Rental and Holiday Booking Scams Guide: Avoid Fake Listings and Deposit Fraud

A rental or holiday booking scam is a fraud in which a criminal advertises a home, flat or holiday stay they have no right to let, or hijacks a genuine booking, and takes a deposit, rent or payment for accommodation that will never be provided. The listing often copies real photos, the price is attractive, and the criminal pushes for payment by bank transfer, gift card or cryptocurrency, or moves the conversation off the booking platform where its protections stop. A newer variant targets hotels and holiday lets themselves: staff are phished, and the criminal then uses the property's own booking account or messaging channel to ask guests to "confirm" card details. This guide explains how each variant works, the checks that expose them, and what renters, travellers and the organisations that support them should do. It is written for consumers, for fraud and customer protection teams at banks and letting platforms, and for hospitality businesses.

Key takeaways

• The payment method is the clearest warning sign. The US Federal Trade Commission says requests for wire transfers, gift cards or cryptocurrency are red flags because they work like cash and the money usually cannot be recovered.
• Leaving the platform removes its protection. Airbnb, for example, prohibits hosts from moving bookings or messages off the platform before booking and says guests who pay off-platform lose its AirCover protection; most booking platforms have similar rules.
• A genuine channel can carry a fake message. Microsoft reported a 2024 to 2025 campaign that phished hospitality staff with fake Booking.com emails to install credential-stealing malware, so a request sent through a real property account is not proof it is genuine.
• Verify the property and the person separately. Search the address for duplicate adverts, check ownership or agency records, view in person or by a live video call you control, and get a written contract before any deposit.
• Report fast, and pay in ways that can be reversed. Figures from Report Fraud (which replaced Action Fraud on 4 December 2025) show 6,066 holiday fraud reports and £11,183,957 in losses in 2024; paying by credit card and reporting immediately to the bank give the best chance of recovery.

What it is

Rental and holiday booking scams are a form of advance-fee and impersonation fraud. The victim pays first for something that does not exist or is not the criminal's to offer. They fall into four main patterns:

Online marketplace scams overlap with the first two patterns; see the Online Marketplace Buying and Selling Safely Guide for the general marketplace rules this guide builds on.

How it works

Fake and copied listings

The FTC describes scammers copying photos and descriptions from genuine adverts and replacing the contact details, or advertising homes that are actually for sale rather than for rent. Warning signs it lists include rent far below local prices, impressive amenities, an owner who is always out of the country, and pressure to decide quickly. Self-guided tours can also be faked, so physical access to a property does not prove the person controls it. The criminal often asks for an application fee and personal data at the same time, which the FTC notes can then be used for identity theft. A landlord does not need a US Social Security number or credit score before you agree to rent, and requests for credit score screenshots can be a way to push victims into paid monitoring services.

Off-platform payment

Booking platforms protect payments made through their own checkout, and criminals work hard to move victims away from it. Airbnb's policy, for instance, prohibits hosts from asking guests to book or message outside the platform before booking, requires mandatory charges to appear in the checkout price breakdown, and warns that a request to pay by wire or bank transfer may indicate a fraudulent reservation. It also screens messages on the platform and blocks those that appear to contain contact details or external links, which is exactly why scammers ask to continue on WhatsApp or email. Hotels on that platform are an exception for disclosed deposits and fees, a detail criminals can exploit to make an off-platform request look normal.

Compromised property accounts and guest phishing

Microsoft Threat Intelligence reported in March 2025 that a group it tracks as Storm-1865 had, since December 2024, sent emails impersonating Booking.com to staff at hospitality organisations across North America, Europe, Oceania and Asia. Lures included negative guest reviews, guest enquiries and account verification requests, leading to a fake CAPTCHA page that tricked the user into running a command (a technique known as ClickFix). The payload included credential stealers and remote access tools such as Lumma Stealer, XWorm and AsyncRAT, used to steal financial data and credentials and leading to payment data theft and fraudulent charges. Once a property's account credentials are stolen, messages to guests can come from the genuine property profile, which defeats the usual advice to "check the sender". For hospitality businesses this is an identity and endpoint problem, covered further in the Account Takeover Prevention Guide.

Fake travel companies

The UK Civil Aviation Authority's ATOL scheme warned in February 2025 that fraudsters have used ATOL, ABTA and ABTOT branding to create false reassurance, and that more than half of UK holiday fraud reports in 2024 mentioned social media platforms. A logo on a website is not evidence of membership: check the scheme's own register.

Why it matters

For victims, the loss is often a deposit they cannot afford plus the cost of finding somewhere else to live or stay at short notice. National fraud reporting figures published by ATOL show 6,066 holiday fraud reports in 2024, with losses of £11,183,957 (down from £12.3 million in 2023), an average loss of £1,844 per victim, and July the peak month with 647 reports. Rental fraud also feeds identity fraud when application forms collect passport scans, payslips and bank statements.

For organisations the issue is shared:

• Banks and payment providers: deposits are usually authorised push payments, so these cases sit in APP fraud reimbursement and monitoring. In the UK, the Payment Systems Regulator's reimbursement requirement covers Faster Payments and CHAPS transfers between UK accounts, splits the cost 50:50 between sending and receiving firms, and expects most victims to be reimbursed within five business days, which gives receiving banks a direct incentive to spot mule accounts collecting rental deposits. See the Authorised Push Payment (APP) Fraud Guide.
• Letting and booking platforms: fake listings and off-platform requests are a trust and safety problem that needs listing verification, message screening and fast takedown. See the Fake Account Creation and Sign-up Fraud Guide.
• Hotels and holiday let operators: staff mailboxes and extranet logins are targets; Microsoft recommends phishing-resistant authentication with MFA enforced on all accounts and no exclusions, link rechecking at click time, and training staff to verify senders and contact providers directly. See the Phishing-Resistant MFA Guide.

Common misconceptions

• "It was on a well-known site, so it must be real." Listings are posted by users. The FTC advises checking whether the property appears on the rental company's own website and searching the owner's name with words like "scam" or "complaint".
• "The message came through the booking app, so it is safe." Compromised property accounts mean a genuine channel can carry a criminal request. Platforms take payment at checkout; a later chat message asking you to re-enter card details through a link is a red flag.
• "I saw the inside of the flat, so the landlord is genuine." Self-guided tours can be faked, and short-term lets can be re-advertised by someone who stayed there.
• "A bank transfer is fine if I have the landlord's name." Transfers are hard to reverse. Name-checking services help confirm the account holder, but a criminal can open an account in any name they control. The ATOL alert advises avoiding bank transfer where possible and paying by credit card for added protection under consumer credit law.
• "Scammers only target first-time renters." Holiday fraud peaks in summer, and the national reporting figures show losses spread across ordinary holidaymakers booking through social media and cloned sites.
• "It is too late to do anything once I have paid." Banks can sometimes stop or recall payments made minutes or hours earlier, and reports help platforms remove the listing before others pay.

Related concepts

• Authorised push payment fraud: the legal and banking category most rental deposit losses fall into. See the Authorised Push Payment (APP) Fraud Guide.
• Impersonation scams: criminals posing as landlords, agents, platforms or hotels. See the Impersonation Scams Guide.
• Travel security: device and account protection while abroad. See the Travel Cybersecurity Guide.
• Identity theft from applications: rental applications collect enough data to open accounts. See the Identity Fraud Prevention Guide and the Credit Freezes and Fraud Alerts Guide.
• Reporting routes: in the US, the FTC lists local police, the advertising website, ReportFraud.ftc.gov and the state attorney general; in the UK, contact the bank immediately, as the ATOL alert advises, and report to Report Fraud (Police Scotland on 101 in Scotland).

If you have already paid: call your bank or card issuer immediately using the number on your card, report the listing to the site where it appeared, keep the advert, messages and payment receipts, and, if you sent ID documents, watch for identity theft and consider a credit freeze or fraud alert.

Practitioner checklist

• Refuse untraceable payments: Do not pay by wire transfer, gift card or cryptocurrency, because the money usually cannot be recovered.
• Stay on the platform: Book and message only through the platform, since paying off-platform loses protections such as Airbnb's AirCover.
• Search for duplicate adverts: Search the address and reverse-search the photos to find the same property listed under different names.
• Check the owner or agent: Check property tax or land registry records for a private landlord, and an agent's ID against the company's own records.
• View before paying: Visit in person, or hold a live video call you start where the person walks through the property.
• Get a contract first: Get a written agreement for a holiday let before any deposit, and confirm the address exists.
• Check scheme membership: Do not trust an ATOL or ABTA logo on a website; check the scheme's own register instead.
• Report fast: Pay by credit card where you can and report to your bank immediately if something goes wrong, as this gives the best chance of recovery.

Standards and references

• Federal Trade Commission: Rental Listing Scams
• Airbnb Help Centre: Paying and communicating outside Airbnb
• Microsoft Threat Intelligence: Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware
• ATOL (UK Civil Aviation Authority): Holiday fraud alert with 2024 national fraud reporting figures
• Payment Systems Regulator: APP scams

Related NHI Mgmt Group resources: Online Marketplace Buying and Selling Safely Guide · Authorised Push Payment (APP) Fraud Guide · Impersonation Scams Guide · Travel Cybersecurity Guide