Furious would-be travelers across the country say popular vacation booking site HomeAway isn’t doing enough to protect its customers from thieves, and one suburban family claims that lack of protection cost them thousands of dollars.
Mario and Ator Valkov, of Des Plaines, had used HomeAway before, but say they became victims after trying to book a property in Fort Lauderdale, Florida in January.
"We started making arrangements for signing a contract with the person on the other side who I thought was the property manager," Mario Valkov said.
The couple says the property owner asked them to send $4,000 via bank transfer to book a week’s stay. Something they had done before on HomeAway without incident.
"It is not unusual,” Mario Valkov said. “A lot of homeowners don't want to deal with credit cards."
What happened next left the Valkov’s stunned.
"I send an email asking would there be charge for the early check in? And the email bounced back saying it was undeliverable. That kind of freaked me out a little bit," Mario Valkov recalled.
One phone call to the actual property owner confirmed their fear: the house was real, but the deal was not.
“When we contacted the property owner, we realized she had no clue who we were, and that the property was booked to another family,” Ator Valkov said.
The family had unknowingly become victims of an apparent phishing scheme where scammers intercept emails, pose as the property owners, re-direct the wired money, then vanish.
“How is this possible? How did this happen?” Ator Valkov said. “And it was very upsetting because the first thing that went through my mind was we lost all this money and we have all these kids who are so excited about going on vacation. So it was very upsetting.”
The FBI told NBC 5 Responds more than $41 million dollars in losses were reported for both real estate and vacation rental schemes last year. What is harder to pinpoint is how many victims might be out there.
HomeAway told NBC 5 Responds it is very rare that customers become victims of fraud. But the company may also entice some users to not make their case public by offering a settlement agreement. The deal gives victims $1,000 back, only if they agree to keep the terms confidential.
The Valkov’s say they were offered the deal, but turned it down, calling it a slap in the face.
"It's an insult because we spent more than that, “ Artor Valkov said. “Not to mention all the disappointed people."
Many of those angry travelers joined a private Facebook page to lash out at HomeAway. One traveler said, “I was scammed in January 2016. $8500.” Another complained “HomeAway is far too easy for scammers to hack into.” Another said “I just don’t know where to turn and I feel helpless.”
In response to these kinds of concerns, HomeAway told NBC 5 Responds it made some changes earlier this year, including an option for renters where they can pay through the website and be 100 percent protected. The company also issued a statement saying their investigation revealed “the Valkovs unfortunately fell victim to a bad guy who took control of the account of one of our property managers.”
“This is known as phishing and occurs when an owner or property manager inadvertently gives their login credentials to a bad guy,” the statement read.
“Travelers who book and pay for a property directly through HomeAway’s checkout system are automatically covered by our Book with Confidence Guarantee, which includes comprehensive payment protection for properties significantly misrepresented,” it continued. “HomeAway has also made significant investments in processes and technology to help detect, prevent and mitigate suspicious activities. We employ fraud detection methods that encompass a combination of technology and human review, but we cannot disclose specific components of our processes as they are proprietary, and discussing them may provide criminals with information to avoid them. To avoid phishing incidents, we educate travelers both onsite through our Security Center and via email communications that explain online identity theft and provide tips for protection. While it’s important for travelers to take the necessary precautions to protect themselves, phishing is a rare occurrence among HomeAway owners and property managers, only happening with 0.02% of transactions.”
In order to protect themselves when booking a vacation rental, HomeAway advised travelers to:
• Do research – Google the homeowner to get an idea of who they are as well as the property, if you have the address.
• Call the number on the listing website before paying.
• Get a rental contract with everything in writing before sending payment.
• Book the property directly through the website, using HomeAway’s online booking and online payment features.
• Pay with safe payment methods – online booking by credit card is recommended; if someone is trying to get you to pay through a wire transfer service, walk away.
• Trust your instinct, if the price is too good to be true then it probably is.
• Visit HomeAway's Security Center for additional tips.