booking.com screens the listings it publishes. On June 18, researchers posted a listing titled "1 bedroom apartment in the heart of London" using the real address of 10 Downing Street and an actual photo of the building, and claimed it was a four-minute walk from the Houses of Parliament.

The listing went live within minutes. No review process caught that one of the most recognizable political addresses on the planet had just been listed as a holiday rental. Booking.com went on to process a real payment for a week-long stay from a Which? researcher. A fake five-star review, referencing Downing Street's real resident cat, "Larry," was submitted and published almost immediately, despite Booking.com's own message stating it would first go through moderator review. Researchers also used the platform's internal messaging system to send a phishing-style request for credit card details through an external link, a type of message Booking.com told Which? it does have the technical ability to detect and block, but hadn't. The listing stayed live for six weeks before being taken down on August 27.

Which?'s travel editor put it bluntly: if a platform's automated systems can't catch something this obvious, it's not hard to see how real scammers get through. The group is now calling on Ofcom, the UK's communications regulator, to investigate.

Why This Matters Beyond One Bad Listing

This story lands at a moment when US cities have already concluded, independently and for entirely different reasons, that platform self-policing isn't something enforcement can rely on. The pattern shows up everywhere city governments have built STR regulation over the past few years, and the Downing Street case is a near-perfect illustration of the exact failure those laws were designed around.

California's SB 346, effective January 1, 2026, doesn't ask platforms to self-certify that a listing is legitimate, it gives cities and counties the authority to compel platforms to hand over host addresses, registration status, and booking activity directly, with fines up to $10,000 a day for platforms that don't comply. The law exists because a city checking a platform's own assurances that a listing is valid isn't considered reliable enough; the verification has to run through an independent data pull instead.

New York City's Local Law 18 goes a step further on the front end: platforms are legally barred from processing a booking at all unless the host is registered with the city first. That's not a review-after-the-fact model, it's a structural requirement that removes the platform's own listing-approval judgment from the equation, precisely because a platform deciding on its own whether a listing looks legitimate is exactly the process that just let 10 Downing Street go live as an apartment rental.

Houston's ordinance, effective January 1, 2026, requires every listing to display a valid registration number, and gives platforms just 10 business days to pull a listing once the city flags one that doesn't have one. Again: the city isn't trusting the platform's internal moderation to catch the gap. It's building a mechanism that doesn't depend on the platform noticing anything at all.

Booking.com's response calling it a "limited test" not reflective of the experience of millions of real listings is a reasonable thing to say about one deliberately provocative test case. But it's also exactly the kind of assurance that city ordinances like these were written to stop relying on. A platform's claim that its systems generally work isn't verification; it's a promise, and city governments have been moving steadily toward requirements that don't ask hosts, or the public, to take that promise on faith.

What This Means If You're a Host

If your listing is currently active on a platform, this story is a useful reminder that platform approval was never proof of legal compliance in the first place, a listing going live only ever meant the platform's own review didn't stop it, not that a government agency confirmed anything about it. As more cities adopt SB 346-style data-sharing laws and LL18-style pre-registration requirements, that distinction is becoming a lot less theoretical. A listing that’s live on a platform but isn’t properly registered locally is no longer something a city has to stumble across. Through a direct data request, it can identify those listings systematically. And that’s exactly the gap this story shows platforms aren’t reliably closing on their own. 

The Bigger Picture

A fake listing for a government building making it through a major platform's checks isn't really a story about one bad actor slipping through. It's a demonstration of a structural weakness, the same weakness cities have already been building around for the last several years, city by city, with registration mandates that assume platform vetting isn't enough. The test just gave that assumption a very public, very concrete example.

Lodge Compliance exists in the gap this story is really about: keeping a property's actual local registration current, so that when a city runs the kind of verification the platforms clearly can't be counted on to run themselves, there's nothing to find. Get a free property compliance report at lodgecompliance.com to stay safe.

This article is for general informational purposes and reflects publicly reported news as of early September 2026. Regulatory requirements referenced vary by jurisdiction and change over time — confirm current requirements with the relevant local authority before relying on them.