Just a reminder what happened to users of “Owners Direct” because of their policy of hiding contact details on their website !
taken from the Guardian 23 Auguat 2014
Families pay for accommodation only to discover, at the last minute, it’s non-existent. That means finding somewhere else to stay and meeting the cost
Three weeks ago Natasha McDonald, her husband and three children were standing outside the villa in Puerto Banús, near Marbella in southern Spain that they had booked for 10 days at a cost of £1,600. But there was no sign of the owner, or the keys. The villa company website was down and, in despair, the family trudged off with their bags to a hotel for the night.
Only the next day did the McDonalds, from south London, discover they had fallen victim to a cruel scam in which crooks hijack the emails of villa owners who advertise through Owners Direct and its sister site, HomeAway.
All the time that Natasha had been emailing with the “owner” – with mundane inquiries such as parking, wi-fi, and the deposit – she had, in fact, been dealing with a fraudster posing as the owner. It’s highly unlikely she’ll ever see the £1,600 rental cost ever returned – or the £2,900 she had to pay in hotel bills.
Natasha is not alone. Since Guardian Money first featured the story of a family whose holiday was wrecked in this way, more and more victims have come forward – and not just British holidaymakers.
Owners Direct and HomeAway (the brand used more commonly outside the UK) is the world’s biggest villa rentals company, with more than 1m listings in 190 countries.
It has emerged that thousands of holidaymakers from all over the world have fallen victim to the scam.
Jillian Roberts contacted us after she was scammed out of the £4,000 that she paid for a family villa in Marbella. She only discovered what had happened a few days before she was due to fly out.
Liz Bancroft from east London was due to be spending this week in the Alps after paying £2,700. Like Roberts, she was forced to find alternative accommodation.
Money is also aware of American tourists travelling to Umbria in Italy who found the villa owner knew nothing of their booking.
Nearly all complain about the poor response from HomeAway/Owners Direct, which says it cannot be held responsible for villa owners who fall for “phishing” attacks.
But the victims accuse the company of failing to address what they claim are serious flaws in the way it operates.
Sarah Allen, who lives in the Middle East, learned she had been scammed the day before she was due to fly from the UK to the south of France.
Like Natasha McDonald, she had found a villa via the Owners Direct and, like her, had used the “contact the owner” facility to inquire whether it was available. Again she got an email from what she assumed to be the owner and, following the usual discussions about security codes etc paid €5,940 (around £4,800) by bank transfer.
She got an email the day before they were due to fly claiming (falsely) that the owners had a buyer now for the villa and could no longer rent it.
“I felt sick. We were already checked in for our flight and my parents were on the way. We agreed to try to see if we could find alternative accommodation as it seemed we would otherwise definitely lose our flights and our parents would be stranded,” she says .
When she got through to Owners Direct she was told by its “trust and security” department it would try to contact the owners and phone back.
“He phoned back to says he could not get hold of the owner. At that point the phone was cut off, and he did not bother to phone again.”
They found a last-minute replacement but Allen says she spent most of the holiday trying to establish what had happened and if she could get her money back.
“The owner has been helpful and called in IT experts to get to the bottom of what happened. He told me four other families had sent money for non-existent bookings.
“I reported the matter to Action Fraud and my bank, and am waiting to see if any of the money can be traced. If Owners Direct is aware of such cases, it should be giving very clear advice to would-be travellers about the insurance options – but I saw nothing.”
The pair were two of several readers who contacted Money after we highlighted the plight of JL from Warwick who lost £2,790 in identical circumstances.
Campaigners in Indonesia have also contacted us to say the fraud has been going on as far back as 2010. The group of villa owners, some who claim they have had their Owners Direct accounts hacked five times, believe the numbers are the tip of the iceberg, and claim both HomeAway and security authorities such as Action Fraud are failing to take the problem seriously.
How it works
Renters looking for accommodation on HomeAway/Owners Direct websites have a massive choice (HomeAway lists 1m properties) and most contact the owner through the “inquire” page on the website. The trouble is, the scammer may have got there first – intercepting the request.
They do this by sending the property owner an initial, fake inquiry. It has a link that once clicked on makes the recipient think they are logging in to either their HomeAway, or email sign-in page. But in reality the link takes them to a page created by the fraudster.
If the owner logs in, the scammer now has access to their email account, and can begin intercepting legitimate rental inquiries.
To cover his tracks, the scammer will typically delete real requests – and reply to the victim from an entirely different, but similar email address set up for the purpose.
They then pose as the owner providing fake details, sending fake contracts, answering questions etc, and finally asking for the payment to be made direct into their bank account.
The real owner will often know nothing about it and just think the number of inquiries has fallen away.
Because the sites show a renter’s email address on all requests, the scammers can email them to offer an alternative.
Campaigners calling for security to be improved say the sites should stop sending renters’ email addresses to owners and, instead, all email addresses should be held within its internal system. They says rival sites have changed the way they operate to improve security.
This week Guardian Money sent messages to two Owners Direct properties in France. One replied within the HomeAway website, the second simply sent an email from their personal email address – both saying the house was available. Is the latter from a scammer? The inquirer has no idea. Some owners have even reported their phone numbers are changed on their listings, allowing the scammer to intercept calls from concerned renters.
It all means booking a property using these sites can be a giant leap of faith.
In response, HomeAway/Owners Direct says it is just one of a number of online businesses engaged in a difficult battle with fraudsters, and that it takes its online security “extremely seriously”.
“While Owners Direct is protected through effective security systems, we have no control over the systems providers of email accounts. This is where the property owner’s email accounts may be compromised. Unless an owner, or an advertiser, contacts us to let us know there is a problem, we have no way to identify that a phishing incident has occurred.”
It says it has provided lots of information and advice to travellers in order to educate them about the risks. It offers free insurance up to £700 in the event of a scam plus the option of purchasing full cover. It is also developing an Owners Direct platform and will include online payments “to further increase safety”.