Another HomeAway phishing case prompts more questions about new fees

This shouldn’t have happened to JoAnne Hemsley’s daughter, Daniella. Not with the recent changes HomeAway made to protect users from phishing attacks.

But it did.

Hemsley’s daughter rented a home in Napa, Calif., during the Memorial Day weekend. Stop me if you’ve already heard this story: Daniella wired money to someone who pretended to be the owner; turns out the real owner’s account had been hacked.

Now she has no rental and the money is gone.

“I am just looking to be made whole after this huge mess,” she says.

Her daughter lost $2,300. She may receive a partial refund of up to $1,000 under its “carefree” guarantee, but that hasn’t been decided yet.

She wants all of her money back, and why shouldn’t she get it? She believed she was booking through a trusted site. Instead, she wired money to a scammer.

This is not a new story. I’ve covered the phishing problem since 2011. It’s a recurring theme on this site.

What is new? HomeAway, freshly acquired by Expedia, has added a controversial new booking fee that promises, among other things, that “travelers who book or pay directly through HomeAway’s sites will have the full amount of their booking protected against things like misrepresented or double-booked properties.”

That would suggest Hemsley’s daughter should have been “protected” against a fake owner. Or does it?

Well, we don’t know yet. I’ve contacted HomeAway to find out, I’ve asked Hemsley for a paper trail, and we’re still waiting on the results of HomeAway’s investigation.

Maybe I’m reading the new HomeAway commitment the wrong way. But even if I am, I would expect that if I’m paying between 4 and 10 percent based on the total amount of the rental, but not to exceed $499, that HomeAway would stand behind its product and refund any money I’d spent on a rental I found through its site.

Related story:   Which United Airlines case should we take? The canceled cruise vs. the flight delay

Perhaps that’s naive. I anticipate a site like HomeAway, or any other site dealing in vacation rentals, will tell me that it’s nothing more than a platform that handles transactions between a vacation rental owner and a consumer. Kind of like Craigslist, only more expensive and with fewer scams.

I’m not making that up. Those are the actual words used by executives when I asked them about their business, and in particular when I confronted them about the phishing problem.

But if these sites are just glorified online classifieds, then please also stop referring to your rentals as “carefree” and positioning yourself as a trusted intermediary.

I still have high hopes that this case can be resolved to Hemsley’s satisfaction, and that, indeed, this was nothing more than a misunderstanding between her and HomeAway.

We shall see.

Should I advocate for JoAnne Hemsley and her daughter?

View Results

Loading ... Loading ...

Update (3/17): HomeAway has responded.

The booking fee is not an insurance product. The funds from the fee are not solely used for our Book with Confidence Guarantee, but are also invested in things like marketing and improvements to the site. You can read more about the new guarantee product here:

Christopher Elliott

Christopher Elliott is an author, journalist and consumer advocate. You can read more about him on his personal website or check out his adventures on his family adventure travel site. Contact him at Read more of Christopher's articles here.

  • Ben

    It’s really not clear exactly what happened in this case. How did a scammer get access to a legitimate owner’s account? How did they communicate with the consumer and convince her to wire the payment? What safeguards are in place to protect consumers from this sort of fraud? We need many more details before we can vote on the case.

    In any case, this type of case is outside of both the letter and spirit of Homeaway’s guarantee, so I think you’re taking the wrong approach by pursuing it that way. If Homeaway has lax security standards that allowed this to happen, which is what I expect based upon the state of security on most websites, then they ought to fully reimburse the consumer.

  • Joe_D_Messina

    According to HomeAway’s website, she is out of luck. This below is taken straight from their site. I wish there was more info about how the scammer got her info. HomeAway has secure online payment options for many properties. Was this a property that didn’t have that? What would possess anybody to wire money given how many fraudulent cases there are out there?

    Avoid the following practices

    Sending cash is not recommended, but paying in cash in person to owner or manager upon arrival can be okay.

    Sending a check made out to cash.

    Using an instant money transfer such as Western Union or Money Gram.

    These payment methods are preferred by criminals and using them voids any guarantees from us.

  • mbods2002

    Hmmm, have a point there. Sounds like their guarantee is only for secure online payments made through their site? I’ve booked with HomeAway and haven’t had any problems but I’d like to know how this plays out!


    I am in favor of advocating for the daughter (who actually booked and paid) to at least find out what happened. VRBO has a great deal of payment information and advises travelers of the most secure payment method. I am very curious as to why the daughter paid that kind of money and did not follow the advice on the website. Advocating should at least answer that question and maybe get something back for her.

  • flutiefan

    Bam. There ya go. She’s not covered under their guarantee.

    And never, ever wire money to these types of things!!!

  • Alan Gore

    It appears that HomeAway’s anti-scam guarantee is contingent on both parties using a specified secure payments system, which also protects their service against being shortchanged by renters making under-the-table deals to avoid paying commissions. The oldest trick in the Book of Scams is to convince a mark to do something illegal to get a discount.

  • commentfromme

    This is how that scam happens – somewhere – somehow an owner is phished. They “click a link” they should not have clicked and a scammer gets access to the owner account. This is not really the fault of HomeAway. A scammer has sent in an inquiry and gotten an owner legit info. Then the unsuspecting target comes along looking for a rental. By then, the scammer has diverted the emails and controls that account, or the scammer can even offer back to the target another total house….not even the first house….actually, a house that is not even phished, and the trail becomes one that can’t even be traced. The problem is that daughter wired money and paid outside of the the system. HomeAway has built the protections upon paying only through HomeAway and does not cover wired funds. This entire extra fee is built upon bullying the consumer to only pay within the system.

  • commentfromme
  • Ruth Carson

    I agree with your assessment. However, Homeaway has made promises about ‘carefree booking’ and they do charge an extra ‘convenience fee’ for their service. I think this is a case where they need to pay up.

  • Extramail

    The only people who make any money from these class action lawsuits are the attorneys. Now, if it makes HomeAway adopt better business practices I guess it’s worth it. EA just settled a class action lawsuit that has been going for 12, yes, 12 years. The settlement is for $60 million and the attorneys get $20 million of that. The most any one participant receives is $15000 and EA doesn’t make the particular game that the suit was about. So, I don’t hold my breath when I hear class action lawsuit.

  • Joe Farrell

    So Homeaway responded with a non-response to the guarantee . . . .

    interesting to say the least.

    they had the perfect opportunity to say: “We guarantee that if you make a booking through our site and are not accommodated in the offered by the seller, and do not agree to suibstitute lodgings, you are entitled to a refund of all sums paid.”

    Unless they still believe that there are nefarious persons lurking on their site , in which case they have a lot bigger problems . . .

  • Pegtoo

    Wow. I would like to thank you. That is an amazing thing you did. I’m sorry your renters are not aware how lucky they were and failed to show their appreciation.

  • C Schwartz

    Yes but the carefree booking comes with using their secure payment portals. They specifically say not to use Western Union or Money gram.

  • William Leeper

    As someone involved in IT security, the most likely way for this to happen is someone gains access to the owner’s email account, sends a password reset from home away, and changes the listing terms.

    Unfortunately, Home Away is clear that their protections only apply when one pays through the home away website.

  • pmcw

    Christopher, I absolutely think you should be an advocate for JoAnne’s daughter. I’ve also been in communication with HomeAway (VRBO), and it seems as though they will say whatever is convenient from top to bottom (you should see the blogs where executives have participated, and they mediate out certain comments).
    The annual subscription cost for a property owner runs from nearly $500 to about $1700. Let’s tilt it to the low side and assume only $500 on average. With 1.239 million property owners, that still comes up to over $600 million per year – or about $600 million more than Craig’s List people to list there.
    You should read the transcript from the last quarterly conference call from EXPE – you can find it on It not only tells us about what is in store, you will see in the Q&A from analysts they aren’t buying the smoke and mirrors (EXPE won’t provide churn data on HomeAway – and that is likely going to increase significantly). The increasing short interest in EXPE stock backs that opinion.

  • pmcw

    I forgot to mention, my VRBO page showed symptoms of being hacked once, I even got a fake inquiry sent to my email address. I forwarded the bogus inquiry to VRBO, and followed up on the phone only to hear the assurance they never get hacked. Of course, they couldn’t explain the email…

  • pauletteb

    I’ll stay away from HomeAway, or any other “vacation” concept where I have to cook a meal or make a bed.

  • pmcw

    Listen to what HomeAway founder, Brian Sharples has to say about charging guests fees, and why it does NOT work:

  • pmcw

    Joe, While I agree with the point that no one should pay for a personal transaction with a wire transfer, the page VRBO sends travelers to is confusing (it is not the one you are referencing). On the page linked below VRBO specifically states that “bank to bank transfers” are okay, and doesn’t even mention “wire” transfers.

Get smart. Sign up for the newsletter.