Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Vacation Rental Property Scam

Published: 2006-08-17
Last Updated: 2006-08-17 14:26:52 UTC
by Chris Carboni (Version: 1)
0 comment(s)
From the mailbag


Dear ISC,

I run a vacation rental business whereby I represent approximately 600 vacation homes.  We are often subject to phishing scams where the perpetrator appears to be a legitimate renter and does a last minute booking.  Sometimes they claim to be making reservations for a friend as a gift or they are a bunch of doctors traveling to a convention and any property we pick for them would be wonderful, etc, etc.  The story usually goes that the car rental company won't take credit cards so could we please charge $200 extra to the card and add $100 for our trouble and could we please send the car rental payment to the company directly.  Then, something happens and they don't need the car rental so could we please just send them a return check for the money, and please take another $50 out for our trouble.  The idea, obviously, is that the charge fails or gets contested, but we've sent them a legitimate check that can be cashed and not recovered.

Yesterday, I discovered a new one, and was alerted to this by a legitimate renter who found a listing of the property that they wanted to rent from my firm on a different website, only the pictures didn't match.  What the bad guys had done was spliced together several pieces of copyrwritten material along with several pictures from several different ads and had taken out their own false ad that I assume they paid for.  I purposely tried to flush them out, and contacted them to rent *their* property.  The response I got back from <email address deleted> had no answers to any questions that I asked, and they urged me to send a check for the deposit immediately and they would courier the keys to my address.  This is obviously a ruse since noone in the industry conducts business this way.  I tried to coerce them into releasing something other than their bogus yahoo mail account such as a phone number or mailing address, but they wouldn't.  I suspect they will disappear as soon as I report the ad as being fraudulent.

I don't know if this story is relevant to your audience, but this is the first time I've seen the bad guys trying to bilk larger sums of money out of legitimate renters instead of them trying to mess with the agencies.  Obviously, this causes much damage to my business since renters aren't sure who they can trust since anyone can seemingly take an ad out for anything.  I think it behooves these advertising companies to do a little more due diligence to verify the accuracy of the information they are displaying rather than just slapping up anything for anybody who has some cash.



Keywords:
0 comment(s)
Diary Archives