Skip navigation

Join the Vacation Rentals Conversation!

Get answers to all of your questions from fellow owners and travelers.

Join the CommunityX

CommunitySeek, Ask, and Share in the Vacation Rentals Community
3333 Views 21 Replies Latest reply: May 23, 2013 5:10 AM by baliexpat RSS
thale HomeAway Employee 107 posts since
Oct 27, 2010
Currently Being Moderated

Apr 27, 2012 6:45 PM

Have you ever received an inquiry that you thought might be bogus?

Has anyone received an inquiry which appears bogus to you? What were the signs that made you think it was an attempt to get your email address for a phishing attack?

  • christineb Community Ambassador 40 posts since
    Mar 1, 2011

    I have never had a situation where I felt that people were trying to get my email address.

    I have been renting our place since 2010 and honestly I have never had an issue with email inquiries.

    But I do get people calling the phone number I have listed (which rings into voicemail because I live several time zones from my property) who are unbelievably vague about date details etc when they are making initial contact. These messages typically have background noise similar to telemarketing calls which set off my spidey senses immediately. I never call these people back but I will get this type of call as often as once a week.

    Part of my filtering process is that I just don't return calls to people who aren't specific about what dates they want etc. This is out of necessity because of the probability of "phone tag" is high as is the cost of a phone call (Skype is technically not allowed where I live).

    • anja Community Ambassador 1,270 posts since
      Aug 9, 2011

      I have had email inquiries that were too vague and left me feeling suspicious.  Were they just wanting me to answer...to get my email validated?  One email was:  "interested. send details with price."  They are always lower case...use "throw away" emails that are not traceable to any links online.

       

      In general, it is too common that inquiries, I'm referring to legitimate ones, are "incomplete"....meaning missing relevant information that would give me a sense of trust for the inquirer.....like a full name, a working phone #, a real email address from the inquirer.  This could be easily fixed if HA/VRBO would "mandate" that all fields in the inquiry form be completed --- or the form will not *send*.

       

      I'd like to know who is contacting me....before I send them all my details.  I'd like to "screen" before I reveal my property details to anyone.  It's not a pefect world...I've successfully "screened" out people I didn't think were a "fit" for my place...I didn't want them here for various reasons...but it's getting harder to do.

       

      The inquiry process is not a perfect system.  It needs improvement.  HA/VRBO can easily remedy this.

       

      On phone calls....    I had gotten one phone call from someone, whom I believed, was just trying to get my email address....which I did not give.  It was a person who claimed that he had been trying to "email me"...but  couldn't get through....claimed something wrong with the address he had.   Said that he was asking for information for his  "mother" ...who is not email savvy ...just helping her....so could I confirm my email address, over the phone.   I did not....I will not respond to such a request!   He asked WHY...rather boldly...no etiquette.   I hung up.  That's how it happened.  I only had this type of call one time.

       

      There is a market for valid email addresses -- which are resold to other scammers...and used for phishing schemes.   But, I have to tell you that VRBO, where I list, is giving out our email addresses enclosed with the "reply to inquirer".   Please...can you guys cease doing that, for us owners?

       

      We're trying to stay "safe" in an unsafe world while we handle strangers who want access to our homes.    If I respond from my Outlook, then I'm giving them my email in the reply . But, for inquiries via VRBO,  from where I get steady inquiries although not as many as in the past,  I'd like to use the  REPLY feature without offering them my email address...but I realized recently that you guys are 'exposing' it.

       

      The "bulk" inquiry feature is sending inquiries regardless of calendar marked "booked"....and often I'm responding "regrets"...and I'd like to keep my email "private" in such a response.  If I'm interested in the booking, I'd respond giving them my email...let me decide.

      I recently had a situation with a local-based resident on my island that was  trying to "book" my cottage {even though my calendar was "full"}...and I do not want him and his drunken girlfriend to know where I am.  I used the *REPLY* feature thinking that "the system" protected  my email address,  and then realized that my email was exposed by you guys in the response form.     Not good.    I became nervous that he will find my exact street address by searching for my email address... and then "appear" at my door.   He did exactly that to an owner that I know here...who told me was robbed by that couple when they stayed in his rental....{credit card fraud}.

       

      Thank you for asking feedback and comment from users here.  It's really important that we help you to shape a better, safer system to do business in. The best way to do that is to inform  you at HA what is happening on the owner's end.  Please help us to feel less vulnerable.

  • tyler-lola New Member 5 posts since
    Mar 23, 2012

    oh, yes, just a few days ago I got the one below from, presumably, the Ukraine.

     

    Depending on your addess to your mail, via a web browser, or email client, you can see some or all of the FULL header (this is the truncated version we usually see).

     

    I normally access my mail through Chrome (a browser) to get to Gmail.  It only displays a summary header.  So if I want to get serious I open it in Apple Mail (you can use pretty much any full fledged email client to do this) and then view the entire header.  Depending on the header, you can usually, find somewhere in there, the originating IP address of the sender.

     

    I use this link to find out where it came from (again there are many that will do this)

     

    http://aruljohn.com/track.pl

     

    In my case, it was in NE Canada.... not Kiev, Ukraine.

     

    I also Google search on key phrases when it looks like a form letter.  I also search on the phone number, email address and see what pops up.  Then I try to initiate a real conversation with the prospective client.  This perhaps tells the most... like DID THEY EVEN SEE the ad?

     

    ~ Rice

     


    ---------- Forwarded message ----------
    From: Annamaria Crisalli

    Date: Tue, May 1, 2012 at 6:13 AM
    Subject: RE: Inquiry for HomeAway Property 973655 - Aug 18, 2012 through
    Aug 25, 2012
    To: galleryhouse@terra360.com

     

    Hello

     

    Thanks for the updated information.
    We are okay with the accommodation and cost .
    we would also like to confirm the reservation on the following information:
    - Mrs Annamaria Crisalli

     

    flat 141, 116 Ubileniya, kiev, Ukraine, 85209 .

     

    Also , due to the unsecured use of credit card online or on the phone,
    I have arrange for payment inform of check

     


    Please do forward me the following details for payment

     


    FULL NAME
    BILLING ADDRESS
    CONTACT TELEPHONE NUMBER

     


    Hope to hear from you soon

     

    Regards

     

    Annamaria Crisalli

    ------------------------------

  • steviek New Member 1 posts since
    Jan 2, 2013

    If you have any experience with Craig's List - these are pretty simple to spot. Incorrect  grammar & spelling, all lower case, no contact phone number. "My Wife's Employer will be sending you a certified check ******** for more than you are charging so please forward us the overage right away".

     

    Common sense tells you to simply receive payment up front well in advance, make certain it CLEARS and never give out the property address or any of your personal information.

     

    I'm pleased to say that we have had very few of these on VRBO/HOME AWAY and most guests are legit.

  • harlemrental New Member 2 posts since
    Dec 30, 2012

    I have been getting some phishing emails over the past few days.  There are two flavors:

     

    1. I get an email to my homeaway email account that has a subject like "Re: rental" or "Re: Contract" and it has a document attached.  If you click on the doc, it brings you to the Google Docs login page.

     

    2. I get an email to my homeaway email account that looks like a valid Homeaway inquiry EXCEPT that it has a different property ID than mine.  I don't reply to inquiries by clicking the REPLY button on the email - I always go to the Homeaway site and do it from there.  When I went to my Homeaway Inquiry page, this inquiry doesn't exist.

     

    I urge owners to be careful when opening or responding to inquiries - looks like there is a lot of phishing going on!

  • kiawahcottage Community Ambassador 248 posts since
    Jan 1, 2011

    Hi,

     

    I have started to use my own 2 e-mail system.  The first e-mail address is for incoming inquiries only from HA /  VRBO.  I never respond from that address.   It is also one of my main general e-mail addresses, the important point is never to respond to an inquiry from it.

     

    The second e-mail is for responding and communicating with inquirers and renters.  If a phisher sends me an inquiry through the HA system he gets the wrong address to send the phishing attack.  If I get a HA inquiry to the second e-mail it's a fake!  If somehow the second e-mail should get phished, they can't intercept my inquiries before I see them. 

     

    Ironically the actual weak spot is when I (occasionally) respond through RM.  Then they get my HA inquiry-only e-mail address.

     

    Just got this phishing attack recently.  Not my property # and all the live links went who knows where.  Oh and 14 people in a 3 bedroom?  Maybe they are a very close knit family?  Other than that it does look very good.  But since HA does not send my inquiries to that address I don't have to give it a second thought.  Sorry Perry, Nevaeh gonna happen!

     

    Paul

     

    Phisher001.png

    • swlinphx Senior Contributor 1,158 posts since
      Aug 30, 2011

      What happens when your e-mail account gets hacked (as I have had done before).  If they get your password or access somehow to the e-mail address you initially receive inquiries from they can respond and forward all that mail so you never knew you got the inquiries.  Then they can correspond with the inquirer as if they were you and encourage fraudulent payment, which was the whole problem HomeAway was trying to avoid.

       

      I didn't realize my e-mails were being forwarded to a bogus account for about 5 days when I finally noticed I wasn't getting any mail from one of my accounts.  I have them all combined in list view so all my e-mail addresses appear in the same place.  Therefore, it is not always immediately apparent if one address has not received mail in a while.

    • baliexpat Contributor 109 posts since
      Feb 8, 2013
    • baliexpat Contributor 109 posts since
      Feb 8, 2013

      This is not only a great idea it should be made compulsory. The email address for logging in to your Homeaway account should be a different email address to the one that you have your inquiries sent to. As a further precaution the email address you use to reply to inquiries should be a different one than either of the 2 above.

      But how many people will really do this? Very few until THEIR property is falsely rented out by the scammers.

      And this property that was used to rent by the scammers will NOT be the property that was pfished. The scammers now, in order for these pfished properties NOT to be detected, are pfishing properties on one site Homeaway... and sending links to ads on Flipkey that are to be used to rent to victims... and vice versa. Originally the scammers pfished a property and and used that same property to rent to the victim. Homeaway was able to shut this down upon being notified by the victim. Then the scammers phished property A on Homeaway and used property B to rent out to the victims. Homeaway reacted by checking all the properties that the victim inquired with originally [if the victims kept their Inquiry Confirmations they could do this... many victims do not however] and eventually isolate the pfished property A that was being used to get the travelers contact info and travel requirements] NOW the scammers have reacted to their pfished ads being discovered by sending the victims a link to an ad on a completely different site.EG An ad is pfished on Homeaway on Property A. The victim is sent a link to property Z on Flipkey and the Flipkey property is used to rent to the victim. Flipkey immediately asks the victim for a list of all the properties they originally inquired with so they can isolate the pfished or phoney ad. But there are no inquiries... because the original inquiries were made at Homeaway. Being competitors they don't talk to each other and both will be trying to avoid liability. We started a small action group in Bali that has been hit hard. Through a media release we had victims email vacationrentalscamvictims@yahoo.com and send us documentation. We are just a small action group of property owners but we have been inundated with victim reports. Where the victims have kept Inquiry Confirmations we have been able to liase with the 2 websites and send the Original Inquiries to the site where they were made. This should not be our responsibility. Flipkey has been amazing in its support. Homeaway has not. Flipkey in order to minimise the personal loss to victims sent out this alert below to all Inquirers in Bali.  At the very least it will identify victims BEFORE they and their families are stranded in a foreign 3rd world country. Will it initally damage the rental business in Bali? Sure it will. Will it help to get travelers to be more security conscious in the long haul; get them to verify the number on the ad and call that and no other number which defeats the scam Sure it will. Will it stop the scammers. NO. Homeaway and the other sites now need to work together and I don't see that happening. Our major focus is to stop the receipt of funds. Presently they go to Barclays Bank which has hundreds of false accounts because their identification process is flawed. Perhaps only a class action suit will get them to lift their game and that is looming.

      See below pic alert to Bali by Flipkey click on pic to enlarge... Bali is a small part of this scam. Other badly affected areas are Florida, Paris and the UK. Your tourist spot will become badly affected if just one of the advertisers in your area gets pfished.

      Flipkey travel alert.jpg

      • swlinphx Senior Contributor 1,158 posts since
        Aug 30, 2011

        The email address for logging in to your Homeaway account should be a different email address to the one that you have your inquiries sent to. As a further precaution the email address you use to reply to inquiries should be a different one than either of the 2 above.

        Okay, so what if you do that but the e-mail address you receive inquiries from is hacked?  All they need do is forward that address to their own, delete the message from the server and then respond with their own address.  This does nothing to prevent someone from posing as you and continuing on the conversation with the inquirer without your knowledge because they set the e-mail account to delete the message from the server once received so that you will never receive it.  This happened to me, but not with regard to vacation rentals.

        • baliexpat Contributor 109 posts since
          Feb 8, 2013

          Yep... that is why I am glad you are here swlinphx. You are right. The only thing it does is hinder them from getting into your homeaway account. Let me ask you something. The Homeaway Inquiry Logs are also showing that no Inquiry was sent to the advertiser whose property was used as the rented property for the scam. If the owner of this property never received an inquiry then how could pfishing his email get the travelers details? Thanks swlinphx... I watch for all your posts. Cheers

          • swlinphx Senior Contributor 1,158 posts since
            Aug 30, 2011

            In the specific case you're referring to it may have been something different like you were talking about before.  However, what I was referring to was mostly for owners (like me) who don't log in to get their inquiries and instead handle all responses from their outside e-mail address.  I don't want to have to log into my inquiries each time and I use my main mail program to archive, sort and refer to inquiries received and responses I sent from all my advertising sites in one place.  Also, originally in the past, many listing sites just linked to an outside e-mail address to the owner before they started going through their own system of delivering inquiries without showing the owners e-mail address on their listings or when they send their initial inquiry.

            • baliexpat Contributor 109 posts since
              Feb 8, 2013

              I see. For me hitting reply to the email, on Flipkey sends the message back though the Flipkey messaging system without logging in ... For Flipkey I also direct email as sometimes if I am attaching more than one Villa File  I go over Flipkeys attachment limit of 5MB.

              With Homeaway I am unsure whether my reply goes through their site or not... don't think so because when I hit reply to the Homeaway inquiry it goes direct to the Inquirer's email because I always add the inquirer to my contacts list at the same time. I only ever log into my Account to change or update the calendar or the rates or to cross check my Inquiry Log.

              Inquiries have been known to go missing. From what our affected property owners [the properties actually fraudulently booked] tell us is that the Original Inquiry is not on their Homeaway Inquiry Logs. Nor did these property owners ever receive the inquiry notification email from Homeaway.

              But we have victims that did receive a Confirmation of Inquiry on the property that was used. I thought maybe it was what you were talking about that happened to you but then I couldn't figure out how the inquiry was also missing from the Homeaway Account Inquiries Log. How could these 2 places miraculously be missing this inquiry at the same time, unless Homeaway was also breached at the exact same moment. The victim definitely made an inquiry in this case because she sent me the Inquiry Confirmation. Homeaway claims it is spam removal. Pretty big coincidence that it keeps happening to each new victim... maybe there is some breach in Homeaway in the spam files.... OK techies... help me out here.

              or maybe I am totally off the mark in my logic

  • telemarkboy New Member 4 posts since
    Oct 25, 2012

    Hi. I have been receiving more and more dubious email enquiries. I have taken on board the replies from other members.Thank you.  I have been in the Internet/Government security business for some 25 years and dealing with the Internet since before it was created back in the DARPANET days, so I have a keen interest in this subject. What is happening to us is potentially quite worrying, and needs to be sorted out, lest the bad guys win, resulting in Owners leaving the community, and Holiday Makers steering clear of the site. This would, most likely, result in the closure of the site, due to zero revenue. We Homeowners need to do our bit for security, and so does HomeAway. For my part, I have difficulty in establishing the true identities of people (Incl. genuine holiday makers) who wish to do business with me. I do the usual background checks, which has worked so far. I'm thinking of ramping up my security checks to include such things as police checks (in country), exchange of passport ID image and data and cross-check to the relevant national passport office, Skype phone call with Image verification: against the passport photo submitted, Facebook and other social media, Fixed land line telephone number, and a Residential address .... It seems to me, that a genuine holiday maker will have a number, if not most, of the following ( which, incidentally could be verified or at least asked for by HomeAway) ...... Full Name, Address, Home phone, Mobile phone, Passport, Drivers licence, Facebook page, LinkedIn page, Entry on the Electoral Register, access to Skype.I am not sure of the technical capabilities of the HA staff, and regrettably have little confidence in their ability to sort the security issues out, in a professional and business like manner, from what I have read in the Forums. I would be happy to discuss these issues with the Security Manager/Officer at HomeAway... you have my email address  and tel no. Is anyone else out there thinking of seriously ramping up their security?

Not a member?

JOIN THE COMMUNITY

Register Now

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Best Answers - 4 points
  • Helpful Answers - 2 points