Consumer group Which? says it was able to create a fake listing for 10 Downing Street on travel giant Booking.com.

The UK watchdog said its researchers were able to book a bogus stay at the prime minister’s address – as well as leave a fake review noting “hanging out” with resident mouser Larry the cat as a highlight.

It said despite clear signs it was fake, Booking.com did not remove the listing until two months after it was uploaded.

“This limited test is not a true reflection of the experience of millions of listings or reviews published on our platform,” a Booking.com spokesperson told the BBC.

They said because Which?’s listing was not “live” on its site across the two months it was present, “some of our automatic fraud controls were not triggered to completely remove the closed listing”.

People could only see the listing and request to book the property during a 20-minute window opened by Which? so its researchers could try to book it.

Booking.com’s spokesperson added “a range of checks and verification measures” help secure the site, and technologies such as AI “help us detect and remove the majority of fraudulent listings within 24 hours”.

But Which? Travel editor Rory Boland said its checks had been shown to be “unfit for purpose”.

“If Booking.com’s so-called sophisticated AI systems can’t spot that 10 Downing Street is not a holiday rental, then it’s no wonder scammers can exploit the platform so easily,” he said.

“It would be laughable that we were able to list the UK’s most famous address for rent, if the consequences weren’t so devastating for holidaymakers, who risk losing thousands of pounds to bogus listings and phishing links.”

It is not the first time the site has faced criticism over its security efforts and customer service.