Out of the blue, Airbnb sent me a text with a "Pin", Not sure if legit.

[Joe-and-Becky0]

I just received a text from Airbnb with a pin.  Not sure what this is about and not sure if this is legit.

Anyone else get this?  Can't figure out why I would need this if it is legit and why I cannot choose my own pin combination if so.

The exact text:

Airbnb PIN. Never share your code with anyone - Airbnb employees will never ask for it. Your code is...

[Regina685]

I am getting one or two pins sent per day and have been for weeks. How do you look up the activity on your account? I am curious to see if I have the same issue.

Thank you!

[Christopher737]

I received 14 texts like this over last 72 hours and Airbnb has done nothing to fix this.  Just logged into my account and saw that my account was accessed around the world 8 times...I have definitely been hacked.

[Terence38]

Same - received almost 20 texts over the last few days. Logged into my account and found it accessed multiple times from all over the world. Changed my password and removed the payment method.

[Tom890]

I have the same as others described... why do they want to hack airbnb accounts? What can they do once in? They haven't spent any money...

[Alyshea0]

I've received the exact same texts - at least 10-15 a day for the past 5 days!!

[Jonathan922]

Got 6 of these text messages today between 4pm and 8pm. Checked my account and yep, logins from Armenia, Spain, Thailand and Saudi Arabia. Airbnb have clearly been hacked. I suggest everyone change passwords including other apps / stores that use the same email and password (if you have any). 

[Emma754]

I, too, have had three SMS messages from Air bnb. I checked my account activity and have had three unauthorised log-ins - two from the US, and one in the UK. None of those were me. I've removed payment methods, logged out, and changed my password. Now I guess it's a waiting game to see if anyone has used my card details.

[Cormac0]

@Joe-and-Becky0 

this happens when you try  logging in from a new device, its to verify that you are who you say you are on the new login.

"Two-step verification is a process that involves two authentication methods performed one after the other to verify that someone or something requesting access is who or what they are declared to be."

[Belén59]

Hello, I'm reciving those too, what should I do?

[Elizabeth1419]

same! 6 messages in 8 days. i blocked the number. scammy scammers.

[Regina381]

I have received them daily in the middle of the night for the past 3 weeks. I can’t find anyone at airbnb to speak to. Logins form different places all around Melbourne everyday. I’ve changed my password in my settings and it’s still happen. Better still, relatives and friends have started receiving suspicious emails from me which I’ve asked them not to open. I need this to stop. Help

[Sarah3100]

I started  getting that message this weekend. I think it’s a phishing scam. I, of course, took the proper precautions just in case. 

[Les35]

This looks more like a glitch than a phish.

The messages I receive come from 78156. Here's an example:

"<#> Your Airbnb verification code is: nnnn. Don't share this code with anyone; our employees will never ask for the code. qkpTe1dy0zl"

Why it starts with "<#>" and ends with "qkpTe1dy0zl" is a mystery.

Replying HELP to the message returns:

AuthyMSG: To learn why you got this message, please visit  https://twil.io/why-verification. Reply STOP to stop texts. Std Msg/data rates may apply.

That link is not a phish. Twilio is the service Airbnb uses to send verification codes when you attempt to login to Airbnb on a new device. Going to that link essentially tells you that the message comes from a company that uses their service and replying STOP may break your ability to get valid authorization messages when you do sign in on a new device (or one where you've cleared cookies).

I just cleared cookies for airbnb.com to simulate signing onto a new device and Airbnb sent a verification code message from 78156 that is identical to the mystery messages except that it doesn't have the weird prefix and suffix text noted above.

Maybe these messages are a result of hackers trying to login to Airbnb accounts, but why the strange prefix and suffix text on the messages? Anyhow, I wish Airbnb would look into this and let us know what they find.

[Samantha799]

I’m getting them too, when I’m not logging on or making any changes. My best guess is that someone is trying to hack into Airbnb and steal my account information. Has anyone received a response from Airbnb as to what’s going on?

[Les35]

If it were an attempt to login to your account, the message would come through without the weird prefix and suffix characters and you would get a corresponding email with a title such as "Account activity: New login from Chrome" showing the When, Where, and Device Type of the attempted login.

This really looks like a glitch on the part of Airbnb or its messaging partner Twilio.

I'm going to call Airbnb support tomorrow to see if they have any clue about this issue.