52

I'm in the process of setting up a long-term lease agreement for an apartment in my hometown with a landlord which lives abroad. The landlord suggested to use a middleman called HomeAway so that the landlord would not have to travel to my country for exchange of keys, legal documents and the security deposit, to which I've agreed. In our case, the landlord has sent the keys and legal documents to HomeAway, which will keep them until we have transferred the security deposit to HomeAway.

HomeAway has sent me instructions for the bank transfer and I'm not sure what to make of it. Their correspondence looks too fishy for what I would expect from a company dealing with these sums of money but it also looks too good, at least for the average scammer. Here are the things that surprised me:

  • The standardised text for the instructions has a few typographical errors.
  • They mention in multiple places that the transfer has to happen within 48 hours, which is impossible considering that I got the instructions on a Friday and my bank won't process the transfer until Monday morning.
  • Emails from them are sent from a different domain (homeaway-eu.com) than where their website is (homeaway.com).
  • The destination account is registered to a private person in Milan, without any mention of HomeAway.

I'm not sure what to make of this. Should I be cautious? Has anyone had a similar experience with HomeAway and how did it play out?

90

Just looking at the domain name:

  • homeaway-eu.com - registered in 2018
    • registrar: NAMECHEAP INC
    • registered by: information hidden
    • email account hosted by: privateemail.com (which is a product of NameCheap domain registrar, essentially it's a 1 minute job to create an email account there)

Whereas:

  • homeaway.com - registered in 1998
    • registrar: MarkMonitor, Inc.
    • registered by: HomeAway.com, Inc.
  • there is even a homeaway.eu - registered in 2006
    • registrar: MarkMonitor International Limited
    • registered by: Vacation Villas International GmbH
    • no email accounts

A legitimate website normally creates a subdomain (i.e. eu.homeaway.com), or they use homeaway.com for emails but add a slash in their website (i.e. homeaway.com/eu), or lastly might buy a different domain name still preserving the name (i.e. homeaway.eu - though I don't know whether this is an official one). In this case, having a domain like "homeaway-eu.com" and using a different registrar seems fishy.

I would get in contact with the real homeaway.com by either an email or phone number on their website to confirm any details before transferring money. Otherwise, I would simply say ABORT.

EDIT: Also, by looking at the SSL certificate of homeaway.com, these are the official domains allowed to be used with that certificate:

abritel.fr
aluguetemporada.com.br
bedandbreakfast.com
clearstay.com
escapia.com
fewo-direkt.de (and luxus.fewo-direkt.de)
homeaway.at
homeaway.ca (and fr.homeaway.ca)
homeaway.co.nz (and www.homeaway.co.nz)
homeaway.co.uk (and luxury.homeaway.co.uk)
homeaway.com (and www.homeaway.com; investors.homeaway.com; professionalreferral.homeaway.com; software.homeaway.com; tech.homeaway.com)
homeaway.com.ar
homeaway.com.au
homeaway.com.co
homeaway.com.mx
homeaway.de (and www.homeaway.de)
homeaway.dk
homeaway.es
homeaway.fi
homeaway.fr (and www.homeaway.fr)
homeaway.gr
homeaway.ie
homeaway.it
homeaway.jp (and www.homeaway.jp)
homeaway.lk (and www.homeaway.lk)
homeaway.mx
homeaway.nl
homeaway.no
homeaway.pl
homeaway.pt
homeaway.se
homeaway.sg (and www.homeaway.sg)
homelidays.com
homelidays.es
homelidays.fr
homelidays.it
ownersdirect.co.uk
stayz.com (and www.stayz.com)
stayz.com.au
travelmob.com (and www.travelmob.com; au.travelmob.com; de.travelmob.com; es.travelmob.com; fr.travelmob.com; it.travelmob.com; uk.travelmob.com)
vacationrentals.com
vrbo.com (and traveler.vrbo.com)
www.homeaway.co.id
www.homeaway.co.in
www.homeaway.co.kr
www.homeaway.co.th
www.homeaway.com.cn
www.homeaway.com.my
www.homeaway.com.ph
www.homeaway.com.sg
www.homeaway.com.vn
www.homeaway.hk
www.homeaway.tw
  • 4
    I've also noticed privateemail.com in the Received: headers in the emails I got! :'D I will contact HomeAway directly through their site at homeaway.com (they offer calling and web-chat). – Feuermurmel Jun 1 at 16:24
  • 34
    Get in touch with the real HomeAway and inform them of the scam so they can take legal action. – chrylis -on strike- Jun 2 at 3:24
  • 7
    Vacation Villas International GmbH does appear to be part of HomeAway -- use the flag on their site to change from German to UK or US – Andrew Leach Jun 2 at 11:58
  • 6
    @Snow essentially redirection doesn't mean HomeAway took action and acquired the domain. It's actually something the scammer will do as it's a 2 second job compared to creating a functioning website. Always check who owns the domain and compare the DNS records between the legit and fake domains, you'll see a difference. – kiradotee Jun 3 at 11:09
  • 8
    In essence the redirect is part of the scam, it makes users think they're getting to the real website because they are getting to the real website. The scammer is not hoping to actually scam you via their website, they don't even want or need a website except as a way to further build confidence in their mark. What they want is for you to type their URL in, see the real website, and go "oh ok, this is real." They probably even have the fake property listed on the real site under a fake account. – dwizum Jun 3 at 18:04
64

This is a scam. There are several red flags. With one of them, I'd be highly suspicious. With the trifecta, it's definitely a scam.

  • Using a slightly different domain name which is one of many possible variations on the company's main domain name. Sometimes it's the same name with a different toplevel name (e.g. company.com and company.eu), but those are often legitimate. Often it adds something to the company name, e.g. here company-eu.com vs company.com.
    Note that having the suspicious domain redirect to the legitimate domain when you browse it on the web doesn't prove anything. The scammer can do that. If the site is HTTPS and the certificate contains both domains, then it's probably legitimate, but beware that it can be difficult to tell as a layman — there are many loopholes that scammers can exploit.
  • Using a payment method that cannot be reversed such as a bank transfer. As far as I can tell (I've never used that service), HomeAway acts as a middleman and accepts credit card payments. Credit cards are no good for scammers because you can cancel a payment. With a bank transfer, when it's done, it's done.
  • Requiring a fast payment. Obviously a legitimate payment will have a deadline, but it'll typically be a fixed number of days before the rental starts. The scammer wants you to pay now and not take the time to think about it. A legitimate business partner also wants you to commit, but it's more important from the scammer, because if you hesitate with renting a property, you remain in the market for renting a property, whereas if you hesitate with falling for a scam, you might realize it's a scam.
  • A destination account whose name and location doesn't match the company.
  • Scams often have poor grammar and spelling. Supposedly that's to be psychologically aligned with people who are more likely to fall for the scam.

Note that this is not a problem with HomeAway. The scammer is impersonating HomeAway.

You may report the scam to HomeAway. Realistically, there isn't much they can do, other than put up a warning about scams on their web page. They may be able to shut down that particular domain, but a domain is extremely cheap. Shutting down a scammer usually requires tracking them through multiple jurisdictions and is hard.

  • 15
    Thank you for your detailed response. I've contacted HomeAway's support and told them the story. We came to the conclusion that this is definitely a scam. We agreed that their security team will contact me and that I will forward them the emails and documents. – Feuermurmel Jun 2 at 15:52
  • 3
    And thanks for the tip that legitimate services usually accept credit cards (or a service with similar protection). If I find myself in a similar situation in the future, I will flat out deny any other form of payment. – Feuermurmel Jun 2 at 15:56
  • 2
    @gerrit Sure. My answer is primarily in the context of short-term housing booked via a third-party platform. For long-term housing, for example, landlords rarely take credit card payments. – Gilles Jun 2 at 22:03
  • 4
    It's also worth noting that HomeAway does not hold keys or distribute them for landlords. They even have a community page that lists ways landlords can get keys to renters (which doesn't include "send them to us and we'll send them to your customer): community.homeaway.com/docs/DOC-1329 – dwizum Jun 3 at 17:58
  • 2
    @Acccumulation a 99% chargeback rate will very quickly result in the loss of ability to accept credit cards, so given the effort needed to set that up, it would hardly be worth it. – briantist Jun 3 at 18:56
47

This situation has a couple strong parallels to common housing scams.

Rental scam #1 – the cloned listing

This is one of the most popular Craigslist rental scams, perhaps because it’s so cheap to execute.

The scammer copies and pastes information from a legitimate rental ad, and then offers a price that’s literally “too good to be true.”

If you respond to the fake ad, the scammer may invite you to drive by the property to view the exterior. What they will not do is give you a tour of the interior. That’s because they are “on vacation” or otherwise unavailable to show the place.

I found many "out of town" landlords when I was apartment hunting recently, and while I don't know for sure whether they were fraudulent (I steered clear), I would be highly suspicious of agreeing to such an arrangement without being able to physically tour the apartment.

  • 4
    They can even go further and show a craigslist ad for an airbnb property, and then rent the property for a day to show it: cbc.ca/news/canada/british-columbia/… – Jim W Jun 3 at 23:01
  • And even if they do have the property, they may still try to scam you. They just rent it out to several people in parallel... – jwenting Jun 4 at 5:11
  • And yet another scam is for people to offer to look after the house of someone who goes on a long foreign trip (e.g. expats) and then rent out the house, sometimes going so far as to change the locks to the real owners can't get back into their own property when they return. – jwenting Jun 4 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.