Something’s still “phishy” about vacation rentals

If you think the words “vacation rental” and “phishing” are all but synonymous, you’re not alone. Just talk to Ann Schutte, who recently found a rental villa with a “million-dollar” view in Sedona, Ariz., through the rental Web site

A woman claiming to own the property quoted her a $645 rate for five nights if she wired her the money. “After a number of e-mails back and forth, I agreed to the rental,” says Schutte, a property manager from Phoenix. “I received a contract. Everything looked correct on the contract. It even had the rental property address and logo. I signed the agreement, and wired the money through Western Union to the U.K.”

For those of you following the vacation-rental phishing saga, you probably know what comes next: Schutte never heard back from the “owner,” so she called the phone number under the property listing.

And that’s when she discovered that she had no reservation. She’d been scammed. VRBO “explained that the owner of the property had her e-mail hijacked because she didn’t have the proper filters in place,” Schutte says. “And there is nothing anyone can do.”

Phishing schemes fraudulently extract personal information by e-mail — in this case, the e-mail login credentials of a property owner. The criminals then impersonate the owner, enticing customers to wire money. The vacation-rental industry has been hit hard by this type of scam since 2011, and there appears to be no hope for a quick remedy.

HomeAway, which owns VRBO and has a commanding market share among vacation-rental Web sites, reported 3,000 phishing cases as of last fall. It declined to provide an updated number because it’s a publicly traded company and was working on its latest quarterly earnings report at the time I requested the information.

“The unfortunate fact is that phishing continues to be a part of the landscape of the Internet,” says Carl Shepherd, co-founder of HomeAway. “For this reason, we continue to work to create systems that enable owners and travelers to talk to each other so that each has a great experience, while minimizing the opportunities for either party to be hijacked by a phisher.”

Last year, the company announced a product called HomeAway Secure Communicationthat would have offered a phish-proof way for homeowners and prospective renters to communicate. But it was “met with some trepidation,” according to the company, because it required both owners and travelers to be logged in to a secure HomeAway system to communicate. HomeAway backed away from that proposed solution and is working on an alternative, which it plans to introduce soon.

Guests are impatient with the phishing problem. Consider what happened to Amitav Chakravartty last year when he decided to rent a home for a family reunion in Southern California. He found a great deal on an oceanfront villa on Craigslist, the online classifieds site, with just one catch. You guessed it: He had to wire $900 to the “owner.”

The loss of this money inspired Chakravartty and Anirban Bardalaye to start a company called Zaranga, a more tightly controlled vacation rental marketplace that handles the financial transaction between both parties.

“We primarily work with reputable licensed property managers, which eliminates any kind of fraudulent activity,” says Bardalaye. “Funds are not distributed to them till a day after check-in. Even more, if hosts require security deposits, Zaranga mediates between hosts and travelers before they release any kind of charges against security deposits.”

So far, Zaranga is working with 600 rental properties, mostly in Northern California, and it claims a “100 percent” track record against any kind of scam, phishing or otherwise.

But short of building an entirely new site that acts as an intermediary between the buyer and the seller, a phishing scam fix has proved elusive. That’s because the criminals perpetrating this scheme are exploiting weaknesses down the entire transaction path.

For example, they’re taking advantage of the fact that some property owners still accept — and often insist on — wire transfers. Sending money by wire offers consumers no protection, and once the funds have been sent, there’s usually no way to get them back.

The phishing schemes also exploit vulnerabilities at the site level, say critics. Many victims claim that sites such as HomeAway and VRBO have been hacked, leading to the compromised e-mail accounts. HomeAway disputes that claim, insisting that the owners’ e-mail accounts were hacked. In any event, the company now covers such breaches through optional insurance that renters can buy.

To add to the confusion, there’s yet another player: the bank handling the wire transaction. A loosely organized group of vacation rental owners has tried to push authorities in the U.K. to track down phishing scammers through the banking system, but so far they’ve been unsuccessful. The complaints are referred to a civilian data collection agency, which in turn is supposed to report phishing incidents to the police.

“They do not even grasp what is going on here,” says Nick Hyam, a British expatriate who manages several rental properties in Bali, Indonesia. “They have no direct contact with the police, have no system in place to update information, and as far as I can see have no system for collating information about the same case. Each report is dealt with as a one-off.”

Unfortunately, it’s either the traveler or the rental owner who usually pays. Rental owners complain that sites such as HomeAway and VRBO pressure them to offer either free or reduced-rate accommodations to victims or risk being de-listed. But more often, renters are simply told that their money is gone, and there’s no way to recover it.

That’s what VRBO told Schutte, even after I asked about her case.

(HomeAway has settled several cases like hers, but usually only when a guest threatens to sue, say victims. The company says that it has settled a few cases, but, a spokewoman added, “it depends on the facts.”)

Many of the online vacation rental sites see themselves as nothing more than listing services, not unlike a Craigslist for vacation rentals. And until that changes, it seems that these phishing incidents are likely to continue unchecked.

Preventing them is as easy as ever. “Use a credit card when paying for a vacation rental,” says Zaranga’s Bardalaye.

And never, ever, wire money. Especially when the deal is too good to be true.

Has VRBO done enough to stop phishing?

View Results

Loading ... Loading ...
Share this story
Share on Twitter Share on LinkedIn Share on Facebook

Underwritten by

This site is underwritten by Sodexo North America

Sodexo North America Sodexo North America is part of a global, Fortune 500 company with a presence in 80 countries. Sodexo is a leading provider of integrated food, facilities management and other services that enhance organizational performance, contribute to local communities and improve quality of life for millions of customers in corporate, education, healthcare, senior living, sports and leisure, government and other environments daily. Learn more at

This site is underwritten by Travelex Insurance Services

Travelex Insurance Services is a leading travel insurance provider in the United States with over 55 years combined industry expertise of helping people dream, explore and travel with confidence. We offer comprehensive travel insurance plans with optional upgrades allowing travelers to customize the plans to fit their needs. Compare plans, get a quote and buy online at

This site is underwritten by AirHelp

AirHelp is the world’s leading flight delays compensation company, helping passengers apply for compensation following a delayed or canceled flight or when boarding has been denied. It is AirHelp’s mission to fight for passenger rights by holding airlines accountable for flights disruptions that are out of passengers’ control. AirHelp has already helped 5 million people, taking the stress out of applying for compensation and making it as hassle-free as possible for travelers around the world.

This site is underwritten by Allianz Travel Insurance

The Allianz Travel Insurance company has built its reputation on partnering with agents all around the world to provide comprehensive travel insurance for their clients. Contact Allianz Travel Insurance for a comprehensive list of coverage.

This site is underwritten by Chubb

Chubb is the world’s largest publicly traded property and casualty insurance company, and recognized as the premier provider of insurance for successful individuals and families in the U.S. and selected international markets, offering coverage for high-value automobile, homeowners, recreational marine/aviation, valuables and umbrella liability coverage. As an underwriting company, Chubb assesses, assumes and manages risk with insight and discipline, and combines the precision of craftsmanship with decades of experience to conceive, craft and deliver the best insurance coverage and services to individuals, families and business of all size.

This site is underwritten by Enterprise Holdings

A family-owned, world-class portfolio of brands. A global network that spans across more than 85 countries. Some 97,000 dedicated team members sharing common values. And more than 1.9 million vehicles taking our customers wherever they need to go.

This site is underwritten by Fareportal

Fareportal’s portfolio of brands, which include  CheapOair and  OneTravel, are dedicated to helping customers enjoy their trip. Whether you want to call, click, or use one of our travel apps, one thing is clear: We make it easy to take it easy.

This site is underwritten by

An independent provider of low cost CDW/LDW insurance for use with rental cars. Up to $100,000 cover with no deductible. Policies available on a per day, per trip or per year basis. Also works with overseas rentals. Try  Insuremyrentalcar.comnow.

This site is underwritten by InsureMyTrip

It’s simple. InsureMyTrip finds you the right travel insurance plan, every time. InsureMyTrip is the authority on travel insurance. Rated A+ for travel insurance by the Better Business Bureau. All travelers that purchase a policy through  InsureMyTrip have access to Anytime Advocates® for claims assistance.

This site is underwritten by Mediacom Communications

The nation’s fifth-largest cable operator, serving the smaller cities and towns in the Midwest and Southern regions of the United States. We are a high-performance broadband, entertainment, and communications company that brings the power of modern technology and quality customer experience to life inside the connected home by combining ultra-fast gigabit speeds with personalized local and over-the-top entertainment choices that fit your lifestyle. Details at

This site is underwritten by SCOTTeVEST

An innovative apparel brand for people who want easy access to everything they need. For those who live for every second, SCOTTeVEST lets you maximize your life. Ditch the carry-on bag and pick up a  SCOTTeVEST.

This site is underwritten by Virtuoso

The leading global network for luxury and experiential travel. This invitation-only organization comprises over 1,000 travel agency locations with 17,500 advisors in over 45 countries, and holds preferred relationships with 1,700 of the world’s finest travel companies. Virtuoso advisors collaborate with their clients to create personalized itineraries featuring exclusive perks, while also providing advice, access, advocacy, and accountability. For more information, visit

This site is underwritten by VisitorsCoverage

As a company that is constantly striving to simplify travel insurance, VisitorsCoverage, is on a mission to help travelers make the better decisions about purchasing travel insurance, quickly. VisitorsCoverage has helped millions of travelers globally to buy the suitable travel insurance and explore the world with confidence. Get insurance for your next trip at  VisitorsCoverage. Lowest Price Guaranteed.

This site is underwritten by MedjetAssist

Medjet is the premier global air-medical transport, travel security and crisis response membership program for travelers. With a MedjetAssist membership, if you become hospitalized more than 150 miles from home, we will get you from that unfamiliar hospital all the way home to the hospital you trust. All you ever pay is your membership fee. MedjetHorizon members add 24/7 personal security and crisis response benefits. readers enjoy discounted rates. Travel safer with  MedjetAssist.

This site is underwritten by Southwest Airlines

The mission of Southwest Airlines is dedication to the highest quality of Customer Service delivered with a sense of warmth, friendliness, individual pride, and Company Spirit. We are committed to provide our Employees a stable work environment with equal opportunity for learning and personal growth.

This site is underwritten by Sungard Availability Services

Leveraging more than 35 years of experience, Sungard AS designs, builds and runs critical IT services that help businesses manage complex IT, adapt quickly and build resiliency and availability. A leading provider of critical production and recovery services, Sungard AS partners with customers across the globe, delivering resilient IT systems, infrastructure and recovery services tailored to achieving desired business outcomes.

This site is underwritten by makes it fast and easy to compare and buy travel insurance online from top rated providers. Our unbiased comparison engine allows travelers to read reviews, compare pricing and benefits and buy the right policy with a price guarantee, every time. Compare and buy travel insurance now at

This site is underwritten by Squaremouth

Squaremouth helps travelers easily and instantly compare travel insurance policies from all major providers. Only companies that meet the strict requirements of Squaremouth’s Zero Complaint Guarantee are available on the website. Compare policies on to save over 70 percent on your next purchase.

This site is underwritten by Travel Leaders Group

Travel Leaders Group is transforming travel through its progressive approach toward each unique travel experience. Travel Leaders Group assists millions of travelers through its leisure, business and network travel operations under a variety of diversified divisions and brands including All Aboard Travel, Andrew Harper Travel, Colletts Travel, Corporate Travel Services, CruCon Cruise Outlet, Cruise Specialists, Nexion, Protravel International,, Travel Leaders Corporate, Travel Leaders Network and Tzell Travel Group, and its merger with ALTOUR. With more than 7,000 agency locations and 52,000 travel advisors, Travel Leaders Group ranks as one of the industry’s largest retail travel agency companies.

This site is underwritten by Travelers United

If you’ve been mistreated by the airlines, Travelers United is your voice in Washington. Join the #1 travel advocacy organization working with Congress to improve and protect travelers. Plus, get $400 of annual benefits you can use for travel for only $29/year. Add your voice to ours. Make travel better.  Join today.