My name is Courtney, I manage the Airbnb for Steve. I am concerned because our account and a guests' account were hacked in June. Airbnb tried to brush it off and offered an implausible explanation, then ignored my follow up questions. I'm extremely busy so I let it go for a few months but I've recently experienced three more interactions which make me concerned that properties with self check-in are targeted by thieves. I've looked through the community threads to see if anyone else has written about this but nothing as specific so I'm sharing my story to see what I can learn.
I manage two properties - each has self check-in as well as instant booking (for any guests who have verified profiles). There is another catch with instant booking - you can book 363 of 365 days of the year except the two days directly before a reservation is set to begin. This is to make sure the apartment will be ready before a last minute booking. It has been like this over a year and there has never been an issue but that changed in June.
On June 11th, I woke up with a notification that a reservation was booked instantly to start that very day and the guest seemed fixated on the lockbox directions. I was across the country in California (3 hours behind NY) and very upset that there was this new reservation which I wasn't sure I could accommodate. I was very confused and thought maybe there was a computer glitch. Guests had checked out that morning and I wasn't confident the cleaner would be able to prepare the apartment in time. It was only a two-night reservation so I called Airbnb to ask for help with the cancellation and also to ask how this could have happened.
The customer service rep was kind about the cancelation and said that I must have changed my instant booking settings on accident. I knew this was not possible. I was visiting my best friend and was almost completely disconnected from my phone and computer. I was in a rural area and had almost no phone service so it wouldn't have happened in my pocket by accident. It was strange but I still assumed it was a computer glitch.
I contacted the guest to apologize for the cancellation and to explain the reservation should never have been possible. The guest replied to tell me that they had been hacked. (Photo attached.) This made me convinced that my account was also hacked because I couldn't see how the instant booking settings would change like that.
I contacted Airbnb to share my concerns and they replied that it must have been Steve who made the changes but that just couldn't be. I take care of everything for the account from the profile, to the messages, to the operations. Steve has the password but he doesn't "have the password". (I'm his assistant and this is the case for a lot of his accounts. He's not tech savvy and he's not too concerned because the Airbnb is running smoothly.) More importantly, I was in California, he was in Miami, and the Airbnb is in New York. They could have easily confirmed the geographical location of Steve's log in. It just wasn't possible that Steve made this change by accident and he definitely wouldn't have done it intentionally.
More importantly, they completely ignored the fact that the guest stated that their account had been hacked even though I told them this. And I have a message from the guest saying that their account was hacked for this purpose! This feels targeted and I wanted to escalate it but I simply had a very busy summer.
Then on November 5th, I got a request for a same-day reservation stating that the guest's apartment had been flooded. The profile was verified so I approved it and sent the check in details. (I won't do this again.) Shortly after, Airbnb called me and told me that the reservation was cancelled because the guest had violated the Airbnb terms. They wouldn't tell me more but they advised me to remove the keys from the lockbox so the guest couldn't use the self check in details. (It was actually very scary because Airbnb wasn't sure if it would be safe to retrieve the keys!) I was very concerned about safety but couldn't get any more information. Everything was OK - the keys were removed from their lockbox and the door codes were changed. Unlike other cancellations, this guest's messages disappeared from my account entirely but I still had their profile open on an old page so I was able to call and text them to ask about what happened... no reply.
Two days later someone else contacted me for a same day reservation saying that their apartment had been flooded. I declined but asked some questions to try to test if they were a real person. They never replied but I felt like I dodged a bullet. Since then, those messages have also disappeared from my account. Clicking the request email, I find that this account was ALSO suspended because that person who ALSO had a flood had also "violated Airbnb's terms of services."
Last week I had more suspicious activity with a reservation made instantly at the last possible moment (Nov 26) for Fri Nov 29 which was cancelled the night before (Nov 28). That guest initially wrote me a single sentence message saying "thanks for stay" but then didn't reply to my friendly message trying to feel out if they were a real person after they cancelled and thankfully they cancelled before I sent the self check in details. But on Nov 29th, I received another same-day request. I declined because it was somewhat late on the day after Thanksgiving and I had already told the cleaner to take the day off. That guest attempted to manipulate me about how his family had nowhere else to stay and that the money had already been taken off his card. I called Airbnb and the money might have been put on hold but it still should have been available. (I couldn't get a straight answer from them about whether the funds would have been available but I recently rented a car and the money was on hold but not charged until I returned the card. So my limit/spending power was the same for those 15 days until I returned the card...)
Is anyone else with self check in experiencing these types of issues? I don't have evidence that every one of these attempts to get into the apartment was fraudulent but that certainly seems to be the case. It definitely was a hack in June and there have been multiple suspicious attempts in the past month.
I will no longer accept last minute requests without confirming there is a real person on the other end and will try to speak with the guests before sending the check in details. I never send check in details to reservations made well in advance without confirming the guest's arrival time so should arguably help keep things secure moving forward but this is super disturbing - especially after Airbnb called me and told me to remove the keys from the lockbox but to beware that the guest might be there. Specifically because Airbnb has stonewalled me.
Anyone else have a similar experience?
