I've been around for 10 years. I've seen (I thought) pretty much every scam in the book. Well, here's a new one - I'm out $36,000 for a long-term rental.

Cliffs:

- Wife finds apartment for 6-month rental on Air BnB, contacts host, sends pictures back and forth etc. Agrees on price and terms.
- Host (with 4 positive feedback rating) "books" apartment stay on Air BnB which we believe generates an e-mail from Air BnB. We are trying to play within the rules here - not get a deal.
- We receive an e-mail from "automated@airbnb.com" that of course is in every way identical to a normal e-mail one would receive from Air BnB. No sign of phishing, even looking at it after the fact.
- E-Mail includes wiring instructions to an account held with Barclays PLC in the U.K with Air BnB in the Account Name (as well as some other text)
- Another e-mail a few days later from another "express@airbnb.com" address which is also, in theory, a legitimate air BnB e-mail sends us a receipt, says payment arrived. Gives us a confirmation/reservation code.
- We believe these accounts are legitimate Air BnB e-mail addresses that were somehow accessed by scammer - not some knock-off e-mail scam that we should have picked up on.
- We realize that the "host" never actually did anything through Air BnB and in fact just sent us wiring instructions to their personal account (bearing the name Air BnB in the U.K) and nothing was every actually done through Air BnB, even though we had every intention of doing so and thought they were holding the funds until we arrived at the apartment.
- Air BnB claims we did this "off-site" to avoid the fee and they are not legally liable.
- Barclays Bank clearly negligent in KYC regulations - this scam has been going on for at least 2 years involving that bank specifically. Somebody had to present ID etc. with a corporation (and reason why it had to have the name "Air BnB" - a recognized international brand - in the account name. So they need to know whose account it was at the very least, and should have asked why the hell it was being opened as if it was an Air BnB account.

http://www.scambook.com/report/view/181558/AirBNB-Leader-For-Welcoming-Fraud-Scams-Complaint-181558-for-$10,070.00

We have lawyers on the case etc re: both Barclays clear negligence and Air BnB's potential culpability here (which is less likely, legally).

However, one question is: we sent Air BnB (legitimately) a copy of my passport. We also, in the midst of being scammed, sent the "host" this document as well as my address in order to do a contract*

*Wife did this, I didn't think much of it as I was busy.

This seems to allow them to do just about anything/open any accounts etc. What common sense steps (cancel passport?) etc. should I take given that my ID seems to be compromised? Or is it not that big of a deal to have a color copy of that document? I assume it is, but this all happened yesterday...

Anyone with advice, especially pertaining to the last point, would be great.

Everyone else BE CAREFUL and DO NOT FALL FOR THIS.

How does the host "book" the place for you.

Did you not go through standard airbnb booking? The traveller is the one that books.

I thought emails were blocked until actually booking through airbnb takes place.

Wow.

At least you never got your kitcken table spunked on

http://www.huffingtonpost.com/2014/0...n_4978830.html

Obviously we'd never used Air BnB before.

It seems pretty logical that the host and guest agree on something (after seeing some pictures etc) and then when it's "booked" the host basically would tell Air BnB "OK - booked. here are the details. Please send instructions to client."

Am I crazy for thinking that? (I'm legitimately asking - it seems pretty standard to me for the system to work that way, or with the guest booking and the host confirming, and then the e-mails being sent out...)

I understand if that's not the way it works, but it seems pretty damn easy to think that is how it would work. And especially when you're getting e-mails from Air BnB e-mail addresses days and weeks after with confirmation #s and receipts etc that are legitimate e-mails that have been essentially "hacked" - there was no "xxx@AirzBnB.com" with some small change we didn't notice.

The e-mails are the same ones that would send e-mails if it was legitimate in terms of the address they come from AND the way they look.

sounds like they and the scammer were negligent in using the ky too...

Damn, sucks man. I think you can insure yourself against identity fraud. So you might want to consider that. Furthermore, contact your bank etc. and tell them a copy of your passport has been compromised.

Did the copy show your SSN? If it didn't I then don't think you have much to worry about.

I would be very cautious and don't underestimate the consequences of this, since the person who now has the the copy doesn't seem to be dumb.

Just FYI, anyone can send an e-mail with anything they want in the "from" field - there's no "hacking" required. Unless you actually responded to these addresses and there was two-way communication there's no reason to believe they're "legitimate Air BnB e-mail addresses that were somehow accessed by scammer". And obviously it's super easy to send e-mails that "look" authentic just by copying the real e-mails and changing the relevant information.

Sounds like AirBnB handled it really badly though. They have serious problems if they have scammers like this with positive feedback on the site.

Something seems off here!

I've used Air BnB a few times myself now.

Payment to host doesn't occur before the day of check in (if really done through Air Bnb) and they are the ones holding on to your money from the time you book a place until you move in. You should fill in payment details on Air Bnb, not send money to random instructions you get.

Best of luck getting something back.

Link to AirBnB ad?

This.

Yes pretty naive nowadays for anyone to wire five figures to a bank account number sent in an email, rather than do everything within the on-site booking system, and/or pick up a phone and verify things with support.

Anyway OP just sell a few more of your scammy auto-seating scripts to cover losses.

options:

[ ] buy software to compete with other pro poker players
[ ] improve your game so you're not dependent upon bumhunting fish so you have enough baht to **** a ladyboy tonight
[x] do nothing, but bitch about it

come on man get real, pretty low to kick someone when they're down after getting scammed for 36k

Let's not divert the conversation into whatever this guy's agenda is with me.

The point of the thread was to:

1) Raise awareness - lots of people use Air BnB (this was the first time my wife and I had) and I can assure you that this scam is extremely sophisticated and 99% of people reading this thread would have fallen for it. Just be careful. This isn't a random, dumb phishing attempt.

2) Ask about my liability re: the passport copy they have and appropriate action I might take given that from either people with knowledge of this or people who have had this sort of thing happen to them and might tell me "you have a lot to worry about" or "that's the least of your worries..."

Thanks in advance to all those who have PM'd me, e-mailed me, offered to write blog entries, or even done completely unsolicited research for me. I really appreciate it.

It's been removed from the site. The "host" did have 4 positive reviews, though, and no negative ones.

But the scam is basically outlined here:

http://www.scambook.com/report/view/181558/AirBNB-Leader-For-Welcoming-Fraud-Scams-Complaint-181558-for-$10,070.00

- There's no "phishing" here

- A user does not think they are operating outside of the site due to the nature of the scam

- User is intentionally made to believe things are fine for at least a week with phony e-mails with receipts and confirmations from Air BnB e-mails that are legitimate addresses in most cases, but not legitimate here (It's easy to do this, apparently). This is while the account is emptied of funds.

- Air B n B has been dealing with this specific scam and Barclays bank in the U.K for 2+ years to stop this. They've asked Barclays not to keep opening accounts with Air BnB in the name and Barclays has kept doing it, and told them to f-off.

- Obviously there's no reason for Barclays to do it intentionally as there's no profit in having money deposited and withdrawn etc. but they aren't following basic procedure. Go figure - a big bank not doing proper risk management.

- I don't know how someone is doing this besides finding a badly run branch or having a friend working there, but basic KYC or common sense should not allow someone to do this.

- Barclays has known about this for years (and the accounts used are all Barclays accounts....) and haven't stopped it. Not sure what else to say on that at this point.

Is this really how the site works? I would think it would be something like Amazon, where you pay for everything through Amazon (on the physical site) and then Amazon pays the business for you. I would never in a million years wire money to a bank account # that I received in an email, but I hope you get your money back OP.

I don't have a $36,000 credit limit on my credit card. I don't know how else to pay for this without wiring funds. So in that sense it's not like Amazon where you put it on your CC by nature, have it insured, etc.

Wiring funds seemed, or seems even, pretty standard to me. I've wired funds for most of my apartments I've booked in advance - not through Air B n B. Especially in non-US countries, they often charge 5% to use a credit-card due to the 3% they pay and currency fees or whatever. I don't know if that's non-standard or if my experience is odd here.

The point is Air B n B is supposed to be the middle-man and only release the funds when we're happy with the place etc. That's what the site advertises.

https://www.airbnb.com/trust

Our host had all of these things (reviews, profile, verified ID).

We of course sent them the funds to what we THOUGHT was Air B n B because of the nature of the scam...

If you've never used the site before, like I said, I'm confident a very, very high % of people would have done the same.

rakeme read my previous response.. The way revils87 seems to have done this is clearly outside of standard procedure and it should work excatly like Amazon

Also, this is nice to read today for those interested in the macro picture.

http://dealbook.nytimes.com/2014/03/...ype=blogs&_r=0

Also revils87.. If you book for example 6 months on Air BnB you only pay for the first month up front and only that money should be withdrawn from your card/whatever option you use. Then after you have moved in the 2nd month will be withdrawn. Unless your place cost $36.000 p/m you are the one having messed up here.

Again, I wish you best of luck getting something back.

I don't intend to be rude, but you're not giving people nearly enough credit here. A lot of us are savvy enough to understand that seeing an e-mail from @airbnb.com doesn't necessarily mean that's the original source, and I'd think the majority of people reading this use e-mail services like gmail that will alert you that the e-mail isn't from the source it purports to be from. You should really switch to gmail or a service with similar features if you're liable to fall for scams like this.

In all seriousness it's not a sophisticated scam, it's just someone emailing you asking you to send them money off-site (36k for 6 months in advance without emailing or calling support yourself) from a legit looking email address (easily done as stinkypete pointed out) with air bnb in the account name (seems readily done). Those two points are all that distinguish it from your run of the mill phishing scam.

Thanks for raising awareness but a simple google of 'airbnb scam' or 'airbnb payment by email' brings up a support thread - 'what if someone asks to arrange payment through email'

https://www.airbnb.com/help/question/199

Something is off because it's a scam.

But a first-time user (the vast majority of users on Air B n B) could/would easily fall for it due to the large sum of money involved (can't use a CC) and the fact that it seemed we were being instructed, with precise timing, by AirBnB from legitimate AirBnB e-mail addresses. The money was never supposed to be paid, but rather held in escrow by Air B n B...

Remember, not everyone has used the site or service before.

And guys - do you really think I'm sending money into outer space for no reason?

Are you really somehow blaming me (or my wife, actually) for thinking, among other things, that:

1) e-mails from legitimate Air B n B e-mails timed perfectly with "host" communication are real instructions, given a reputable-seeming vendor with feedback (4 positives, a "verified" ID + profile etc...)

2) a bank account cannot be opened with Air B n B in the name in the U.K where there are some of the tightest financial regulations in the world when the account opener is associated with Air B n B. This about that interaction for a second and how ridiculous it would be...

"I want to open a bank account in the name "xxx Air B n B"

"Why do you want to have Air B n B in the name?"

"Uh..."

3) if such a bank account was opened once, or twice Barclays would put a stop to it after Air B n B has told them to from the top of their legal department? (and yes, this has happened - for a long time).

Don't be so sure I'm so stupid and you would have seen it coming a mile away...

I did not fall for it, so to speak. My wife did.

However, having reviewed the entire process, I'm quite confident I would have done exactly as she did. I'm being honest with myself.

Perhaps this is clear or not, I don't know - the actual e-mail addresses are REAL e-mail addresses Air BnB uses... they aren't like "Joe@AirBnB.com" - they are (and there are several of them) the exact same ones you would receive a legitimate e-mail from on Air B n B. Not a knock-off.

I don't know how to check the source of an e-mail. What do you mean exactly with that? What kind of alert would have gone off here to say it wasn't actually from Air B n B? I don't know if my wife ignored something like this or not but would like to know for sure.

I'd be curious to know exactly how you would open said bank account?

Have you ever opened a corporate bank account?

Do you know what kind of documentation they ask for in less-regulated places?

I happen to be all-too familiar with KYC regulations in the U.K through dealing with Skrill, and with corporate bank account opening as I've dealt with both extensively in the last year.

Cliffs: It's not that easy to do legitimately, much less illegitimately with a well-known international brand in the name. But I'd welcome your ideas on how to do it so easily.

I don't know anything about that. By 'seems readily done' I'm just referring to Barclays allowing it to happen for several years.

The main issue is not wiring five figures off-site to banking details given in an email, I'm surprised you'd have taken that action looking back. I'm confident a low % of people would fall for that.

+1

As I pointed out earlier, anyone can use any basic e-mail software to set the "sender" field to whatever address they choose. It's not a sophisticated spoof and doesn't require the sender to have any access to the address they claim to be sending from. If you respond, you'll respond to the real airbnb and the scam will likely be uncovered, but they're banking on you just sending them money rather than communicating via e-mail.

If someone sends you an e-mail claiming to be from an airbnb.com address and the actual source (e-mail server) isn't the real airbnb server, gmail and other decent e-mail services will give you a message like this: