Site   Web

September 30, 2014

Beware of Rental Phishing Schemes

Image courtesy of (Stuart Miles) /

When traveling with the whole family, I prefer to rent homes, condos or apartments over staying at a hotel. I find that having a kitchen and the extra space makes a big difference to our family’s comfort, and the price per night is often comparable to hotels. Unfortunately, owners of vacation rental properties have become targets of scammers who use photos and information posted to these sites to create fake property listings, soliciting payment from unsuspecting vacationers who unknowingly pay a thief, thinking that they are making a reservation for their upcoming vacation.

I discovered this scam while looking for a condo to rent during an upcoming trip to Disneyland. Before I started a general search using or as I normally would, I sent an e-mail to Kim Nguyen, the owner of a unit in the area that we rented last year. I asked if she would be running any discounts in the month we will be travelling, or if she offers a returning traveler discount. I didn’t receive a reply.

Several weeks later, I discovered a message in my junk mail folder, a reply to the e-mail that I had sent to Kim. The sender’s e-mail address wasn’t the one that I had written to, but I assumed that she had migrated to a new Gmail account. The message asked if I had received a reply that had been sent previously and whether or not I was still planning my vacation. It referenced the name and VRBO property number that I had included in my email, and indicated that the property was available – at a 25 percent discount – if I was still interested.

I started corresponding about the rental. The property didn’t show as available on VRBO’s website: was it actually available for the dates I would be travelling? The response came that the VRBO calendar wasn’t up to date and yes, the property is available. The price I was quoted was surprisingly low: $700 for five nights, when the price listed for the same unit on VRBO was $239/night. If I wanted to get the 25 percent discount, I would need to complete a bank transfer to pay the rent and security deposit.

I received an e-mail with a rental contract. The name of the owner was accurate – I knew the owner’s name from our previous rental – but her address was listed as being in the U.K. I knew that the owner lived in Orange County, and her phone number listed on VRBO was a 714 area code, so it seemed unlikely that she’d moved overseas. The property address was compete and accurate (specific street and unit numbers aren’t listed in VRBO search results), which I also knew from our prior stay. Then I got to the part where the bank information was listed for the transfer: Barclays Bank in the U.K.

At this point I had about 734 bells going off in my head at all the “red flags.” I decided that it’d be best to call Kim before going any further via email. It’s a good thing too: the e-mails I’d been replying to were not from her, despite the wealth of accurate details. Hackers had gotten access to her VRBO account, were re-routing inquiries from travelers, and had even stolen her photos – using them to post fake property rental offerings on sites like Craigslist.

According to Kim, she isn’t the only VRBO owner whose account was hacked. When the breach first occurred several months ago she says that the first indication of trouble was that she didn’t receive any e-mails for several days. As the manager of nine vacation rental properties, she averages 20-30 messages each day. Then the phone calls began. Existing renters wanting to know why she hadn’t gotten back to them, or worse, asking if they really should transfer funds as they were being asked to do via e-mails that appeared to have generated from her. She called VRBO and they confirmed that they’d been getting calls about many of their owner’s accounts being compromised. They recommended that she set up new email accounts and change her VRBO password. The site administrators sent an e-mail to former renters to warn them of the account breach and instruct them not to respond to discount offers requesting direct bank transfers (I didn’t get this letter).

While it’s lucky that I had enough skepticism to stop short of transferring money to an overseas account, Kim says not everyone was so lucky and it’s heartbreaking that there’s nothing she can do to stop it. With photos of her properties regularly being posted to sites like Craigslist at ridiculously low prices, it’s likely that others will continue to fall prey to the fraud.

A few tips to avoid this kind of scam:

  1. Never agree to transfer funds outside of a legitimate vacation rental site. Websites like VRBO and HomeAway allow travelers to pay directly through the site, and will even guarantee the transaction.
  2. Use extreme caution if you intend to rent a property through a site like Craigslist. Person-to-person transactions offer no guarantees or protections for either party.
  3. If something makes you leery (deal seems too-good-to-be-true, information that isn’t quite right, an owner that isn’t forthcoming with details about themselves or the unit), call the phone number listed on a legitimate vacation rental website and speak with the owner directly.


Andrea Eldridge is CEO of Nerds On Call, which offers onsite computer and laptop repair service for homeowners and small businesses. Based in Redding, Calif., it has locations in five states. Contact Eldridge at