Credit Card Scam - beware!

[Michael-And-Songha0]

Just now, I received notice by email of 3 AirBnB bookings in China made using my stolen Visa card details. I am nowhere near China, and have no intention of going there.

The first was cancelled, followed by the second two for much higher sums (totalling about 1000

sterling).

As I had just made a genuine AirBnB booking a few minutes earlier using the same card, it looks very likely that the AirBnB site is insecure, as the card has not been used lately for anything else.

I have informed my Card company and AirBnB, and hope this action will lead to a successful outcome.

In the meantime, I shall remove my Credit Card details from the AirBnB website. Any other suggestions?

I hope this alerts others to this scam, or that it's a one-off.

[Michael-And-Songha0]

A further two v expensive  bookings were quickly made using a second card I have listed on AirBnB. This time for properties in Thailand.

I  CANT REMOVE THE CARDS FROM THE WEBSITE AS THERE ARE OUTSTANDING PAYMENTS  - THIS IS WHAT AIRBNB SAYS - BUT THE ONLY

PAYMENTS OUTSTANDING ARE THESE FRAULULENT ONES!

12 hours llater - no commment from AirBnB, though I emailed them several times. I've of course had to stop the cards with the banks, so now I'm left with

very little money for our trip and will I guess have to have more wired out via Western Union or some such.

Here is the description of one of the fake properties as it appeared on AirBnB. Please note that the property is advertised in Thailand!

"6-bedroom house on Marble Arch in London has accommodations with free WiFi, 2.9 km from Carnaby Street, an 18-minute walk from Madame Tussaud's and 1.4 km from The Serpentine. This villa is a 19-minute walk from Hyde Park and 2.4 km from Royal Albert Hall."

As phone numbers and emailsof the hosts have been made available to AirBnB, the least they can do is remove these listings. Clearly there have been no verifications (apart from email and phone number), so these fraudsters were able to post fake properties, make a fake booking using my card details and then collect on the proceeds.

All AirBnB need do is check on my listing to see these details, including purported photos of the criminals (one is wearing a face-mask!).

I'm very curious how AirBnB will deal with these listings. PLEASE HELP!

[Elena87]

@Michael-And-Songha0 

It looks like the fake listing details are cut and pasted from a place ''6-bedroom house on Marble Arch'' advertised on booking com

[Sally221]

Let's hope not by ignoring the false listings or by ignoring the several reports of hacked credit card, that would be bad for guests and legit hosts too, Sally

[Michael-And-Songha0]

Thanks for reading, Sally. Surely AirBnB should check these listings more carefully before they pocket their cut!

[Sarah977]

@Michael-And-Songha0  I'm so sorry this is happening., and it seems to happeneing with alarming frequency these days. Many reports of hacked cards, fake listings, etc. 

I'm a host and have never usd Airbnb for travel. But if and when I do, this is what I'd do- I'd have the credit card I used on Airbnb have a credit limit on that card that was sufficient to cover the booking I was actually making for myself, and very little more. I don't know if all credit cards work this way, but I can change the credit limit online to whatever I want, as long as it doesn't exceed the max they allow me. Then I would pull the credit card info off the site entirely when I wasn't in the midst of a booking. 

Then I'd have a different credit card that I used to pay for other things that had whatever credit limit I could get and that I never used for any online anything. Way too many hackers out there these days and way too many security breaches.

[Michael-And-Songha0]

Sarah, that's very good advice, thank you!

I'll do this before our next trip. I've had a phone chat with an AirBnB staff memeber who said the incident is being referred to their "Trust Team" who will get back to me by email. 

Watch this space.

[Gordon0]

Please don't take offence, @Michael-And-Songha0, but is the site you used to make the bona fide booking a legitimate Airbnb site? There are others out there that look very similar.

The Airbnb site is secure (see the padlock) so it would be very odd to have your card details taken in this manner as staff don't have access to the details.

[Michael-And-Songha0]

Padlock or no padlock, at least three scammers are sitting on the bona fide AirBnB site as hosts, purportedly in Thailand and China. This can be verified by checking out my trip records any time. I hope the Trust Team will deal with this.

[Sarah977]

@Gordon0  There are hacks going on- I don't know how they do it. And there are scammers putting up fake listings, which they then immediately take down as soon as they manage to scam someone. A guest posted one of these the other day- legit on the official Airbnb site, but listing asked guest to email him, as he doesn't have his calendar updated, and that then if they wanted to book it, the host would have to "send an invitation to Airbnb". It was a total scam, but on Airbnb.

I had a guest who told me her Airbnb account was hacked, and this ws some years ago- she now pulls her credit card info off the site if she's not in the midst of an active booking. 

[Elena87]

@Sarah977 

The hacks come from other websites being compromised.

Information about e-mail and password used is circulated amongst criminals.

They can use somewhat sophisticated software for a procedure called 'credential stuffing' - many different websites are checked to see if access can be obtained using the hacked e-mail and password.

Unless a user has unique passwords, airbnb access can be vunerable.

With access to a live credit card - a criminal can't see the details, so they will try to cash in and book an airbnb listing they have set up or have also hacked into ( to avoid the new host 30 day payout wait). Typically a high value booking, at the shortest notice - to try to receive a hosting payment. They will attempt to alter notifications and alerts to genuine account holder. Cancellations can muddy the water, but they are looking still for cancellation payments to be made.

Payment diversions can be made to stop genuine hosts receiving real payments too.

You are right, guests should remove card details from their profile as best practice.

Everyone should use unique passwords, and make sure the notification settings are on.

Airbnb should introduce two factor authentication and re-think how easy it is to set up a listing.

[Sarah977]

@Elena87  Thanks for the more detailed explanation. I'm not super tech-savvy, so I really don't have a clue how they do these things. But I never understand why people use their Facebook or Google account to log-in to Airbnb. That seems really unsafe. I have completely different passwords for everything I do online. And I avoid social media like the plague- no Facebook, Twitter, Instagram, or Snapchat acounts for me.

[Connie473]

Just happened to me, same thing, and yes on the secure site!

[Michael-And-Songha0]

Update on my case (original poster):

I received an email today (5 days after the event) from AirBnB as follows:

Our bank has notified us that you are disputing a transaction for reservation HMAENSX3XJ and we wanted to follow up with you.

This is regarding a 8 night stay in Changsha Shi Hunan Sheng on June 7, 2019.

Then the link after this states:

Hi Michael And Songha, do you know why the payment for this reservation was reversed?

Our bank has notified us that you are disputing this transaction. Please send us some feedback on how we can improve!

 I showed up but the listing was not as described

 Whoops! I recognize this reservation now and didn't mean to do a chargeback

 I don't recognize this reservation and never stayed here!

 Other

I selected "other" and wrote that while I am pleased that some action is being taken on the first case (of 4), I hope that further action will be taken for the other 3 cases.

AirBnB seems to only recognise (so far) that I am disputing this payment from my bank account, although the evidence of fraud (see above) is pretty clear.

Should I wait till I hear further from AirBnB, and/or take alternative action?

[Sarah977]

@Michael-And-Songha0  Try keeping on Airbnb for a bit. You have to lay things out extremely simply for them, I have found.

There were 4 reservations made on my account that I did not make.

I did not book any of these places.

So of course I did not stay at any of these listings.

It appears that my account was hacked.

All of these reservations were fraudulent.

I require that all of these fraudulent charges be reversed.

Please advise as to how you will  proceed with this, ASAP, or I will have to involve the police.

Short sentences in chronological order. They don't seem to comprehend anything more complex.

Good luck.