Rental phishing sites use live chat to win over hesitant travelers
Holiday travelers looking for a place to stay are landing on copies of popular rental platforms, complete with host names, ratings and reviews, that ask for their passwords, personal details and credit card numbers.
The sites, spotted and taken down by Fortra’s Intelligence and Research Experts (FIRE) team, rely on familiar branding, copied property listings and reservation details, along with urgent messages meant to rush visitors into acting.
A phishing page imitating a rental marketplace (Source: Fortra)
The timing is deliberate, since “cybercriminals know that travelers are more likely to click quickly as a trip approaches,” Fortra’s Elyse Neumann wrote in a blog post on the findings.
Pressure that comes with a deadline
Travel bookings tend to involve high prices, tight deadlines and limited availability, and the fake sites play on that urgency. Visitors are told their reservation is unconfirmed, their payment has not been processed or their booking will be canceled. Other prompts urge them to complete verification to continue, or dangle special pricing for a limited time.
These warnings “may push travelers to click before checking the website address or confirming the reservation through an official channel,” Neumann cautioned.
A login page with familiar sign-in options
One phishing site impersonated a global experiences and lodging platform, using a lookalike address (confirm-[redacted].rooms-home93914[.]space) and imagery matching the brand. The sign-up prompt asked for contact details and social media credentials.
“This type of page can be used to collect account information, phone numbers, or login credentials. If travelers reuse passwords across services, information submitted to a fake booking site could also put other accounts at risk,” Neumann explained.
Her advice is to steer clear of entering credentials after following an unsolicited link, “even if the page includes recognizable logos or familiar buttons.”
Listings built to blend in
Attackers copy photos and descriptions from legitimate properties, so judging a site by its looks gets hard. “A polished listing does not prove that the property exists or that the booking platform is genuine,” she wrote.
According to Neumann, FIRE is “increasingly seeing attacks that prey on the urgency of booking a stay via popular short-term lodging marketplaces.” In the cases it examined, the phishing pages showed listings with locations, travel dates and prices. One page displayed an apartment and a house side by side, and “nothing about the listings appeared obviously suspicious.”
Travelers comparing several properties tend to focus on price, availability and the look of the place, without stopping to ask whether the site itself is legitimate. Mimicking the familiar details of a trusted rental marketplace lets attackers keep the copycat site believable long enough to steer visitors toward verification or payment.
Unconfirmed reservations as bait for personal data
In another case, the booking flow led to a “confirm and pay” screen marking the reservation as “Unconfirmed.” Visitors were told to complete a mandatory verification process before the booking could go ahead and were assured it would cost nothing extra. The page then asked for the traveler’s name, email address, country and phone number.
Those requests may seem harmless. Neumann warns, however, that information submitted to a fraudulent site “can be used for identity theft, follow-on phishing, or account takeover.”
A support chat that vouches for the card form
A separate booking page displayed a credit card payment form and paired it with a live support chat. The chat responded directly to the visitor’s concerns and presented the card request as a routine security check.
The reassurance that the card would not be charged was there to lower the visitor’s guard. It’s a move that “reduced hesitation and encouraged the submission of payment information,” she noted.
“The safest approach is to pause before completing a booking. A convincing property listing can be copied, but the official website address is much harder for a scammer to imitate,” concluded Neumann.
