How people who go online to rent vacation properties can avoid being scammed by computer hackers

Dear Globetrotter:

Welcome to the 455th issue of your monthly foreign-travel magazine, the one that invites its subscribers (including you) to share travel recommendations, tips and warnings from their experiences overseas. We’ll supplement those with additional researched material, columnists’ articles, relevant travel news and just plain fun.

Let’s start with the latest word on an online problem affecting travelers.

Those of you who rent vacation properties, be aware that unscrupulous computer hackers have been hoodwinking some renters using websites such as www.homeaway.com and its sister website, www.vrbo.com. There have been multiple reports in the news, on travel forums and on the ITN Message Board.

The scam works like this. When an inquiry is submitted by a renter via the inquiry form on the website, it can be intercepted and responded to by someone who has hacked into the system. The hacker has the full details of the inquiry and may reply posing as the property owner or someone working for a rental company (phony) representing the (legitimate) property. The real property owner, one of many thousands of people listing properties on the website, is not aware that the inquiry has been intercepted. 

Usually, in the scammer’s response, all of the information relating to the property matches up with the online listing except for the phone number and the email address. The renter, believing he is being contacted by an agency working on behalf of the property owner, often assumes that the different contact information is legitimate.

Scammers may offer special, low-price rates for booking immediately, and they usually ask for bank wire transfer payments. A contract is sent, and all seems to be in order until the money is actually transferred. The money is immediately removed from the bank account and the account is closed down. The email address and phone number also are closed or abandoned. 

The hapless renter is left without a place to stay and no way to get a refund, and the property owner — when the victim renter shows up at his property or perhaps calls the correct number to confirm, cancel or reschedule a rental — is horrified to find that his property has been “booked” without his knowledge and without any payment to him.

Regarding VRBO, one victim wrote to ITN, “The advice they provide on the website is not foolproof; I actually did almost everything they tell you to do except phone the property owner at the number in the original online listing. The real problem is that their online contact form is subject to phishing.

“There have been slight variations in the scam, but most have followed the exact same pattern as mine. My bank made me close my account and open a new one. Apparently, a scammer can reverse engineer a wire transfer and attempt to auto-debit funds from your account.”

ITN emailed HomeAway.com asking what steps they may be taking to curtail the hacker problem and for any advice for renters. Jaime Dito, Internal Communications Manager, HomeAway, responded on Nov. 25 as follows:

“Phishing is a major Internet problem affecting a number of online industries, and, unfortunately, vacation rentals are not immune. 

“In relation to our business, we know that what’s happening in each of these cases is not a breach of either of our sites but a breach of the homeowner’s or traveler’s email account, which is where much of the communication about a booking occurs. 

“Criminals have gotten extremely savvy with their tactics, often replicating from our sites full pages and/or email forms with the hope of defrauding travelers, so it’s extremely important for a traveler to call the phone number on the vacation rental listing to confirm they’re speaking with the right person. Since we know our systems are not what’s being hacked, this is one of the safest ways to ensure you’re speaking with the true home­owner or manager. 

“If there are further questions, you can call our customer support team, and they can also help investigate whether or not a homeowner is who he says he is.

“As phishing continues to pose a threat to the vacation rental industry, we’ve done a number of things at HomeAway to help protect people.

“We launched a Security Center and increased our education efforts regarding Internet safety in all email communications.

“We expanded the coverage of our Carefree Rental Guarantee to include phishing.

“We expanded our customer support coverage to 24/7, so customers now can receive assistance at any time, day or night.

“We introduced online booking so that more travelers can safely pay for their rentals with credit cards or PayPal versus wire transfers, checks or cash. On a property listing, this is noted with a green shield that says ‘Payments.’ Travelers can also sort (property listings) by ‘Accepts Online Payments’ to ensure they can always pay with a credit card.

“Within the last week, we introduced an email-exchange process that ensures more secure communication between owners and travelers. The process anonymizes both email addresses (instead, each party will see a generic HomeAway email address), and the messages are sent through HomeAway’s secure system versus through their own email accounts. 

“This process is similar to how users conduct business on popular sites like LinkedIn and Etsy. You can read more about this change here: http://community.homeaway.com/blogs/homeaway-insights.

“One last piece of advice I’d leave with your readers is this: trust your gut. If an owner offers a deal that’s too good to be true (for example, offering a deep discount in a peak season) or asks you to send cash or wire money in a hurry to secure a booking, trust the voice in your head that’s warning you something isn’t right.”

It should be noted that HomeAway’s Carefree Rental Guarantee, referenced above, is not free. The price starts at $39, based on a rental payment of $1,000, and increases by $10 for each additional $1,000 of rental price coverage up to $10,000 in coverage. 

HomeAway’s website has more information about online scams; on the homepage, click on “Community” to reach the forum, then do a search using the keyword “scam.”

Jane Childs of San Francisco, California, has an information request. She emailed, “I am asking for advice for a single, 93-year-old world traveler.

“My husband and I traveled the world with the help of ITN. Seeing a witch doctor in Africa, sailing down the Sepik River in Papua New Guinea, driving from Islamabad to Kashgar, watching Carnival all night in Rio… . It’s all been a dream come true! 

“Now, by myself, I still have the zest to travel. A year ago I departed Hong Kong on Holland America Line’s Nieuw Amsterdam and flew home from Athens. Seeing that part of the Middle East was fascinating; Dubai was a mirage in the desert.

“From ITN readers, I would like to get travel suggestions for a nonagen­arian. My age has slowed me down, yet I still have the desire to see our planet. It would be wonderful to hear of any great ideas besides cruise ships. Going to Paris and sitting at a sidewalk café to watch the passing parade is an option, but I’m sure there are other activities available.

“How do you find tour guides who know the travel secrets that make a trip special — the wedding in the village, watching food preparation or walking down the back lanes? I would love to hear what other nonagenarians have discovered. I would certainly be happy to send notes thanking all respondents.

“Some like a Rolls-Royce or diamonds, but traveling the streets of the world is the greatest!”

Let’s hear from you, subscribers. Write to Super-senior Travel Options, c/o ITN, 2116 28th St., Sacramento, CA 95818, or email editor@intltravelnews.com. Responses will be forwarded to Jane and printed in ITN.

In this column last month I described the differences between “chip-and-PIN” credit cards, being used in a majority of countries outside of the US, and “chip-and-signature” credit cards, which are being issued by many banks in the US and which cannot be used for completely automated transactions in many locations outside of the US.

We’d still like to know. If you applied for and received a true chip-and-PIN credit card from a US-based financial institution and have used it overseas successfully at an unmanned pay point — by entering your PIN — tell us which financial institution issued the card plus the name of the card and what some of the qualifying requirements were. 

Write to Chip-and-PIN Cards, c/o ITN as noted above.

We could use a few more photo submissions for our monthly “Where in the World?” quiz. Try for landmarks, natural or man-made, or standout structures or an unfamiliar angle on something we all would normally recognize. Get creative. We’re looking for a wider variety of sights.

Last month we introduced a new ITN Travel Award, the Hit the Road Award, based on the “Road to…” movies starring Bob Hope, Bing Crosby and Dorothy Lamour. What I neglected to do was credit the subscriber who came up with the idea for the award, and that was Lois Martinek of New Gretna, New Jersey.

Lois provided a list of the movies’ titles along with the years they were released, then wrote back to say, “This came to me in the middle of the night: if you should decide on offering this award, you might want to call it the ‘Hit the Road Award’.”

We thought it was a brilliant idea, and we hope Lois has many more restless nights. (Just kidding!)

Sharon Ordelheide of Oakdale, California, wrote, “Love International Travel News! The travel ‘war stories’ offer great info for future travel.”

Wanda Bahde of Summerfield, Florida, wrote, “Each issue includes treasures from past discoveries or ideas for the future. Keep up the great work!”

Ronald Thibeault of Fort Kent, Maine, sent in the addresses of a couple of travelers and wrote, “I have started receiving your magazine and find it full of helpful facts, etc. I read that you send out free samples and I have some friends who might like it too.”

Ronald’s friends were put on the list to each receive a complimentary copy of the next-printed issue. We’ll send free samples to overseas addresses, as well.

Remember, ITN has promised to never sell anyone’s name and address to another firm. They’re safe with us.    — DT