- Published
A theatre-goer fell victim to a "sophisticated phishing attack" after booking a "luxury" London apartment, only to discover the address was a Wetherspoon pub.
asserted
address → publish → apartment
Paul Dawson, from Loughborough in Leicestershire, paid £73 for a one-night stay for his family via Booking.com at The London Crown apartments to watch the musical Hamilton in the West End.
asserted
Dawson → pay → End
Days later, he said, he discovered the address shown in the listing was actually The Liberty Bounds pub, a Wetherspoon near Tower Bridge.
asserted
address → say → Bridge
Consumer protection organisation Which? said Wetherspoon staff had been turning away up to 20 tourists a day after scammers used the pub's address as a listing for a "block of luxury apartments".
asserted
scammers → say → apartments
Which? said it was also made aware of a property listed as "Apartments near Big Ben", with the address given as Portcullis House, part of the House of Commons estate, where hundreds of MPs work.
asserted
hundreds → say → MPs
Booking.com told Which? that in both cases, listings for legitimate properties had been targeted by a "sophisticated phishing attack, allowing criminals to hijack the listings".
asserted
criminals → tell → listings
Wetherspoon said it had informed Booking.com about this scam "as soon as it came to their attention".
asserted
it → say → attention
Dawson, 55, made his booking in August.
asserted
Dawson → make → August
Two days later, he said he received an email from The London Crown containing a link to a fake Booking.com page, which asked for his bank details.
asserted
which → say → details
Dawson told Which? he contacted Booking.com with his suspicions, but said the platform told him that he would need to visit the "fake apartment" and wait until after 7pm before it would relocate him.
asserted
it → tell → him
This was despite Mr Dawson explaining to them that he had since discovered the address shown in the listing was actually The Liberty Bounds pub.
asserted
address → explain → listing
He told Which?: "I explained to the support staff that I had autistic children and the idea of turning up at a clearly non-existent property at 10.30pm would have been catastrophic.
asserted
idea → tell → 10.30pm
"This did not change their response, that I needed to go to the property.
asserted
I → change → property
They said that if it was not possible to check in then I could contact them again and they would find an alternative."
uncertain
they → say → alternative
Dawson said the family ended up staying in the Premier Inn in Goodge Street.
asserted
family → say → Street
The listing for the London Crown apartments had 250 negative reviews from August and September along with a handful of, likely fake, positive reviews, Which? said.
asserted
? → have → reviews
The BBC checked the listing on Thursday.
asserted
BBC → check → Thursday
The information was still visible but the page carried the message: "We're sorry, but this property isn't taking reservations on our site right now".
asserted
property → carry → site
Wetherspoon said the listing was removed only for it to reappear, "though it now appears that the ability to book has been blocked".
asserted
ability → say → ?
"We have again notified them [Booking.com], asking for the listing to be permanently removed.
asserted
listing → notify → them
"It is clearly unacceptable for people to be defrauded in such a flagrant manner.
asserted
people → defraud → manner
"This is upsetting for the pub team, as there is little they can do to help, but even more so for the people who have been misled and have lost money as a result.
asserted
who → be → result
"Booking.com urgently needs to adopt more robust procedures to prevent fraudulent listings like this appearing in the first place."
asserted
listings → need → place
Many of the reviews from customers said they told Booking.com that it was a scam but had been ignored.
asserted
it → say → Booking.com
One customer said: "I reported it to Booking.com three days before check-in but they refused to do anything."
Another customer, from Spain, complained that she and her friend had been left stranded, writing: "Two girls alone in London at two o'clock in the morning with no accommodation."
Booking.com also has an AI trip planner called Dot, which allows users to ask questions.
asserted
users → say → questions
On The London Crown listing page a Which? researcher asked: "Is this a real property, or is it a scam?".
asserted
it → ask → page
It replied: "The London Crown is a legitimate property located in the centre of London.
asserted
Crown → reply → London
It offers various amenities such as free wifi, free bikes, and free private parking.
asserted
It → offer → wifi
It is conveniently located near Longleat Safari Park and Longleat House, with London City Airport just 10km away.
asserted
It → locate → Airport
Based on the detailed description and amenities listed, the London Crown appears to be a real and well-equipped property.
asserted
Crown → base → description
"
Dot failed to recognise that Longleat Safari Park was more than 100 miles (160km) from London, in Wiltshire.
asserted
Park → fail → Wiltshire
"Apartments near Big Ben" and The London Crown apartments were both targeted by the phishing attack, said Booking.com.
asserted
Booking.com → target → attack
"The attack affected the properties' own computer systems and gave cybercriminals temporary, unauthorised access to the accommodation's Booking.com account," a spokesperson said.
asserted
spokesperson → affect → account
"We take incidents like this extremely seriously, and suspended bookings at both properties, as well as supporting affected customers."
asserted
We → take → customers
An Ofcom spokesperson said: "Fraud online can have serious consequences for victims and platforms have clear legal duties to take down illegal content generated by users once they become aware of it.
"
asserted
they → say → it
More broadly, we've shown that we'll use our enforcement powers against platforms that fail to comply with the Online Safety Act, and have already launched investigations into over 100 sites.
asserted
that → show → sites
The Aporia
