VRBO/ Home Away, experiencing a security breach of some kind

It is pretty serious, and I am concerned it's an employee of VRBO doing it. They know what dates people are requesting for resorts and all emails are sent through a relay system. It has to be an inside or how could this person know specifics about renter inquiries and fake it?

Somehow, someone is seeing resort requests and emailing as though they are the rental company/ individual, then they say they have the unit requested available and are having the money sent to an address in the United Kingdom, overseas wire transfer.

Scary.

Homeaway

How did you learn about this?
Jim

Someone used our daughter's name to answer an inquiry from an actual person who she'd talk to via the site. The emails are secure because they have a relay system. How could this scammer know about the specific details of the inquiry, if it is not an inside job?

She had told inquirer at the time that she had no inventory for the date he wanted. Then weeks later, he sent her an email with all of the scammers emails to him, back and forth and asked why he couldn't use a credit card. He wised up and realized he was probably talking to a dishonest person. He originally thought it was her because the scammer signed her first name on all emails.

The scammer wanted money sent to the UK and said something about credit cards not being secure. Yeah, that's a huge red flag. Credit cards are secure for both renter and owner.

This has been reported recently in the media

http://www.buzzfeed.com/johanabhuiyan/homeaway-users-victims-of-phishing-scams#22ofz5h

Seems to have originated with and/or targeted users in the UK

Very funny that VRBO acts like this is all new to them, when our daughter talked to them today about it.

What a violation. The person should be traceable and should get caught. But it seems like they don't really do anything about scumbags like this person.

The email the scammer is using is evacationsrental@gmail.com I don't care how many people know his email. I hope he gets flooded with scammers trying to take his money.

Another article:
http://www.nbcconnecticut.com/inves...-Rentals-HomeAway-VRBO-Warning-258986851.html

I am trying to figure out how they do this. If it's a relay email system, how are they doing this? I see no answers. Phishing was one thing discussed in the above article.

Speaking as someone who is moderately familiar with the internet, if VRBO searchers are being phished, it seems likely that somethign is amiss. But from talking to a colleague tonight, we came up with at least two ways to game VRBO to get what happened here without access to the servers themselves.

Also, for general knowledge, when you suspect a scammer on gmail or yahoo or any major freemail provider, forward their email to abuse@whateverdomain... It might save some other poor fool a lot of money.

I am not understanding what happened here. What do we need to look for when booking with VRBO or HOME AWAY to prevent a scam? I have made a deposit for next spring with HOME AWAY.

mpumilia said:

I am not understanding what happened here. What do we need to look for when booking with VRBO or HOME AWAY to prevent a scam? I have made a deposit for next spring with HOME AWAY.

Click to expand...

Your transaction is probably quite safe and legit unless you wired money to someone whose identity you hadn't verified. The advice given is to be sure that you are actually communicating with the property owner directly (preferably by phone rather than email) at the time you are signing any agreement and don't use wire transfers for deposits or payment in advance.

sun&fun said:

Your transaction is probably quite safe and legit unless you wired money to someone whose identity you hadn't verified. The advice given is to be sure that you are actually communicating with the property owner directly (preferably by phone rather than email) at the time you are signing any agreement and don't use wire transfers for deposits or payment in advance.

Click to expand...

I always use credit card for Home Away. Didn't actually speak with the owner but via email, but still have to pay balance when we get closer (next year) and intend on calling her at that time. Thanks! I feel better. Had a great experience this past May when we booked through HOME AWAY and had no issues.

Homeaway and VRBO use a mail relay service. However, unfortunately the original sender's actual email address is still visible to the landlord/owner. I believe this is something they are working actively to address, but at this time it is still occurring.

There are so many ways that something can be hacked it's really frightening. A hacker may have gained access to a landlord's account through a number of means during an activity the landlord is doing completely unrelated to Homeaway or VRBO - through a P2P/file sharing site, for example. Once they have access to the account, they will be able to see all the email addresses to which the landlord has replied.

It may be worthwhile to check to see if any of your other contacts have also been compromised.

Sorry this has happened to you. Good luck getting it resolved!

Eric

This happened to a friend of mine a few months ago. She was renting a house on VRBO. The "owner" had her wire the money to him. That should have been a red flag, but she did it anyway. It was a wire to this country- Florida, I think, because they had surveillance video of him picking up the money at Western Union. I have to check back with her to see if he was caught. There was some way he was capturing her inquiry before it hit VRBO.

Recently REDWEEK changed their "reply" method ...

If you NOW hit reply to an inquiry from Redweek - it goes back to the NEVER, NEVER land of Redweek.com. You have to manually CHANGE the address to the "displayed address" of the inquirier contained within the email.

And this thread explains WHY.

This is some good information. We were planning on renting a home in the Lake Gaston area of NC., now I am doing a second take.

I got scammed in July on a VRBO rental. Somehow, someone, intercepted the e-mail inquiries that were suppose to go to the owner. The scammer replied as if they were the owner, said it was available and to wire the money.

I checked out the owner, property, phone number etc ahead of time and everything was legit. I never thought of her e-mail being compromised.

The only good news was I qualified for their $1000 guarantee.

It's as simple as having a keylogger Trojan Virus on your computer. If you do, it does not matter what you access or how often you change your passwords. Keyloggers record everything. All your requests, all your logins, all your passwords. Tax info/SSN if you are doing your taxes online etc. They get stored in a tiny file on your PC and sent to the scammer through the internet. every so often as text files. So I wonder if this really is a VRBO issue, or a trojan virus issue.

Could also be the good old fashion breach of any web mail type account out there. Once they break in, and get user info/passcodes they can log in any time and act as the user. Why stop there, once you have one email and password, they likely take thatinfo and run them up against other consumer sites using program that tries to log in to everywhere with it. Credit card sites, tax with SSN info especially.., other email sites. Register a hit in the program, and log in elsewhere to steal someone's identity.

I am SURE we all use different usernames and passwords for every site out there though. I know I do. My identity was actually stolen, and they have tried to file unemployment, open CC, log into my discover card and add their names and addresses. Oh yeah, it's scary out there and this stuff does not surprise me. Be careful out there.