Fake Rental Sites Use Live Chat to Steal Card Details

Fake vacation-rental websites are copying real-looking property listings, reviews and booking details to steal travelers’ passwords, personal information and credit card numbers. Some even provide live chat that reassures hesitant visitors, making the scam especially convincing when a trip is approaching.

What happened

Researchers from Fortra’s Intelligence and Research Experts team found phishing pages designed to resemble popular rental marketplaces, according to Help Net Security. The researchers reported the sites and had them taken down, but the campaign shows how scammers can build believable copies of booking services.

The pages used copied property photos, descriptions, host names, ratings, travel dates and prices. Visitors were told that a reservation had not been confirmed, a payment had failed or a booking would soon be canceled. Other messages offered special pricing for a limited time or demanded an additional verification step.

One fake checkout page included a live support chat. When a visitor questioned a credit card request, the chat presented it as a normal security check and claimed the card would not be charged. According to the report, that reassurance was intended to reduce suspicion and persuade the visitor to submit payment information.

Other pages requested names, email addresses, phone numbers, countries and social media credentials. Fortra warned that scammers could use this information for identity theft, additional phishing or account takeover.

Who is affected

Anyone booking a vacation rental through a link in an unexpected email, text, social media post or other message could encounter this scam. Travelers facing limited availability, high prices or an approaching departure date may be more likely to act quickly.

A polished page is not proof that the property or booking service is legitimate. The report says scammers can copy genuine listing details closely enough that nothing about the displayed homes looks obviously wrong.

People who reuse the same password on several services face added risk. Credentials entered on a fake booking page could also expose other accounts using that password.

What to do now

1. Do not sign in through an unsolicited link. Open a new browser tab and go to the rental company’s official website address instead. Check your reservation there rather than trusting the link’s branding or buttons.

2. Pause when a message creates urgency. Claims that your booking is unconfirmed, your payment failed or your reservation will be canceled are reasons to verify the request through an official channel before entering information.

3. Check the full website address before continuing. Lookalike domains can display familiar logos and copied listings. The official address is a stronger signal than the page’s appearance.

4. Do not treat live chat as proof. A person answering questions does not make the site legitimate. Leave the page if support asks for card details or credentials during an unexpected verification process.

5. Replace any password entered on a suspicious rental page, especially if you reused it elsewhere. Give every important account a different password so one stolen login cannot unlock several services.