{
  "story_id": "b4e9d60eddaa1b46c52ad43d1af09ad7",
  "desk": "drm3",
  "revision": 1,
  "published_at": "2026-09-02T07:45:12.000Z",
  "content_hash": "fe19cb5e3e98e415a8d93b8a0fc060276957e0d7ed0103b804dc9fe050c831b4",
  "hash_basis": "sha256 over `headline\\ndek\\nprose`, plus `\\n` + the canonical citations JSON when any source is placed, plus `\\n#blog` for blogs",
  "basis": {
    "headline": "UK Watchdog Exposes Security Gaps on Booking.com via Fake Downing Street Listing",
    "dek": "Which? watchdog exposed security failures on Booking.com by successfully listing a fake property at 10 Downing Street.",
    "prose": "The UK consumer watchdog Which? successfully set up a fake listing for 10 Downing Street on Booking.com on June 18, 2026, using the address and a picture of the Prime Minister's home. [^1]\n\nA payment for a week-long stay was processed by Booking.com for the fake listing, and the money had not been refunded more than six weeks later. [^2]\n\nRory Boland, editor of Which? Travel, said on 2026-06-25 that Booking.com's AI systems failed to spot the fake listing and urged the Prime Minister to urge Ofcom to use the Online Safety Act. [^3]\n\nBooking.com did not remove the fake listing until two months after it was uploaded, despite clear signs it was fake. [^4]\n\nWhich? researchers were able to book a bogus stay at the prime minister's address and leave a fake review noting 'hanging out' with resident mouser Larry the cat as a highlight. [^5]\n\nWhich? Travel editor Rory Boland said its checks had been shown to be 'unfit for purpose' and that scammers could exploit the platform easily if AI systems cannot spot that 10 Downing Street is not a holiday rental. [^6]\n\nA fake review was uploaded to the site almost immediately after the listing went live, describing the stay as 'exceptional' and mentioning 'Larry the cat'. [^7]\n\nThe listing remained active until it was finally removed on 27 August 2026, six weeks after it was set up. [^8]",
    "cited": "[{\"statement\":\"The UK consumer watchdog Which? successfully set up a fake listing for 10 Downing Street on Booking.com on June 18, 2026, using the address and a picture of the Prime Minister's home.\",\"source\":\"The Independent\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-01T23:01:00.000Z\",\"publisher_count\":1,\"sources\":[\"The Independent\"]},{\"statement\":\"A payment for a week-long stay was processed by Booking.com for the fake listing, and the money had not been refunded more than six weeks later.\",\"source\":\"The Guardian\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T07:45:12.000Z\",\"publisher_count\":1,\"sources\":[\"The Guardian\"]},{\"statement\":\"Rory Boland, editor of Which? Travel, said on 2026-06-25 that Booking.com's AI systems failed to spot the fake listing and urged the Prime Minister to urge Ofcom to use the Online Safety Act.\",\"source\":\"The Independent\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-01T23:01:00.000Z\",\"publisher_count\":1,\"sources\":[\"The Independent\"]},{\"statement\":\"Booking.com did not remove the fake listing until two months after it was uploaded, despite clear signs it was fake.\",\"source\":\"BBC News\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T01:27:34.000Z\",\"publisher_count\":1,\"sources\":[\"BBC News\"]},{\"statement\":\"Which? researchers were able to book a bogus stay at the prime minister's address and leave a fake review noting 'hanging out' with resident mouser Larry the cat as a highlight.\",\"source\":\"BBC News\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T01:27:34.000Z\",\"publisher_count\":1,\"sources\":[\"BBC News\"]},{\"statement\":\"Which? Travel editor Rory Boland said its checks had been shown to be 'unfit for purpose' and that scammers could exploit the platform easily if AI systems cannot spot that 10 Downing Street is not a holiday rental.\",\"source\":\"BBC News\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T01:27:34.000Z\",\"publisher_count\":1,\"sources\":[\"BBC News\"]},{\"statement\":\"A fake review was uploaded to the site almost immediately after the listing went live, describing the stay as 'exceptional' and mentioning 'Larry the cat'.\",\"source\":\"The Guardian\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T07:45:12.000Z\",\"publisher_count\":1,\"sources\":[\"The Guardian\"]},{\"statement\":\"The listing remained active until it was finally removed on 27 August 2026, six weeks after it was set up.\",\"source\":\"The Guardian\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-02T07:45:12.000Z\",\"publisher_count\":1,\"sources\":[\"The Guardian\"]}]",
    "kind": "news"
  },
  "receipt_verify": "Ed25519 over the dot-joined string `slice_hash.cursor_from.cursor_to.view.view_version.row_count`; public_key and sig are base64url of the raw 32-byte key / 64-byte signature",
  "receipt": null,
  "receipt_note": "this revision predates receipt-keeping (before v0.37.0); the filed row lives in the record",
  "generation_chain": {
    "wire": {
      "stream": "fountain_news",
      "story_id": "507bcb6bd8871d09a5568bfdf125e8ac",
      "thread_id": "a2ee8a692654e865597bab355e077b50",
      "thread_label": "Rory Boland",
      "novelty": "UPDATE",
      "content_hash": "2d9b9b482332416f57c48d53f9474546a255af35e35a81b56fe3f387f7e1b7be",
      "last_published_at": "2026-09-02T07:45:12.000Z",
      "read_receipt": {
        "slice_hash": "069682019ef400563585527bab6474e0dc4419c25869011c2b01ad23bb466b71",
        "cursor_from": "eyJ0cyI6IjIwMjYtMDktMDJUMDY6NDY6NTIuMDAwMDAwWiIsImlkIjoiMWFmYjlhNThjYWIzZjJmNGNkN2I3YTRiZmQ3Y2YwOGYiLCJ2IjoiMSJ9",
        "cursor_to": "eyJ0cyI6IjIwMjYtMDktMDJUMDc6NDg6NDkuMDAwMDAwWiIsImlkIjoiZTlkZTA0NWE4NTRkNDJhYzAwMTVhN2EzZGE3MWMzOGQiLCJ2IjoiMSJ9",
        "view": "v_fountain_news",
        "view_version": "1",
        "row_count": 100,
        "window_days": 3,
        "bytes_scanned": 12017721,
        "credits": 8,
        "price_per_100_rows": 8,
        "sig": "4e4uuUUMSWBJT7xlEq27xWcgwtqZLJGYaNOsJ3sslOlxq3IrRr9i1CJiktWIbaGtetaDL4BBDFSkjx7Z91KnAg",
        "public_key": "bMUigy8O0jOnBxQ4Sc-5lwhIZ8LQVAhxMbR7qESVuUE",
        "signer_path": "lakehouse/data-extract/v1",
        "alg": "Ed25519",
        "signed": true
      }
    },
    "written_at": "2026-09-02T22:41:20.269Z"
  },
  "cited_facts": [
    {
      "statement": "The UK consumer watchdog Which? successfully set up a fake listing for 10 Downing Street on Booking.com on June 18, 2026, using the address and a picture of the Prime Minister's home.",
      "source": "The Independent",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-01T23:01:00.000Z",
      "publisher_count": 1,
      "sources": [
        "The Independent"
      ]
    },
    {
      "statement": "A payment for a week-long stay was processed by Booking.com for the fake listing, and the money had not been refunded more than six weeks later.",
      "source": "The Guardian",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T07:45:12.000Z",
      "publisher_count": 1,
      "sources": [
        "The Guardian"
      ]
    },
    {
      "statement": "Rory Boland, editor of Which? Travel, said on 2026-06-25 that Booking.com's AI systems failed to spot the fake listing and urged the Prime Minister to urge Ofcom to use the Online Safety Act.",
      "source": "The Independent",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-01T23:01:00.000Z",
      "publisher_count": 1,
      "sources": [
        "The Independent"
      ]
    },
    {
      "statement": "Booking.com did not remove the fake listing until two months after it was uploaded, despite clear signs it was fake.",
      "source": "BBC News",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T01:27:34.000Z",
      "publisher_count": 1,
      "sources": [
        "BBC News"
      ]
    },
    {
      "statement": "Which? researchers were able to book a bogus stay at the prime minister's address and leave a fake review noting 'hanging out' with resident mouser Larry the cat as a highlight.",
      "source": "BBC News",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T01:27:34.000Z",
      "publisher_count": 1,
      "sources": [
        "BBC News"
      ]
    },
    {
      "statement": "Which? Travel editor Rory Boland said its checks had been shown to be 'unfit for purpose' and that scammers could exploit the platform easily if AI systems cannot spot that 10 Downing Street is not a holiday rental.",
      "source": "BBC News",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T01:27:34.000Z",
      "publisher_count": 1,
      "sources": [
        "BBC News"
      ]
    },
    {
      "statement": "A fake review was uploaded to the site almost immediately after the listing went live, describing the stay as 'exceptional' and mentioning 'Larry the cat'.",
      "source": "The Guardian",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T07:45:12.000Z",
      "publisher_count": 1,
      "sources": [
        "The Guardian"
      ]
    },
    {
      "statement": "The listing remained active until it was finally removed on 27 August 2026, six weeks after it was set up.",
      "source": "The Guardian",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-02T07:45:12.000Z",
      "publisher_count": 1,
      "sources": [
        "The Guardian"
      ]
    }
  ],
  "note": "A signature proves who filed this and that it has not changed since. It never makes a claim true."
}