Dear AirBnB and AirBnB community,
I would like to share with you my story because I believe it will contribute raising awareness and do better.
I should perhaps start by saying that I have used AirBnb a handful of times and I was never disappointed. I do regard it a a genial business idea and its advantages are several.
I have come back from yet another trip organised via AirBnb and I had a great experience with both the hosts who welcomed me and my boyfriend in Crete. At the end of our stay in the island, I received a pop up notification from my AirBnB mobile app showing a conversation between a guest and a host. They were discussing the arrangements about a trip of 22 days in New York which was booked from my profile for 2,475£. I almost fell of my bed.
I checked my email account immediately and there was an email mentioning that my email address had been changed, the email was addressed to a guy i.e. the unauthorised person who used my account. I immediately emailed AirBnb to say that I did not order the email change. Meanwhile my bank account had been charged 2,475£.
On the same day (it was a Sunday) I phoned the AirBnB UK contact number and I explained that my profile had been hacked. I was reassured that a specialist team would have taken care of my case and they would have been in touch with me. I could no longer log in into my AirBnb account as my credentials were not accepted due the hacker having edited them.
As I was not contacted by AirBnb the day after, on the Tuesday I called AirBnB again and I was told that my request had been marked as urgent and a specialist was working on it and they would have kept me informed. Neither calls nor emails from AirBnb followed. On Wednesday I dialled the same number for the 3rd time and still there was no progress.
Now a week has passed and to date I have not received a single email (not even an automated one) from AirBnb in reference to the hacking of my profile.
While not having the full picture and not being an IT expert, these are the conclusions I can draw and that I would like to highlight:
• 1) My profile -originally associated to a female profile- was renamed after a guy. 2) The trip to NY was booked while I was on a trip in another contined hosted by AirBnb hosts. I would dare say that these are evident security threats that are automatically detected by even the most basic informatic systems though it seems that AirBnb has not put in place this kind of risk mitigation measures.
• In all mainstream online platforms or email accounts we use daily, the email address (or mobile for those who decide to share it) constitutes a key tool and every action undertaken by the user is checked against it. Countless times I have been sent an email requiring to click on a weblink to confirm that I agreed with changing the email address. How often I moaned! In fact it is a simple and fundamental requirement that ensures control to the user. Receiving an email only after the email address has been changed is not effective. Risk management is about implementing ex ante measures and a global business like AirBnB should know it.
• AirBnb has never contacted me through a whole week. I ignore the reasons but in terms of customer care, this is appalling.
FOLLOW UP
I would like AirBnb to :
- Keep me abreast of the findings of the specialist team, how the hacker will be prosecuted and how they plan to restore my trust.
- Inform me about what steps it has taken to address all the flaws of its system that my experience has revealed.
- Advice how I can take possession of my profile again so that I can submit a review for the wonderful hosts I had and allow them to publish their review about me and my boyfriend.
From my side, I learnt that no bank details should be shared permanently with AirBnb. I hope my experience can benefit other people and prompt AirBnb to improve.
Thank you for your attention,
Sara
PS: I had to create a new AirBnb profile in order to post this comment as my original credentials are no longer recognised.
