Oh no, not another VRBO phishing scam!

Just when I thought it was safe to rent another VRBO vacation home, I received a complaint from Brit Railston about a rental in Utah that went terribly wrong.

Now, to be clear, it is safe to rent from VRBO as long as you use a credit card. But please, folks, no wiring money. Ever.

I’m already in touch with VRBO about this case, which I’ll get to in a minute. Meanwhile, the question for you is: Given VRBO’s response, how hard should I push it to refund Railston’s $9,900. (Yeah, that’s a lot of money.)

The home in Park City, Utah, was meant for an extended family gathering in October.

“After some back and forth negotiation, we agreed on a price and were sent wiring and check-in instructions,” he says.

(Again, at the risk of repeating myself: no wiring money!)

He continues,

Strangely enough, we never received the promised “welcome package” once the funds were sent.

After a few weeks I called the seller; he claimed to have never heard from us, and had no idea what I was talking about. After several follow up calls, I believe him.

VBRO denied all responsibility in the scam, and said the owners email must have been hacked. Yet the owner said he got legitimate property requests both the week before and after the alleged hack of his email.

At this point, it sounds like we’re out of luck.

VBRO isn’t being any help. It seems to me if VBRO knows its possible for negotiation to be phished from their site, yet they still support it via their site, they have some culpability.

Let’s go straight to the VRBO response. I think it’s illuminating.

You recently sent an inquiry for the property referenced above. First, thank you for using our site. Unfortunately, we have reason to believe that the owner or property manager may have unknowingly and inadvertently had their email account compromised.

What this means for you specifically is that there’s a chance someone other than the actual owner or manager for the property may have viewed your inquiry and contacted you. This issue is commonly referred to as internet phishing. When we learned of this potential issue, as a precaution to you our traveler and also to protect our vacation property owner we temporarily deactivated this listing. We are currently in the process of working closely with the owner or property manager to assist with revising their account with us and reinstating this listing.

How this impacts you:

*If you sent money to book this property, you should contact the owner or property manager by calling the phone number included at the top of this message. We recommend that you do not communicate with the owner via email until the listing has been reinstated.

*If you have not yet sent money but are still interested in booking this property, please wait to receive an additional notification from us that the listing has been reinstated with a revised account. At that time, you will be able to use our inquiry form to again contact the vacation rental owner or property manager. Also, be sure to follow the directions for paying safely found on your inquiry confirmation email and at our security center:

http://www.homeaway.com/info/security?Travelers

Please be advised that at this time, the rental property described in the listing is not eligible for participation in the Carefree Rental Guarantee program. If you have already purchased the Guarantee prior to this notice, please let us know.

HomeAway is working hard on HomeAway Secure Communication, a new system that will add heightened protection to correspondence between vacation rental owners, property managers, and travelers. Learn more here:

http://community.homeaway.com/blogs/homeaway-insights/2012/04/25/phighting-phishing

Please feel free to contact us should you have any questions.

VRBO representatives also told Railston by phone they couldn’t help him.

I contacted VRBO on his behalf and VRBO has agreed to review this case. I’m not entirely sure how productive any further involvement in a resolution would be.

VRBO doesn’t seem to like operating under the glare of the media spotlight, now more than ever. I imagine the Railston case is particularly embarrassing because it assured everyone the phishing problem was being addressed this spring. I haven’t had a phishing complaint in months.

Another fact worth noting: Railston tracked the IP address of the phisher to London, which is the location of the other phishing attacks. Wouldn’t it make sense for VRBO to contact law enforcement authorities in the U.K. to stop these criminals once and for all?

Clearly, they’ve figured out a way around VRBO’s current safeguards. Perhaps a police officer can be more persuasive?

The simplest solution, of course, is to ban all payment by wire on VRBO and its affiliated sites. Then travelers would be protected by their credit cards. End of story.

In the meantime: No. Wiring. Money.

Christopher Elliott

Christopher Elliott is an author, journalist and consumer advocate. You can read more about him on his personal website or contact him at . Got a question or comment? You can post it on the new forum.

More Posts - Website - Twitter - Google Plus

  • Dutchess

    The problem here with mediating this case is you’ve been down this road with VRBO in the past, their guarantee is pretty worthless and they obviously have a serious phishing issue yet they don’t seem to be willing to do anything about it. They’ve flat out refused to honor or make amends for these scams yet a solution to this would be very easy. Create an internal messaging system that would provide a secure means of communication between the property owner and potential renters. Instead, they rely on email addresses and stand by their flimsy guarantee.

    I don’t see mediating this as being beneficial unless you want to drum up some negative press about VRBO and get them to do the right thing that way, they don’t seem to be willing to make things right on their own.

    This is where airbnb has VRBO beat hands down. Airbnb has a secure messaging system, money is all handled by Airbnb and they hold the money until you get to the property and can return it if there’s an issue. Also, they protect the property owner by having the option to collect a security deposit. This also works in favor of the renter because they act as mediator in case there’s a problem. No money changes hands until both sides are happy, this beats VRBOs obviously problem prone system.

  • jim6555

    In my humble opinion, the fact that VRBO does not take all reasonable measures to protect its clients makes them liable for payment of damages to those who get ripped off using their site. It’s the same principal as a hotel being aware that their guests’ rooms were being constantly broken into by thieves but refusing to provide improved locks on doors.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    I’m not happy about the way VRBO has conducted itself. It does seem like there are many simple options it could implement. But at the end of the day wiring money to an unknown person, especially to pay for a domestic rental is so unwise that it trumps VRBOs negligence.

    There simply is never a good reason to wire money to a stranger. It’s the electronic version of dropping cash off in a paper bag.

  • http://www.facebook.com/profile.php?id=100001823466572 Jen Armstrong
  • StarKiller

    OK, the more I’m reading about this the more I’m thinking it isn’t owners’ emails being hacked, it is VRBO’s database, possibly with help from an inside source. You can make an email look like it is coming from anywhere and put in a reply address that goes elsewhere. Without parsing the headers of the original emails there is no way to know. At the very least they need to put on every page of their site to not wire money.
    After hearing about all the scams, not just here but of all kinds, is there any legitimate use for wiring money that can’t be done more securely some other way? That and prepaid debit. Never buy a prepaid debit card to pay something because they won’t take a credit card. Never take a check, deposit it and return hundreds or thousands of dollars by wire.

  • JenniferFinger

    Wiring money to strangers isn’t a good idea (I found that out the hard way once), but that said, VRBO gets away with rotten treatment of its customers because no one takes them on-do they?-and local law enforcement doesn’t seem to care.

  • john4868

    I guess I look at this differently than most here. VRBO isn’t treating its customers poorly because it’s customer is the property not the consumer. It’s a listing service. If this was 20 years ago, would you blame the newspaper for being burned by an ad?
    Chris, do you know if the OP paid for the insurance policy meant to protect this exact thing? (See screen shot). It would only have been $149 for the rental.
    Finally, I think this is out of Chris’s hands. The OP needs to call the local FBI office for this case of wire fraud. Unlike CC scams, the receiving bank account had to have a Federal Tax ID tied to it (unless it was wired overseas). Wires have a paper trail associated with them. They should be able to trace the person down. If it was a a scam, he’s probably not the only one.

  • technomage1

    I’m not really sure this is VRBO’s fault. A quick view at the Traveler Help section of the page shows that under “How to Pay Safely” there is the text “Never pay by cash or instant money transfer services such as Western Union or Money Gram.
    These payment methods are preferred by criminals, and using them will
    void any guarantees from HomeAway, including the Carefree Rental
    Guarantee.” (emphasis original).

    How can VRBO reasonably guarantee that a negotiation not be phished from their site? They don’t control the owner’s email accounts, virus protection, or password practices.

    The OP’s best option is to contact law enforcement to try and recover his money – I don’t think he has a great shot, but still he could try.

  • Raven_Altosk

    VBRO is a joke. Any legit system would have an internal communication for buyers and sellers that could be monitored. They would also forbid listings asking for wired money and remove ones that did.

    But, y’know.
    What do they care? It’s not THEIR money.

  • Raven_Altosk

    Five bucks says VBRO would disclaim the insurance because it wasn’t a legit rental. Therefore, the insurance is useless.

  • Alan Gore

    There is one huge difference between VRBO and the MLS listings: a listing service doesn’t handle money, but just puts sellers in touch with buyers. VRBO, in offering the Carefree Rental Guarantee, makes itself a party to the transaction and therefore responsible for phishing on its own site.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    That brings up a good point. The IP address was oversees, but banks make a distinction between domestic and international wire. However, there are other ways of wiring money besides using a bank.

    I also notice the amount is right under the Federal 10k cash reporting limits. That should be another red flag to anybody. Any transaction just under a legal or contractual reporting limit should be scrutinized because if the other party is trying to avoid a reporting obligation you can bet that’s there is something fraudulent going on.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    There are perfectly legitimate reasons for wiring money. The key is that you have to have confidence that you know who the recipient is. I receive international wires from clients in many countries. International checks can take six weeks to clear and non-swipe credit transactions cost more and have greater restrictions.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    I’m not sure the guarantee is worthless. It states pretty clearly that it doesn’t apply if you wire money. That’s seems like a pretty reasonable limitation given that you should never ever wire money to a stranger. That’s Finance 101.

    If you choose to engage in foolish behavior whether through ignorance or intent, you can’t expect people to insure you.

  • Jeanne_in_NE

    When I read story after story about the same problem, I always ask myself, “Just who *are* these people that know enough to ask {insert consumer advocate name here} after the fact, but don’t know enough to get roped into {insert scam here}?”

    I’m very sorry for Mr. Railston – that’s a LOT of money to lose. But who the heck wires money after story after story shows up in print, online and on tv about various kinds of scams using wire transfers?

    I don’t think mediation will accomplish anything. This is a matter for law enforcement. Not that it will accomplish a lot, since many of these scammers operate out of Internet cafes under aliases.

    However, a quick look at the VRBO site doesn’t show the same sorts of disclaimers that appear on CraigsList. Traveler advice is down deeper than it should be if VRBO really wants to protect travelers. I think VRBO’s reputation has suffered another hit and after all these stories, deservedly so.

  • Joe_D_Messina

    Very well said. I find it hard to have sympathy because this was such an incredibly dumb move. I’m sure I’d feel a bit differently if it had been a few hundred bucks, but the darn fool wired nearly $10 grand?! I have the feeling a fly-by-night roofer or some other scam artist would have gotten that money if not for this phishing scam.

  • pauletteb

    No. Doing. Business. With. VRBO. My family is planning our semiannual reunion for next year. Any property listed with VRBO is now off the table.

  • john4868

    I would agree IF you didn’t have to pay for the guarantee (see the screen shot). Since you do, it’s really only a party if you pay for the insurance (which they aren’t calling insurance so they don’t have to deal with state insurance commisions which takes us back to Chris’s trip protection contracts scams).

  • Nikki

    OK, I understand circumstances where people don’t use computers on an ongoing basis… but I have to assume that anyone knowing what the heck VRBO is in the first place is capable of basic Internet safety rules.

    That said – how in the hell are people still being scammed into wiring money to anyone in this day and age? I mean, I see it even on places like Western Union and Moneygram… they question you as to whether or not you’re responding to a possible phishing scam, and how to identify it.

    I just… oh never mind. Whoever said sense was common, lied. At any rate, I wish the OP luck in getting his money back… 9K isn’t exactly a drop in the bucket.

    Oh, and VRBO? Please close the hell down if you’re not going to help your customers. Friggin’ safety information is hidden better than a Contact Us email address for a corporation.

  • john4868

    I’m more inclined to agree even though its a covered reason (phishing is clearly covered) because this isn’t really insurance. Never met a guarantee I had to pay for….

  • mbods

    Even though Railston was naive in wiring money, I voted “yes” only because VRBO “assured everyone the phishing problem was being addressed
    this spring”. Your idea to ban wiring on this site is a great idea, can’t figure out why they don’t do this.

  • http://www.eyeonannapolis.net/ John Frenaye

    The OP was foolish and lost. I am not seeing how it is VRBO’s fault. I can click on the EMAIL OWNER button and communicate directly with the owner. At that point, I have all I need to phish. It does not need to be immediate, it could be down the road.

  • twres

    I’m afraid he was just plain scammed. It is a lot of money to lose and I know he wants it back, but I think he is going to have to chalk this one up to an expensive lesson learned. VRBO should not have to pay him back, since they were not the ones to scam him and even cautioned against wiring money. He can report this to law enforcement but good luck ever seeing results. The scammers know how to hide and protect themselves. The FBI is not interested in wire fraud until it hits the million dollar mark for a transaction.

  • Dutchess

    VRBO has declined to cover these kinds of scams in the past.

  • S E Tammela

    Unfortunately, there’s little point tracking an IP. It can easily be faked, and they are ESPECIALLY faked in cases involving criminal activity – the scammer will want to cover their tracks. It is as accurate as writing a stranger’s home as your return address on an envelope.

    Regardless, laws change from country to country and there’s not necessarily anything the local police can or should do. It’s frustrating to see people continuing to champion IP-witch-hunts. It is ignorant to think they identify anyone.

  • Stupid_Tax

    Stupid Tax, plain and simple. Who the hell wires money in 2012?

    And as far as the police in the UK, I’m sure they’ll get right on this. They probably have nothing better to do.

  • Joe_D_Messina

    Lots if not most properties on VRBO are available to rent through other channels, as well. Not that it really matters, since the OP’s problem had nothing to do with the property per se.

  • jennj99738

    The VRBO site is very clear about advising users not to wire money. It is also very difficult to feel sympathy for someone who wires money in this day and age.

    However, I would recommend that Railston file a police report and report the theft (don’t call it fraud or scam) to his homeowner’s carrier. It is far from a sure thing, as most policies don’t cover fraud, but it certainly worth a shot.

  • DavidYoung2

    Nobody, including VBRO, can fix stupid. So, you get an e-mail that asks you for $9,900 (hmmmm…. just under the $10,000 limit for the filing of a ‘suspicious activity report.’ I wonder why?) And then you send it. You’ve don’t know this person, you’ve never met this person. And you send them $9,900 in cash.

  • EdB

    Filing with his homeowner insurance may not be a very good idea. Even if it would be covered, there is a lot of reports/stories about insurance companies dropping homeowners after they make a claim. Once dropped, it can be a lot harder/expensive to get a new policy. So think carefully before filing.

  • dourdan

    maybe they should add “in the even you use a money transfer you forfeit all protection and compensation.”

    I might inspire smart people to reassess the situation:
    scammer: this is the ONLY way you can pay me
    renter: well i guess i have to get a different property, because i just don’t feel comfortable wiring money.

    and if someone is not very smart they will just have to live with their mistake:
    scammer: of you wire me money i will give you a 50% discount.
    renter- sure!
    (this person will be otu of luck when they loose their money.)

  • jennj99738

    I would file a complaint with the claimant’s state’s insurance division if this occurred. Many states have strict laws regarding when a policyholder can be cancelled or non-renewed. Insurance is there for people to file legitimate claims.

  • streamerstoo

    If you check out http://www.ripoffreport.com you will see 30 reports on this company, VRBO, so if you want to know who you are dealing with before you buy on line, check out this site! Buyer be aware before you buy!

  • http://www.facebook.com/donna.williams.1044186 Donna Williams

    We dealt with VRBO very successfully a couple of months ago. They had a rental property that just met our needs, but at first, we were very leery of them because of all the problems we had read about. But we went ahead and corresponded (and talked by phone more than once) with the owner who seemed legitimate. But to be sure, we insisted on paying by credit card through VRBO itself (that is an option they offer), and we bought the VRBO insurance or whatever you choose to call it. It was an extra $89, but when you are talking in the thousands, better safe than sorry. We still worried a little until we actually got there and were in the house, but it all worked out perfectly. So all the people who are just writing off VRBO because of this are wrong to me. You can never be 100% sure, but when you are talking thousands of dollars, you can take steps to safeguard yourself, and it seems to me that the OP didn’t do that.
    That’s a lot of money to lose, but I am not sure that it is VBRO’s fault. I feel sorry for the OP, but I think he could have (and should have) done a lot more to safeguard himself in this situation. So I vote no; I doubt that there is anything Chris can do.

  • Michael Selby

    I don’t understand why someone would send money for anything found via the internet. I pay cash for almost everything, except travel and internet purchases.

  • lorcha

    And what if the seller’s VRBO account gets compromised? What makes VRBO more secure than, say, gmail, which can use legitimate 2-factor identification?

  • Dutchess

    This has been what I’ve said about VRBO all along. They could set up an internal messaging system that allows people to communicate securely. The secure messaging system should have secondary account authentication that notices when they log in from a different IP address or from a different computer.

    There’s one big reason they DON’T want to do this, if they provide secure communication it puts them further in the middle of the transaction and could be considered a party if/when fraud like this occurs.

  • streamerstoo

    Look at ripoffreport for more info on VRBO

  • TonyA_says

    It’s called STRUCTURING, right?

  • TonyA_says

    Why doesn’t VRBO simply institute a ban on wire payments? If they do that, then they can post PAYMENT BY WIRE TRANSFERS NOT ALLOWED for all parties on the front of all pages (instead of having to go to another linked page).

  • Michelle Norton

    I voted no because I don’t think mediation would accomplish anything. Basically, he got scammed – and if he knew enough to send an email to Chris for help, then he should have known enough to NOT. WIRE. MONEY.

  • Trudi

    I understand VRBO is really just a ‘meeting place’ for renters and rentors, but the company should to take some responsibility. At the very least they should contact law enforcement. Their standard ‘we’re just a resource service’ answer is getting old. They know they are allowing scams and they don’t do squat about it. Their rental guarantee is all about keeping the owner’s property protected and they don’t do much, if anything, for the renter.
    I lost more than $800 to a scam with them. Still, I have rented from the company twice since, but ONLY with a credit card. I am leery of renting from owners anymore, too. I have found that property managers (who are often real estate agents) are more professional and tend to be more likely to have a sensible legal contract, and they generally accept credit cards. I think VRBO and HomeAway should insist all their owners and property managers to accept charge cards as a safety measure for both parties. The people who rent from VRBO and HomeAway are just as important as those who list their homes. One wouldn’t work without the other, but it’s getting harder and harder to trust a company who NEVER backs up their offers with a guarantee.

  • Edward Boston

    They could easily require credit cards be accepted as a condition for posting a listing. with the smartphone credit card terminals from places like square and intuit, there is no reason for a domestic place not to.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    That brings up a good point. What percentage of people who book through VRBO have phishing issues? Is it substantial or just a very occassional dupe?

  • Cybrsk8r

    This is why I would never, ever rent thru VRBO or any of it’s clones. The risk is just too high. Even if you are talking to the real owner, if the property turns out to be dump, VRBO will leave you twisting in the wind. We’ve seen quite a few of those cases, too.

  • http://www.lipglossandabackpack.com/ LipglossandaBackpack

    I did a bank transfer once to secure a hotel room in rural Mexico. I had to have a TON of information, including the full name of the person I was sending it to (I was happy to see it was a German name, as the hotel website was in Spanish, English and German), their bank information (which corresponded with the only bank in the small town near the village in which the hotel was located), their phone number (Mexican country code!) and their (Mexican!) address. If any of it didn’t match what the receiving bank had on file the transfer would have been cancelled at my expense. In fact, my local bank turned me away at first for not having enough information about the recipient. I acknowledge that I could have been scammed, but I feel like there’s a much lower possibility when the money is transferred bank-to-bank. I understand why this may be a need, especially in the developing world. But Western Union? Hell no.

  • commentfromme

    This is posted on VRBO big and clear EVERY TIME a potential renter sends an email to a VRBO property. Test it. Send a test inquiry to a rental. I think this is loud and clear. VRBO is not responsible for total stupidity. “Prior to paying a reservation deposit, always verify payment instructions with the owner or manager by calling the phone number published on the listing. Learn more in our Security Center.”

  • Extramail

    Maybe vrbo ought to have a system where all transactions go through vrbo similar to the way stubhub operates. There is no direct contact between buyer and seller. Granted, stubhub makes a heck of a lot of money via commission but it is also a guaranteed transaction for all parties involved.

  • commentfromme

    After I sent a test I also got an email from vrbo. How much clearer can they be? Pay through ReservationManager(TM) from VRBOAccepts credit cards and eCheck.This is the most secure way to pay, and your payment is guaranteed against internet fraud up to $10,000.Pay by credit card, check, PayPal or bank transferBefore sending money with one of these methods, call the telephone number published on the property listing to confirm your reservation and payment details.If the listing does not have a phone number, please contact us for assistance.Credit cards offer charge-back protection should there be any issues with your reservation.Your payment is guaranteed up to $1,000 if you follow the recommendations listed above.and…Never pay by cash or instant money transfer services such as Western Union or MoneyGram. These payment methods are preferred by criminals and using them will void any guarantees from VRBO including the Carefree Rental Guarantee.

  • http://www.facebook.com/CarverFarrow Carver Clark Farrow

    Maybe. As I understand it, and I’m not a banking expert, is that structuring is when you “structure” a transaction to avoid reporting requirements. The distinction is too subtle to explain in a blog posting, but the common example is you want to deposit 12k in cash. That would trigger the reporting requirements. So you deposit 6k today and 6k tomorrow. You’ve structured a transaction solely to avoid reporting. In this case the 9.9k doesn’t trigger the reporting requirement so without more it may not be considered structuring.