52

I'm in the process of setting up a long-term lease agreement for an apartment in my hometown with a landlord which lives abroad. The landlord suggested to use a middleman called HomeAway so that the landlord would not have to travel to my country for exchange of keys, legal documents and the security deposit, to which I've agreed. In our case, the landlord has sent the keys and legal documents to HomeAway, which will keep them until we have transferred the security deposit to HomeAway.

HomeAway has sent me instructions for the bank transfer and I'm not sure what to make of it. Their correspondence looks too fishy for what I would expect from a company dealing with these sums of money but it also looks too good, at least for the average scammer. Here are the things that surprised me:

  • The standardised text for the instructions has a few typographical errors.
  • They mention in multiple places that the transfer has to happen within 48 hours, which is impossible considering that I got the instructions on a Friday and my bank won't process the transfer until Monday morning.
  • Emails from them are sent from a different domain (homeaway-eu.com) than where their website is (homeaway.com).
  • The destination account is registered to a private person in Milan, without any mention of HomeAway.

I'm not sure what to make of this. Should I be cautious? Has anyone had a similar experience with HomeAway and how did it play out?

Improve this question
3
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – JoErNanO ♦
    Commented Jun 5, 2019 at 12:39
  • This happened to me very recently. We payed 1,300 euro before realizing. Fuck these people >:,(
    – Mia
    Commented Jul 8, 2020 at 9:03
  • @Mia You have my sympathy. :'/ Those people suck.
    – Feuermurmel
    Commented Jul 8, 2020 at 12:48

3 Answers 3

Reset to default
92

Just looking at the domain name:

  • homeaway-eu.com - registered in 2018
    • registrar: NAMECHEAP INC
    • registered by: information hidden
    • email account hosted by: privateemail.com (which is a product of NameCheap domain registrar, essentially it's a 1 minute job to create an email account there)

Whereas:

  • homeaway.com - registered in 1998
    • registrar: MarkMonitor, Inc.
    • registered by: HomeAway.com, Inc.
  • there is even a homeaway.eu - registered in 2006
    • registrar: MarkMonitor International Limited
    • registered by: Vacation Villas International GmbH
    • no email accounts

A legitimate website normally creates a subdomain (i.e. eu.homeaway.com), or they use homeaway.com for emails but add a slash in their website (i.e. homeaway.com/eu), or lastly might buy a different domain name still preserving the name (i.e. homeaway.eu - though I don't know whether this is an official one). In this case, having a domain like "homeaway-eu.com" and using a different registrar seems fishy.

I would get in contact with the real homeaway.com by either an email or phone number on their website to confirm any details before transferring money. Otherwise, I would simply say ABORT.

EDIT: Also, by looking at the SSL certificate of homeaway.com, these are the official domains allowed to be used with that certificate:

abritel.fr
aluguetemporada.com.br
bedandbreakfast.com
clearstay.com
escapia.com
fewo-direkt.de (and luxus.fewo-direkt.de)
homeaway.at
homeaway.ca (and fr.homeaway.ca)
homeaway.co.nz (and www.homeaway.co.nz)
homeaway.co.uk (and luxury.homeaway.co.uk)
homeaway.com (and www.homeaway.com; investors.homeaway.com; professionalreferral.homeaway.com; software.homeaway.com; tech.homeaway.com)
homeaway.com.ar
homeaway.com.au
homeaway.com.co
homeaway.com.mx
homeaway.de (and www.homeaway.de)
homeaway.dk
homeaway.es
homeaway.fi
homeaway.fr (and www.homeaway.fr)
homeaway.gr
homeaway.ie
homeaway.it
homeaway.jp (and www.homeaway.jp)
homeaway.lk (and www.homeaway.lk)
homeaway.mx
homeaway.nl
homeaway.no
homeaway.pl
homeaway.pt
homeaway.se
homeaway.sg (and www.homeaway.sg)
homelidays.com
homelidays.es
homelidays.fr
homelidays.it
ownersdirect.co.uk
stayz.com (and www.stayz.com)
stayz.com.au
travelmob.com (and www.travelmob.com; au.travelmob.com; de.travelmob.com; es.travelmob.com; fr.travelmob.com; it.travelmob.com; uk.travelmob.com)
vacationrentals.com
vrbo.com (and traveler.vrbo.com)
www.homeaway.co.id
www.homeaway.co.in
www.homeaway.co.kr
www.homeaway.co.th
www.homeaway.com.cn
www.homeaway.com.my
www.homeaway.com.ph
www.homeaway.com.sg
www.homeaway.com.vn
www.homeaway.hk
www.homeaway.tw
Improve this answer
11
  • 5
    I've also noticed privateemail.com in the Received: headers in the emails I got! :'D I will contact HomeAway directly through their site at homeaway.com (they offer calling and web-chat).
    – Feuermurmel
    Commented Jun 1, 2019 at 16:24
  • 36
    Get in touch with the real HomeAway and inform them of the scam so they can take legal action.
    – chrylis -cautiouslyoptimistic-
    Commented Jun 2, 2019 at 3:24
  • 7
    Vacation Villas International GmbH does appear to be part of HomeAway -- use the flag on their site to change from German to UK or US
    – Andrew Leach
    Commented Jun 2, 2019 at 11:58
  • 6
    @Snow essentially redirection doesn't mean HomeAway took action and acquired the domain. It's actually something the scammer will do as it's a 2 second job compared to creating a functioning website. Always check who owns the domain and compare the DNS records between the legit and fake domains, you'll see a difference.
    – kiradotee
    Commented Jun 3, 2019 at 11:09
  • 8
    In essence the redirect is part of the scam, it makes users think they're getting to the real website because they are getting to the real website. The scammer is not hoping to actually scam you via their website, they don't even want or need a website except as a way to further build confidence in their mark. What they want is for you to type their URL in, see the real website, and go "oh ok, this is real." They probably even have the fake property listed on the real site under a fake account.
    – dwizum
    Commented Jun 3, 2019 at 18:04
65
+500

This is a scam. There are several red flags. With one of them, I'd be highly suspicious. With the trifecta, it's definitely a scam.

  • Using a slightly different domain name which is one of many possible variations on the company's main domain name. Sometimes it's the same name with a different toplevel name (e.g. company.com and company.eu), but those are often legitimate. Often it adds something to the company name, e.g. here company-eu.com vs company.com.
    Note that having the suspicious domain redirect to the legitimate domain when you browse it on the web doesn't prove anything. The scammer can do that. If the site is HTTPS and the certificate contains both domains, then it's probably legitimate, but beware that it can be difficult to tell as a layman — there are many loopholes that scammers can exploit.
  • Using a payment method that cannot be reversed such as a bank transfer. As far as I can tell (I've never used that service), HomeAway acts as a middleman and accepts credit card payments. Credit cards are no good for scammers because you can cancel a payment. With a bank transfer, when it's done, it's done.
  • Requiring a fast payment. Obviously a legitimate payment will have a deadline, but it'll typically be a fixed number of days before the rental starts. The scammer wants you to pay now and not take the time to think about it. A legitimate business partner also wants you to commit, but it's more important from the scammer, because if you hesitate with renting a property, you remain in the market for renting a property, whereas if you hesitate with falling for a scam, you might realize it's a scam.
  • A destination account whose name and location doesn't match the company.
  • Scams often have poor grammar and spelling. Supposedly that's to be psychologically aligned with people who are more likely to fall for the scam.

Note that this is not a problem with HomeAway. The scammer is impersonating HomeAway.

You may report the scam to HomeAway. Realistically, there isn't much they can do, other than put up a warning about scams on their web page. They may be able to shut down that particular domain, but a domain is extremely cheap. Shutting down a scammer usually requires tracking them through multiple jurisdictions and is hard.

Improve this answer
8
  • 16
    Thank you for your detailed response. I've contacted HomeAway's support and told them the story. We came to the conclusion that this is definitely a scam. We agreed that their security team will contact me and that I will forward them the emails and documents.
    – Feuermurmel
    Commented Jun 2, 2019 at 15:52
  • 3
    And thanks for the tip that legitimate services usually accept credit cards (or a service with similar protection). If I find myself in a similar situation in the future, I will flat out deny any other form of payment.
    – Feuermurmel
    Commented Jun 2, 2019 at 15:56
  • 2
    @gerrit Sure. My answer is primarily in the context of short-term housing booked via a third-party platform. For long-term housing, for example, landlords rarely take credit card payments.
    – Gilles 'SO- stop being evil'
    Commented Jun 2, 2019 at 22:03
  • 4
    It's also worth noting that HomeAway does not hold keys or distribute them for landlords. They even have a community page that lists ways landlords can get keys to renters (which doesn't include "send them to us and we'll send them to your customer): community.homeaway.com/docs/DOC-1329
    – dwizum
    Commented Jun 3, 2019 at 17:58
  • 2
    @Acccumulation a 99% chargeback rate will very quickly result in the loss of ability to accept credit cards, so given the effort needed to set that up, it would hardly be worth it.
    – briantist
    Commented Jun 3, 2019 at 18:56
46

This situation has a couple strong parallels to common housing scams.

Rental scam #1 – the cloned listing

This is one of the most popular Craigslist rental scams, perhaps because it’s so cheap to execute.

The scammer copies and pastes information from a legitimate rental ad, and then offers a price that’s literally “too good to be true.”

If you respond to the fake ad, the scammer may invite you to drive by the property to view the exterior. What they will not do is give you a tour of the interior. That’s because they are “on vacation” or otherwise unavailable to show the place.

I found many "out of town" landlords when I was apartment hunting recently, and while I don't know for sure whether they were fraudulent (I steered clear), I would be highly suspicious of agreeing to such an arrangement without being able to physically tour the apartment.

Improve this answer
3
  • 4
    They can even go further and show a craigslist ad for an airbnb property, and then rent the property for a day to show it: cbc.ca/news/canada/british-columbia/…
    – Jim W
    Commented Jun 3, 2019 at 23:01
  • And even if they do have the property, they may still try to scam you. They just rent it out to several people in parallel...
    – jwenting
    Commented Jun 4, 2019 at 5:11
  • And yet another scam is for people to offer to look after the house of someone who goes on a long foreign trip (e.g. expats) and then rent out the house, sometimes going so far as to change the locks to the real owners can't get back into their own property when they return.
    – jwenting
    Commented Jun 4, 2019 at 5:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .