Beware of Indonesian Hackers

[Anton133]

Hello fellow host,

My title description couldn't be more specific. But this is my real experience as a host for AirBnB in Jakarta only for the past 12 weeks. So far I had 10 legit reservations and 3 attempts from hackers. This post maybe more suitable for host who rent their place in Indonesia, but it maybe apply elsewhere. So here are some of the obvious signs that someone is using fake/ hacked account to book your place in Indonesia:

1. Foreign account, with strange English grammar. As a local, I am quite familiar with how Indonesian-English grammar looks like. So if you receive a booking from foreign account, try to get more details from them using English. Indonesian hackers are expert on breaking IT system, but not so in English grammar.

2. Account name and profile picture does not match. I must emphasize to you all, that as a host you have the legal right to ask for proper photo ID. Especially when you turn-on instant booking. People can book your place only with one verified ID e.g phone number

3. Booking for someone else. In one of my case, a lady from Scandinavian country is booking for 'her Indonesian friend'. When I received strange booking like this, I can't help to snoop around. Google, Instagram, Facebook have plenty of information about your potential guest. If you don't find any obvious connection between the bookers and the guest, then raise a flag of potential scam. 

4. Odd timing. Who would book an AirBnb at 3AM local time? This is hacker prime time.

The most common technique for this cyberfraud is using someone else's credit card (carding). They even advertise their service in social media, for people who wants to get cheap hotel, airline ticket, restaurant voucher etc.

In most cases, somehow AirBnb system can't identify this type of scam. I use my gut feelings and common sense and try to investigate myself. Usually I report to Airbnb after I am sure it was a scam. AirBnb is fairly new to Indonesia. Due to limited payment option i.e credit card and PayPal, this platform is not too popular. Most of my guest are local Indonesian with 0 reviews, so it's kinda challenging for a host to verify their potential guest.

Hope this helps. Please leave me a note if you have similar experience. Would love to hear from the community.

Cheers,

Anton - Indonesia

[Ben551]

Hi @Anton133  - interesting post, though I'm not sure I fully understand it... though it's Sunday afternoon and I'm sleepy..

Can you explain a little more clearly what you believe these 'hackers' are attempting to do, in a step by step manner?  Is it that you believe they are booking your accomodation using an illegally obtained credit card, then on-selling that reservation to someone else?  If so, have you reported their user accounts to Airbnb to investigate?

If so, I'd just call them 'credit card thieves'... they often obtain this information just by walking around Denpasar airport with a scanner, which is why travellers should always use an RFID Protection Wallet... especially when they travel to Indonesia!  My wife's family have been vacationing in Bali every year for the last 12 years, so this (and other security issues) are talked about often.  Mother-in-law has had her credit card cloned more times than I have fingers to count.  There is also the little matter of the death sentence... still, it's an interesting and beautiful place to visit.

I think your general message to hosts is a good one though : we should always be vigilant and watch out for any third-party bookings.  They are against the Airbnb TOS for good reason.  Not only do they raise security issues about the validity of bookings (like the ones you mention) but also if they were allowed, the platform would be subject to a myriad of onselling regimes during peak season, much in the same way a Ticket Reseller does... never a good outcome.

[Anton133]

Hello @Ben551 ,

Appreciate your feedback.

The answer to all your questions in 1st paragraph is YES. The hackers used fraud credit card to book accommodation, either using hacked account or fake account. Later, they sell the accommodation for someone else, at cheaper price. All cases had been reported to AirBnb. In the case of hacked account, the real person got notified and they can claimed credit card charge. In the case of fake account, they got removed by Airbnb for violating Airbnb policy

[Susanto1]

hi Anton... saya Susanto dari Medan - Indonesia juga.. Saya ingin bertanya apakah Anton pernah tau kalau ada kejadian saya sebagai user airbnb, kartu kredit saya di hack untuk pemakaian nginap di Airbnb di Taiwan. Ini saya barusan melihat tagihan kartu kredit saya yang datang ke saya tertulis Airbnb selama 1 hari di tgl 13 Juni - 14 Juni 2019. padahal saya itu posisi saya masih di Medan..
Maafkan saya memakai Bahasa Indonesia untuk melakukan percakapan ini. saya takut bahasa Inggris saya tidak terlalu bagus untuk berbincang dengan anda..

santo - medan

*sensitive information hidden*

[Anton133]

Halo Susanto,

Kartu kredit fraud bisa terjadi dimana saja, terutama transaksi via internet. Kebetulan kartu kredit anda dihack untuk pemesanan Airbnb di Taiwan. Saya pribadi pernah mengalami kartu kredit dihack untuk melakukan transaksi di USA dan Bangladesh.

Anton - Jakarta

[Elisa2039]

Maybe its not related but it seems peculiar that in less than two weeks I had been messaged by two Indonesian guests trying to book my place in Mexico City for long term stay. My rental is more like hotel type and its not the best for long stays (in my opinion).

Both have messaged me late at night (between 1/2am), bad English (which could be understandable), but both wanted long term stays, which I dont get it as you can get a cheaper option in the city (maybe its difficult for foreigners to rent a place outside of airbnb).

Both have no reviews, joined airbnb less than 6 months ago, government id and selfie verification only. The first one wanted the place for a month and asked for a discount (I already have a big discount for long stays). As it is a long term rental and he told me he was in Mexico City I told him that he could see the place and we can talk. I told him that any transaction would be done through the site. He said he will contact me and never heard from him.

Today I got a similar reservation, this time for 215 days, which is a big amount. Once again, he said he is Indonesian which I thought it was strange. I asked for more info and he told me he is only traveling long term and with his bad English told me he was in Mexico (but he also told me he was in Mozambique  so it was confusing). He wants to move from the place he is currently staying here in Mexico (he even mentioned the street), because its noisy and there’s parties and he wants a quiet and clean place. He just wrote asking for the 8 months stay and with the possibility of staying more time. I got suspicious, told him that I wanted him to see the place, and once again that all the transaction should be done through the site. He agree with what I wrote but I dont know if I should ignore it. I looked for his name and only found a  profile in Linkedin, no other site. Cant compare pictures as Airbnb doesnt let me see the picture until the reservation has been made. Any suggestions? Im only asking because its a fair enough money and he hasnt even asked for a discount (like the other one), but also thats why im suspicious too. Thanks.