Scammers Use Old Logins to Make Fraudulent Airbnb Rentals on Your Account

Renting out your home might be the key to making big money, especially if you live in a sought-after location. While in the past you might have had to hire a property management company among other hurdles, technology has made it easier to take advantage of this opportunity. Companies, like Airbnb, let you post a listing for your home or property online, and people can rent the use of it at prices you determine and dates that fit your schedule. It might be your beautiful beach house in an exotic tropical location or just the spare bedroom in your house or apartment – some users have even posted their lawn space for camping.

While apps and technology make it easier to list and more affordable to rent properties, there is a downside. Criminals have flooded this innovative market place with scams. Scammers have used Airbnb to conduct rental scams, posting properties for rent they never managed. Now users are reporting fraudulent activity has taken place in the Airbnb platform. Account owners have noticed reservations being booked for non-refundable rentals that the users did not make themselves. Some have had their cards charged and money removed from PayPal accounts.

According to Airbnb, the platform has not been attacked or breached. In a statement from Airbnb they called these fraudulent charges “isolated incidents.” Airbnb’s investigation shows that these accounts were logged into with accurate login credentials and then the accounts were used to rent accommodations, charging the victims’ payment methods.

In short, that means someone got a hold of the victims’ login credentials. It’s quite likely that the information was gleaned from a previous data breach of a different company. This practice, known as credential stuffing, means if a users’ login information was breached in a previous attack their accounts using the same login are also in jeopardy. The Yahoo email breach, for example, would give criminals access to every single account you own if you are reusing that compromised username and password combination on other accounts.

While the damage appears to be rather limited, it is a good idea to change your Airbnb account password, even if you were not affected by these fraudulent charges. Monitoring your accounts regularly will also help you recognize suspicious activity as soon as it occurs.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read more: First American Financial Breach Exposes Millions of Complete Identities