The world of vacation rentals is a multi-billion dollar industry. People across the globe are looking that perfect getaway, from Europe to the Connecticut shoreline, and they have easy access to tens of thousands of properties on line.
VRBO/HomeAway is the world's largest online marketplace for vacation rentals, generating nearly $350 million in revenue last year. Property owners pay a small annual fee to list their home on the user-friendly platform.
Dr. Bart Muhs rents out his cottage on Hawk's Nest Beach in Old Lyme every summer.
"We use VRBO and Homeaway, exclusively," said the Guilford resident.
Last year, Carrie and Will Creech used the site to search for a place to hold their annual family reunion, and
thought they had found the perfect spot out on Cape Cod.
"It was 3 cabins on the lake that we would have private access to," says Creech.
Carrie reached out to the owner through HomeAway's email portal with questions about whether linens were included and about fans because they didn't have central air. She heard back the next morning and was surprised by what she read.
"They offered us a four to five-hundred dollar discount if we signed up now and paid in advance, but they hadn't answered my questions about the linens and fans," said Creech.
Another email garnered the same response, so her husband, Will, gave it a try. They sent back a different, larger discount, but same kind of an email without reference to their questions.
"That's when I started to be a little suspicious," says Creech.
They were right to be; the Creeches had been phished.
According to Gary Davis, Vice President of Consumer Marketing for internet security giant McAfee, phishing continues to be one of the more pervasive threats in the security space today. He says vacation rental market is a frequent target for phishing scams because of the large sums of money at play.
"VRBO acknowledges that they had more than 3,000 successful scams over the course of the past year. What we don't know is the total number that was attempted," Davis said.
Bart Muhs says he has never had a problem with HomeAway, but his Old Lyme neighbor hasn't been so lucky.
The owner of the beach house tells the Troubleshooters, the HomeAway email portal for his property was hacked three times in a matter of days. He had no idea until one of the renters called him to say he'd wired $2,000. That's' when he knew he'd been hacked and says HomeAway denied all responsibility. While HomeAway did not address this specific situation, in a statement it said "HomeAway evaluates all incidences of phishing or fraud to help provide restitution."
Facebook has a usergroup called "Victims of HomeAway/VRBO", but it's closed to members only. The Creeches joined.
"Some of the these people, in order to get their money back, have signed non-disclosures with HomeAway,' said Carrie Creech.
HomeAway acknowledges that the company sometimes creates settlement agreements, which include non-disclosures to protect both parties.
The Creeches say the suspicious emails they received all had one common quirk.
"They never sign their names, then it always said 'regards,' no name," said Carrie.
To protect yourself, Gary Davis says you should talk directly to the property owner, never conduct the entire transaction over email, and try to find properties that take credit cards or Paypal, so your money is protected.
The Creeches noticed the couple that owns the Cape cabins had listed their phone number on HomeAway. When they called, the couple had no idea who they were and said they had never received an email from them. Still, Carrie and Will ended up renting the three cabins last summer, but were a virtual mouse click away from getting scammed out of their vacation fund.
"If they had just answered those 2 questions, I probably would have done the wire transfer," Will Creech said.
HomeAway does provide some warnings after a prospective renter has made initial email contact with an owner, but Carrie Creech doesn't think it's enough.
"I will still use your service, just admit there are untrustworthy people in this world and they'll take advantage," said Creech.
Carrie Creech wrote to the Attorneys General in both Connecticut and Massachusetts. The Attorney General's office in Hartford confirms they have received about half a dozen complaints about VRBO/HomeAway, including from one customer who received a settlement from the company.
HomeAway is taking action to protect customers. In December, the company launched a secure communication system that hides both the renter and owner's email addresses. HomeAway also offers insurance, guaranteeing up to $1,000 for no charge and up to $10,000 for a $39 fee, as long as you pay by what the company calls a "safe method," which is credit card or Paypal.
