Key Takeaways
If you’ve spent enough time on the internet, you’ve probably heard a few travel booking horror stories: fraudsters calling up impersonating a hotel or booking agency to steal credit cards, or phishing emails that look legit but are anything else.
If you rent out your property through a holiday booking site like Airbnb, Booking.com or VRBO, as well as hundreds of other smaller platforms, you’ll also have a raft of other types of fraud to worry about as a landlord. In this article, we’re going to look at some of the scams that circle around Booking.com and Airbnb – but these examples of fraud are not specific to these websites. Rather, because of their scale and popularity, these services are the most visible to holidaymakers and private landlords, and consequently the biggest potential targets for scammers in this area of the hospitality sector.
You’ve found the perfect villa or apartment in a place you’ve always wanted to visit. Booking a week there was easier than arranging the travel thanks to a website that’s a household name around the world. Then, a few days before the trip, you’re asked to confirm your payment details, apparently by the property’s owner. Before you know it, your bank account’s been emptied. What’s just happened?
This and other scams targeting users of popular booking sites including Airbnb, VRBO and Booking.com are sadly all too common. This despite significant efforts by those very platforms to stop fraud: Airbnb alone blocked 265,000 suspicious listings and cut the number of clicks on ’risky‘ external links by 20% by June 2026, after introducing new security features in 2025.
Can you get scammed on Airbnb or Booking.com?
Absolutely. But we need to clarify this statement a bit more, because almost all of the fraud ultimately takes place *off* these platforms, where the providers’ guarantees and indemnities against fraud don’t apply. Platforms like Booking.com, Airbnb and VRBO are generally very safe – and all three are big enough to be listed on multiple US stock exchanges. What’s happening is that scammers are abusing this trust to defraud members of the public at scale.
And it’s not unique to these or other short stay booking platforms. In the US, the Federal Trade Commission recorded complaints from consumers losing a total $274 million in 2024 to travel, vacation and timeshare plans scams – the ninth most reported type of fraud in that country. Of that, vacation and travel fraud made up 55,719 of the total 58,347 reports.
There’s also been an increase in AI-enabled fraud, although it’s not clear how significant this is. Booking.com’s Chief Information Security Officer (CISO) Marnie Wilking said there is anywhere from reported a 500-900% increase in AI-enabled scams over the 18 months to June 2024, particularly AI-generated emails, text messages and images. It’s not clear what previous sum, the increase in the number of incidents of fraud is based on.
Travel site fraud has the same elements as any other type of fraud
It’s worth noting that fraudulent activities around websites like Booking.com and Airbnb are more visible because the sites themselves are very high profile and have high public visibility. It is this visibility that makes them attractive targets for fraudsters, and the fact that these websites act as intermediaries between property owners and people looking to rent from them also means that a fraudster can insert themselves into the transaction a little easier.
With that in mind, the types of fraud we’re about to talk about are actually pretty universal and apply to all kinds of commercial activity, such as booking concert tickets or buying a collectible at auction.
One thing to bear in mind as a massive red flag is if the other party wants to move the conversation or transaction off the platform and onto another service, such as email or WhatsApp. Be extra careful when they want to use transfer methods that are difficult to revoke such as wire transfers or crypto transactions. If in doubt, go back to the provider’s website or App and contact the host or customer using the built-in messaging service.
Remember, too, that common types of fraud like phishing scams apply to intermediary sites like Airbnb, Booking.com and VRBO just as they do to other popular web sites and services. If in doubt, always close the email or message, and log in to the site or dedicated app to verify and address the message through that site or app, not directly.
The most common Airbnb scams
The watchword here is: if it looks too good to be true, be suspicious, and if it requires urgent action on your part, tread carefully, too.
Fake and AI-generated listings
Travel sites are getting better at spotting and pulling fake listings before they reach the public view, but it’s still possible to be presented with a property listing that contains stolen images of a location, or pictures that have been adjusted or even created wholesale using AI. One way of sense-checking before booking is to conduct a reverse image search of the photographs to see if they’ve been used elsewhere. Bear in mind that many holiday rentals are also listed on other websites, so don’t be too surprised if the pictures pop up. However, do check that the listing, location and other details are absolutely consistent.
“Pay me directly and I’ll give you a discount”
Treat this as a hard ‘No’, no matter how tempting the offer. Not only are you likely to end up paying a fraudster as well as the actual venue for your stay, but you lose all the protection that big platforms like Airbnb and Booking.com provide for your safety.
Bait-and-switch and last-minute ‘problems’
Messages like these are often sent just before you depart to make you panic and accept what’s offered as a substitute. Some hosts do this deliberately, listing a few amazing looking locations at attractive prices to then bait and switch the customer to a much less pleasant location at the last minute. That substitute will likely be far below the standard you paid for, and you’re well within your rights to book elsewhere. Whatever you do, avoid cancelling the booking yourself; ask the host to cancel. Report to Airbnb immediately and, if the ‘problem’ has popped up within 30 days of travel, and the host has cancelled, Airbnb will help you find the same or better accommodation.
Fake reviews and cloned listings
Similar to fake listings, cloned listings and less-than-legit reviews are also something to look out for. When looking at a property, check other properties in the same area, read reviews and be on the lookout for repetition, odd or unusual dates and the host’s history – it’ll show how long they have been a host, the number of reviews and the rating given by visitors.
Fake damage claims after checkout
These are incredibly frustrating, but a few minutes spent videoing and photographing the property when checking in and when checking out will help protect you from fraud here. Walk through the property making a video of it with your phone. Any existing damage or wear should be highlighted and photographed. Do the same when you check out. If need be, talk through any visible issues as you go.
The Booking.com scam wave: phishing inside the app
Cybercriminals defraud Booking.com customers differently: first they compromise the hotels providing the accommodation, then impersonate them and ask for payment details they then use to steal money from guests. This impersonation can take the form of an email or phone call. And if they’ve successfully stolen the hotel’s booking.com login credentials, they can even send an in-app message.
Why is this fraud approach different? Booking.com differs from Airbnb in that the accommodation providers tend to be hotels and hotel chains. From an attacker’s perspective, this makes the hoteliers attractive targets – compromise one of these, and you can defraud dozens, even hundreds, of people.
Microsoft detailed an attack starting in December 2024 that impersonated booking.com and targeted hospitality organizations around the globe. The campaign used a social engineering technique called ClickFix to steal credentials and data that gave the attackers access to the victims’ booking and reservation systems.
The attack starts with spoofed emails that the attackers send to legitimate customers applying pressure to re-enter payment details or risk losing their reservation, with links to fake but authentic-looking booking and payment pages. The criminals make these emails particularly effective by using genuine information they’ve stolen from the hotel’s reservation system – things like your name, date of stay, home address and other information.
Once the targeted person opens the fake website, an error or verification process message pops up, tricking the user to install spyware.
One last thing: attackers who compromise hospitality companies and steal both data and credentials have also been known to make off with their Airbnb or Booking.com logins. Thus, it’s entirely possible messages you receive in-app asking for payment or communication on a web page or service outside the platform come from fraudsters. If in doubt, flag suspicious messages to the platform provider.
Is this message really from Airbnb or Booking.com? A 30-second check
We’ll say it again: think before you click, and spend a couple of seconds looking at the message you’ve just received and its tone. Is it intended to scare you, or insert a sense of urgency? Tread cautiously. At this point, we’d urge everyone to log in to the app or web page for the service independently, and to see whether the message is repeated there. If it isn’t, then it might be time to contact Airbnb or Booking.com to check.
A few things to bear in mind:
- Platforms, hosts and hospitality companies will never ask for payment, card or security details via chat links.
- If you get a message that claims to come from a host or the service, just go to the relevant Airbnb or Booking.com app instead. If it’s legit, it’ll be in there. If it isn’t, you should report it to the platform instead.
- Don’t just tap on links in random emails.
- If you’re really concerned about a message, look up the details of the hotel or property you’re staying at on the internet and call or email them using those details, and not the ones provided in the email.
- Report suspicious emails or chats using the platform app – you’ll be helping them, the venue and other travelers by doing this.
- Always beware of the combination of urgency, payment request and a link in a message – it’s invariably a scam.
Scams that target hosts
It’s not just big hospitality companies that get scammed, either. Airbnb hosts are also targeted with a variety of fraud schemes. Here are a few things to be aware of:
- Overpayment: The guest pays, but they overpay, sometimes massively. You’re asked to transfer the balance back, maybe with an apology and a suggestion you keep a bit extra for yourself. The initial payment will fail – often some time after you’d expect it to, leaving you out of pocket ($) and potentially at the receiving end of a fraud investigation. In this case, the attacker has used stolen payment details, and then asked for repayment to a second, likely also stolen, bank account.
- Chargeback, aka Friendly Fraud: The guests book the accomodation, stay and then, some time later, come up with a bogus reason to persuade their bank to issue a chargeback, recouping the cost of the stay.
- Fake guest profiles: The guest looks fantastic on paper, but in reality they’re anything but. The actual person booking may be subletting to others, organizing a massive party or using your property for criminal gain.
- Fraudulent damage disputes: The guest makes a complaint to the platform (Airbnb or Booking.com) concerning damage or poor conditions at your property, and requests compensation. The damage has been caused by them deliberately or may even be fabricated entirely. Be sure to take pictures and video of the property before and after use to document any potential fraud.
Then, one key bit of advice for all of these situations is to keep communications and payment strictly on the platform itself, as Airbnb goes to great lengths to protect hosts who fall victim to scams. Aside from this coverage, we’d also recommend specialist host and venue insurance on top to cover damage, fraud, and legal fees.
How to book safely: the 60-second routine
It’s better to take proactive action than live in fear. Here’s a round of quick checks anyone can perform when booking a stay that will fend off most of the potential avenues for fraud:
Once you’ve found a place that looks good:
- Perform a reverse image search to see if it’s listed elsewhere under different details or in a different location. Consider checking for AI content using a free online tool like isgen.ai to find any telltale signs of image manipulation, too.
- Check the property and the host’s history on the platform. If both have been there a number of years and have a strong set of reviews over multiple years or months that aren’t duplicated or otherwise suspicious, it’s a good indication that they’re legitimate.
- If the price is too good to be true, it’s probably a scam. Check pricing for similar rentals nearby.
- Book with a bank card, not a wire transfer, and always do it via the app or platform’s website. In some countries, card transactions are protected by the bank or card issuer against fraud, and they may be able to issue a chargeback to recover funds.
Scammed anyway? Do this, in this order
If you are unlucky, and fall victim to a fraud:
- Report in-app to Airbnb or Booking.com and see if you’re covered. Misrepresented bookings are covered.
- Bear in mind that bank chargebacks may also protect you, but you’ll need to contact your bank to make a complaint as soon as possible.
- If you put details into a suspicious site or form, or you shared them in the chat, call your bank’s fraud line immediately, and if you haven’t already, implement two-factor authentication and change passwords.
- Report to your national fraud center and/or police. If you don’t know who that is, use an internet search. For example, the UK has Action Fraud, while the US has the Federal Trade Commission. Reporting your encounter with fraud as a crime can also give you a crime number (at least in the UK) that can be passed to whoever provides your travel insurance.
- Acting fast can often recover stolen money, so don’t be discouraged.
Insights from an ESET expert
“Booking sites like Airbnb and Booking.com are very safe, but as we trust these brands, criminals take advantage of this and attempt to exploit people in creative ways. The biggest warning sign in this scam – as well as other similar scams – is when the criminals try to move the conversation or payment away from the platform; this is usually transferred to WhatsApp. Whether it’s a fake message asking you to verify your card or a last-minute cheaper deal on the same booking, that’s when the alarm bells should start to ring and you should stop all communication.
The best advice is to always remain inside the app for communication with the company. Unfortunately, lots more companies are legitimately using WhatsApp as their communication tool for ease of use but remember to be skeptical of any request outside the platform, especially those messages with urgency and similar strange requests. You can always double-check in the app or via the genuine website.”
- Jake Moore, Global Security Advisor
Stay one step ahead of online scams
ESET HOME Security Premium protects your data and online activity - even when threats look like legitimate booking messages.
Conclusion
The sorts of scams that target users and hosts on Airbnb and Booking.com aren’t much different from fraud elsewhere on the internet. However, they have a high profile for several reasons. Firstly, both companies have strong brand recognition, and act as intermediaries. Secondly, holiday bookings tend to be some of the costliest parts of most people’s year, and something they look forward to. Losing a large chunk of money, their holiday or both is a devastating experience.
That said, it’s important to bear in mind that neither platform is deemed unsafe, but criminals have found gaps to exploit. Keep your transactions and communications within the platforms, and it’s likely your holiday and your money will be protected by the provider. Take a moment to think twice about the messages you receive, and follow our guide, and your chances for falling victim to fraud will have lessened. Enjoy your holiday.
Frequently asked questions
1. Can you get scammed on Airbnb?
Absolutely – but it’s not because Airbnb is unsafe. Scammers create fake listings, push for off-platform payments, or send phishing messages that imitate (or even hijack) real hosts. Stick to in-app payment and communication, and most scams simply can’t touch you.
2. Will Airbnb or Booking.com refund me if I’m scammed?
Quite often, yes, if you stayed on platform. Airbnb’s AirCover can rebook or refund you when a listing is fraudulent or seriously misrepresented, and Booking.com investigates reported fraud. If you paid outside the platform, refunds become much harder, which is exactly why scammers ask you to do so. Bear in mind your bank may be able to help you, too, so if you do fall victim, call them.
3. Why did my hotel message me asking to verify my card?
Yeah – it almost certainly didn’t. Criminals compromise hotel and host accounts and send messages asking you to ‘verify’ your payment from inside the genuine reservation thread. No legitimate hotel or platform asks for card details in chat. Open the app yourself and either check or call the hotel via its official website.
4. How can I tell if an Airbnb listing is fake?
Run the photos through a reverse image search and an AI image search, read the reviews for natural variety and history, check how long the host has been active, and compare the price with similar places nearby. A stunning property at half the going rate, from a brand-new host, is a classic scam.
5. Is it ever OK to pay a host outside the platform?
No. Every off-platform payment request, be it a bank transfer, payment app, or card verification link, is either against the rules or an outright scam, and it strips away every protection your booking came with.
6. What should I do first if I already paid a scammer?
Call your bank or card issuer immediately and request a chargeback. In this situation, speed matters most. Then report the listing or message to the platform, change your account password if you entered it anywhere, and file a report with your national fraud center.
