Oh no, not another VRBO phishing scam!

Just when I thought it was safe to rent another VRBO vacation home, I received a complaint from Brit Railston about a rental in Utah that went terribly wrong.

Now, to be clear, it is safe to rent from VRBO as long as you use a credit card. But please, folks, no wiring money. Ever.

I’m already in touch with VRBO about this case, which I’ll get to in a minute. Meanwhile, the question for you is: Given VRBO’s response, how hard should I push it to refund Railston’s $9,900. (Yeah, that’s a lot of money.)

The home in Park City, Utah, was meant for an extended family gathering in October.

“After some back and forth negotiation, we agreed on a price and were sent wiring and check-in instructions,” he says.

(Again, at the risk of repeating myself: no wiring money!)

He continues,

Strangely enough, we never received the promised “welcome package” once the funds were sent.

After a few weeks I called the seller; he claimed to have never heard from us, and had no idea what I was talking about. After several follow up calls, I believe him.

VBRO denied all responsibility in the scam, and said the owners email must have been hacked. Yet the owner said he got legitimate property requests both the week before and after the alleged hack of his email.

At this point, it sounds like we’re out of luck.

VBRO isn’t being any help. It seems to me if VBRO knows its possible for negotiation to be phished from their site, yet they still support it via their site, they have some culpability.

Let’s go straight to the VRBO response. I think it’s illuminating.

You recently sent an inquiry for the property referenced above. First, thank you for using our site. Unfortunately, we have reason to believe that the owner or property manager may have unknowingly and inadvertently had their email account compromised.

What this means for you specifically is that there’s a chance someone other than the actual owner or manager for the property may have viewed your inquiry and contacted you. This issue is commonly referred to as internet phishing. When we learned of this potential issue, as a precaution to you our traveler and also to protect our vacation property owner we temporarily deactivated this listing. We are currently in the process of working closely with the owner or property manager to assist with revising their account with us and reinstating this listing.

How this impacts you:

*If you sent money to book this property, you should contact the owner or property manager by calling the phone number included at the top of this message. We recommend that you do not communicate with the owner via email until the listing has been reinstated.

*If you have not yet sent money but are still interested in booking this property, please wait to receive an additional notification from us that the listing has been reinstated with a revised account. At that time, you will be able to use our inquiry form to again contact the vacation rental owner or property manager. Also, be sure to follow the directions for paying safely found on your inquiry confirmation email and at our security center:


Please be advised that at this time, the rental property described in the listing is not eligible for participation in the Carefree Rental Guarantee program. If you have already purchased the Guarantee prior to this notice, please let us know.

HomeAway is working hard on HomeAway Secure Communication, a new system that will add heightened protection to correspondence between vacation rental owners, property managers, and travelers. Learn more here:


Please feel free to contact us should you have any questions.

VRBO representatives also told Railston by phone they couldn’t help him.

I contacted VRBO on his behalf and VRBO has agreed to review this case. I’m not entirely sure how productive any further involvement in a resolution would be.

VRBO doesn’t seem to like operating under the glare of the media spotlight, now more than ever. I imagine the Railston case is particularly embarrassing because it assured everyone the phishing problem was being addressed this spring. I haven’t had a phishing complaint in months.

Another fact worth noting: Railston tracked the IP address of the phisher to London, which is the location of the other phishing attacks. Wouldn’t it make sense for VRBO to contact law enforcement authorities in the U.K. to stop these criminals once and for all?

Clearly, they’ve figured out a way around VRBO’s current safeguards. Perhaps a police officer can be more persuasive?

The simplest solution, of course, is to ban all payment by wire on VRBO and its affiliated sites. Then travelers would be protected by their credit cards. End of story.

In the meantime: No. Wiring. Money.

Christopher Elliott

Christopher Elliott is an author, journalist and consumer advocate. You can read more about him on his personal website or contact him at . Got a question or comment? You can post it on the new forum.

More Posts - Website - Twitter - Google Plus

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    Why were you happy it was a German name?

  • Nontendo

    I’ve rented several times through VRBO and have had good luck. Owners in Italy have always wanted a deposit via a wire transfer, and then the balance in cash on arrival (though the deposit has never been more than a few hundred euros). I guess it depends where the owner resides; I’d be more leery of wiring money to someone in the US because it’s a more unusual way to conduct business there.

  • disqus_wK5MCy17IP

    If I understand correctly, VRBO has a form on their website which potential renters use to contact property owners. VRBO is saying the property owner’s email was compromised, but how do they know it wasn’t their site the was compromised and the email switched? They should keep records of when the email address was changed on the account and a record of IP addresses used to log into the account. Has the OP considered contacting the police and asking them to request the login IP information? Because if the VRBO site was phished, I think they should be responsible.

  • http://www.lipglossandabackpack.com/ LipglossandaBackpack

    Well, it’s pretty random to find a hotel in almost-middle-of-nowhere Mexico with a webpage only in English, Spanish AND GERMAN. It was good to see a connection between the website’s language and the name I was transferring money to… I took it as one indicator that I was PROBABLY transferring the money to the actual owner and not someone who had hacked their email.

  • happy canine

    How do you report phishing to VRBO. I recently contacted the “owner” relative to 433419 who wanted $$ wired to Europe. Turns out they lifted the property info and photos from the MLS listing for the property.

  • https://plus.google.com/115197896619361127605/posts Aaron W

    This is, in fact, what Amazon does when you buy something from a third-party seller. The filter even removes email addresses so phishers can’t make an end-run around it.

    VRBO wants it both ways — it pretends to guarantee the authenticity of its listings and transactions, but refuses to take the reasonable and relatively simple steps that could actually prevent cases like this.

    All that said: WHO WIRES MONEY TO A STRANGER!? C’mon.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    That would be an unlikely outcome though I can see an aggressive attorney trying.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    That makes sense.

  • http://www.facebook.com/Gascony Jane Bennett

    I represent the other side of the coin: I am an owner of a holiday home in France, which I rent via VRBO and two other sites. I live in the UK so guests who also live in the UK pay by cheque and others by bank transfer. They have the option to use Paypal but rarely do. We do not have a credit card facility and don’t intend to get one.

    My responses to an enquiry (and subsequent email exchanges to answer specific questions) are so atypical of someone who’s up to no good. In addition, VRBO do suggest enquirers call the owner as a safeguard, and even if not in doubt I would think this is good advice. Our ad has a link to our website with full contact details, my name is there for all to see, and when it’s googled it pops up enough times to convince people I’m real, it’s to be hoped. So there are measures in place to check on owners. I have the rates set at just about the right level and frankly, we’ve enough outgoings already without adding the cost of accepting credit cards to them; I’d far rather plough what is left at the end of the tax year back into improving our guests’ vacation experience.

  • http://www.vadimoss.com/ vadimoss

    Well, there are certainly some precautions that VRBO could have implemented to avoid this type of scam. For instance flipkey and rentini.com have already introduced a no direct reply messaging system. When homeowners and guests are replying to emails all communication is stored on the server where suspicious requests for wiring money could be easily filtered out and flagged. Also in case of rentini the company handles all monetary transactions for a small fee, which guarantees that money won’t end up at some scammer’s account in the UK. There is a good reason for credit card payments to become a norm in vacation rental business. All transactions are trackable, recoverable and scammers will get to jail at the end.

  • VRBOOasisowner

    I have had the reverse happen on a rental.  I sent the contract – they changed some of the verbiage and wanted me to sign the agreement stating that they had sent the deposit of $2,700 when the check they sent was for only $500.  The bad part – this renter was a real estate attorney!  So I  guess it works both ways.  Just be careful when renting your property and look for those red flags – make calls and ask questions.

  • Madd

    Am currently going through this exact mess. Why no warning on VRBOs main page of what to look out for?

  • Thom Dunaway

    We hear about this quite often. Crooks can falsely set up a property on VRBO, steal some photos and offer an unbelievable rate. The more sophisticated ones will even speak with you over the phone and tell you about their rental, which is not really their rental. We had one client call us today for a Caribbean villa that even said they were told they could use a credit card. It is much safer to work with someone who has a proven track record, has been in business for a long time, and has relationships with many owners in the area. Relationships with many properties can also be key, because while uncommon, properties can have issues and if you need to be moved to another property an individual owner will not have an option for you. Renter Beware!

  • http://www.facebook.com/cindy.bugden.7 Cindy Bugden

    I am an owner of a couple of properties listed on vrbo. I was contacted by someone who was in the process of sending money to book a property. Fortunately, the renter got suspicious when the site he was corresponding with got the property address wrong. He knew someone who had another email contact for me and sent another email.

    I immediately contacted vrbo and was given a response similar to that above. The email that I use for this property was used very rarely outside the vrbo site so I found it difficult to believe that access was not due to this website. I changed the email associated with my site and hope this does not happen again.


  • eDepositinv

    There are ways to protect yourself that are inexpensive but still secure where the money doesn’t transfer to the owner until the renter agrees (i.e. verifies the owner, property, lease agreement, etc.) but allows the owner visibility that the funds are good from the renter. Used by high end auctions to verify bidders, eDeposit verifies the owners and renters through gov’t and bank regulation and verifies the funds are available for the transaction BEFORE moving any funds between owner and renter. Owners pay a very small fee when the transaction settles, much less than VRBO or PayPal charges. Disclosure: I invested in eDeposit

  • http://www.facebook.com/pascal.robin.1042 Pascal Robin

    It specifically says NOT to wire money on VRBO’s site. All people have to do is read and take precautions. No one in their right mind would wire that much money!

  • Candy Gustafson

    Can you answer this question Elliott, do think home owners on VRBO use the site to lure renters in and than have them send a personal check and all contact is done through email so they don’t have to pay VRBO for the booking? I am struggling to have my deposit returned, I have not contacted VRBO because I am waiting to see what the home owner is going to decide. I have spent time since researching and I have to say I am very shocked at what I am learning about the VRBO company and how they treat renters per not allowing negative comments etc… now I am thinking if they are losing money,,maybe they will listen?

  • bodega3

    Why did you sent a check? That is rule #1 of how NOT to book any travel.

  • Candy Gustafson

    I felt like he wouldn’t book the house if I didn’t..stupid I guess..