To those who are not aware of recent phishing scams that has been appearing in the last couple of months, here is the gist of the scam.  I’ve been racking my brains lately for ideas on what HomeAway might do to counter this type of scam, hence this “mussing....” thread for anyone to make their suggestions. If you have any of your own, say it here. Maybe they will listen.

These attacks are specifically targeting Owners (or Property Managers) with ads at VRBO/HomeAway in particular (but can really be any) using known free web base email accounts (i.e. Gmail, Yahoo! Mail, Hotmail and Windows Live email addresses). What is happening is the bad guy is sending Owners an inquiry generated from the VRBO/HomeAway Owner’s webpage listing to learn the Owner’s email address. Once the bad guys has the Owner’s email address, he sends a fake email inquiry (not generated at the Owner’s website) directly this time to the Owner that includes a VRBO/HomeAway in the subject line and looking like a normal or official inquiry. The email includes a link to “View Message”, and when clicked, the Owner is sent to a page telling him that his email session has ended and that he needs to log back in and presents him with a login page (a fake one) that looks almost identical to an official login of the Owner’s email provider to trick the Owner to login, thereby capturing (phishing) the username and password. They could then login to the Owner’s email account and create filters to redirect any VRBO/HomeAway Inquiries to the bad guy’s account so that it never shows up in the Owner’s inbox... at which point they start corresponding with the travelers that sent Inquiries, convincing them they are the Owner and giving travelers a discount and instructions on where to send the money (always via wiretransfer, their modus operandi) for their stay – all via email. The Real Owner is unaware this is happening, unless and until the Traveler has been duped in sending the money and calls the Owner.