“HOLIDAY SCAM” HOW IT WORKS

Renters looking for accommodation on HomeAway/Owners Direct websites have a massive choice (HomeAwaylists 1m properties) and most contact the owner through the “inquire” page on the website. The trouble is, the scammer may have got there first intercepting the request. They do this by sending the property owner an initial, fake inquiry. It has a link that once clicked on makes the recipient think they are logging in to either their HomeAway, or email sign-in page. But in reality the link takes them to a page created by the fraudster.  If the owner logs in, the scammer now has access to their email account, and can begin intercepting legitimate rental inquiries. To cover his tracks, the scammer will typically delete real requests and reply to the victim from an entirely different, but similar email address set up for the purpose. They then pose as the owner providing fake details, sending fake contracts, answering questions etc., and finally asking for the payment to be made direct into their bank account. The real owner will often know nothing about it and just think the number of inquiries has fallen away. Because the sites show a renter’s email address on all requests, the scammers can email them to offer an alternative.

Campaigners calling for security to be improved say the sites should stop sending renters’ email addresses to owners and, instead, all email addresses should be held within its internal system. They say rival sites have changed the way they operate to improve security. This week Guardian Money sent messages to two Owners Direct properties in France. One replied within the HomeAway website, the second simply sent an email from their personal email address both saying the house was available. Is the latter from a scammer? The inquirer has no idea. Some owners have even reported their phone numbers are changed on their listings, allowing the scammer to intercept calls from concerned renters. It all means booking a property using these sites can be a giant leap of faith.

In response, HomeAway/Owners Direct says it is just one of a number of online businesses engaged in a difficult battle with fraudsters, and that it takes its online security “extremely seriously”. “While Owners Direct is protected through effective security systems, we have no control over the systems providers of email accounts. This is where the property owner’s email accounts may be compromised. Unless an owner, or an advertiser, contacts us to let us know there is a problem, we have no way to identify that a phishing incident has occurred.” It says it has provided lots of information and advice to travellers in order to educate them about the risks. It offers free insurance up to £700 in the event of a scam plus the option of purchasing full cover. It is also developing an Owners Direct platform and will include online payments “to further increase safety”.

• Anyone caught by this fraud who wants to contact the group set up to help victims should email: Vacationrental scamvictims@yahoo.com

Culled from Guardian