Fake Booking.com Listing Used Parliament's Address

Criminals used the address of Portcullis House, part of the House of Commons estate, to advertise a fake Booking.com listing called 'Apartments near Big Ben'. A second, seemingly linked listing used the address of a London Wetherspoons pub near Tower Bridge, sold as 'London Crown' apartments. Both appear to have been created by phishing genuine hosts' accounts, then swapping in new names, photos and addresses.

One guest was charged £243 for a three-night stay that didn't exist, and was asked through Booking.com's in-app chat for bank details shortly after paying. Some guests who grew suspicious were reportedly told by Booking.com to go to the address and check in. At Portcullis House, that meant being turned away by armed security. Booking.com told Which? that a phishing attack gave criminals temporary unauthorised access to two real Somerset properties' accounts, and that it has suspended bookings on both and is supporting affected customers.

What this actually means for you

This isn't a story about Parliament being hacked. It wasn't. Someone simply typed a well-known public address into a booking listing, and enough of the normal checks failed to let it stay up. The genuine weak point was a phishing attack on a host's account, not any flaw in how you use the platform.

It's also a reminder that a listing looking legitimate, having reviews, a professional-looking page, even AI backing, isn't proof that it's real. Booking.com's own AI trip-planning tool told researchers both fake listings were genuine when asked directly.

This doesn't mean every Booking.com listing is suspect, or that most guests are at risk. It means a small number of listings were manipulated, and the warning signs were there if you knew to look.

What to do

Before you book

• Be wary of central London addresses at unusually low prices, or addresses that seem to belong to well-known public buildings, offices or pubs rather than housing.
• Check the listing's reviews for recent complaints, not just the star rating. Scam listings often accumulate negative reviews quickly once guests realise something is wrong.

After you've paid

• Genuine payment happens through Booking.com's official checkout, not through a follow-up chat message or a separate link. If you're asked to send bank details after the booking is confirmed, don't.
• If you're told to travel to the property to 'check it exists' as a form of verification, that isn't standard practice. Contact your bank or card provider for a refund instead of turning up somewhere in person.

If you think you've been targeted

• Report the listing to Booking.com directly.
• Report it to Action Fraud as well. Don't rely solely on the platform's own assistant or in-app guidance to tell you whether something is genuine, in this case it didn't.
• If you've shared any bank details, contact your bank immediately.

What this does not fix

A VPN doesn't stop a booking platform's host account being phished, and it doesn't verify whether a listing or an address is genuine. Nothing here suggests encrypting your connection would have prevented this particular scam: the fault sat with account security on the platform side and with listings that weren't properly checked before going live.

What a VPN and good habits *do* help with is the part that's yours to control: not clicking suspicious links sent to you off the back of a booking, not reusing a password that's already been exposed elsewhere, and checking a link before you open it rather than after.

If you've had a message about a booking that feels wrong, or you're not sure whether a link is genuinely from Booking.com, Veystrix's free scam checker at /tools/scam will look at the wording for you, and /tools/url will check a link without you having to open it.