How to avoid travel scams and fake rental listings

Four years ago, Joel Kramer was scouring vacation rental sites for a Rhode Island beach house for his family of five. A promising message from a property manager with "Golden Vacation" landed in his inbox: A three-bedroom was available for 10 days in early August. The house checked all of Kramer’s boxes, except one.

The rental didn’t exist.

"I e-mailed, no response. I e-mailed again, no response. We called and got a Verizon response saying this number is no longer active," said Kramer, 74, a neuropsychologist in San Francisco, recalling the day before his family was supposed to move into the rental. "We went, ‘Oh, s---.’"

The Kramers had been scammed.

Travelers have been conned since time immemorial, but today’s scams are more insidious and sophisticated than such old tricks as the bait-and-switch or shell game. Security experts say modern-day swindlers use advanced technology such as artificial intelligence to trick travelers out of their money and sensitive personal data.

"Cybercrime is a business, and just like legitimate businesses, cybercriminals are really focused on maximizing the returns," said Steve Grobman, chief technology officer at McAfee, an online protection company. "They’re using technology to optimize their victim-conversion rates, things like AI to find victims who are more likely to fall for scams. And they are making the scams more relevant or scary to their victims."

Though the Federal Trade Commission received nearly 3,000 fewer fraud reports during the second quarter of 2025 compared with last year, the total loss was larger. Thieves absconded with $40 million, an increase of $5 million.

Grobman said everyone is a target. Cybercriminals will go after younger, thriftier travelers with cheap travel deals and lure older, wealthier travelers with luxury trips. They will prey on their victims through social media or by text, email or phone.

'The scammers know what generation you are and focus on the things that will resonate with you," Grobman said. "They really do know a lot about you and can hyper-optimize the scams to target the victims."

The FTC and other security entities offer tips to help identify and avoid fraud. Scammers often pretend to be affiliated with an established organization, such as the FTC, for instance. They will pressure the person to act immediately or risk missing out. And they will require forms of payment with weaker consumer protections than credit cards, such as Venmo, Zelle or a wire transfer.

In hindsight, Kramer noticed several red flags. "Mark Meyer," the so-called property agent with "Golden Vacation," had sent him a Vrbo listing, even though the company urges renters to perform all transactions on its platform. Meyer said the owner lived in Ireland; Kramer, however, had seen the name of a Rhode Island resident (the true owner, he later discovered) on the contract. Meyer instructed Kramer to pay through XOOM, a PayPal subsidiary that does not refund received payments. (Kramer was able to halt the second installment.)

After losing half the $4,000 fee and jeopardizing his family’s summer vacation, Kramer has changed some of this travel-planning behaviors. He said he will no longer reply to emails from strangers on his phone. Instead, he will wait until he is on his home computer, where can see the full scope of the message and pick up on any suspicious signs.

He has also stopped relying on rental companies for his New England beach getaways. He and his wife bought a place in Rhode Island, which they rent on Airbnb.

The fake rental listing

The Kramers fell for the vacation home scam, one of the most common travel deceits, according to the FTC.

The con works like catfishing, but with rental properties instead of people. Impostors will pilfer real online profiles and sell them as their own. In some cases, the rentals may be complete fabrications.

"If a legitimate Vrbo or Airbnb renter has created a good description with photos, then the scammer basically copies that and presents it as their property," Grobman said. "It makes it very easy for the scammers to get somebody to put down a deposit, but they didn’t actually get a booking."

How to spot it: If the property’s profile appears in multiple off-platform sites, with no history of guest reviews. Vrbo’s warnings include listings with incorrect spellings or grammar; low-res photos; and a request to communicate and pay off-site. To protect yourself, the FTC recommends searching online for the property’s address, the owner’s name and the rental company. Cross-check the information against the listing you received. Grobman, meanwhile, recommends using only reputable rental agencies or platforms that vet the owners and provide protections, such as Airbnb’s AirCover and VrboCare.

The CAPTCHA-if-you-can scams

Travelers need to be on high alert with every interaction, even rote ones such as proving to a website that you are not a bot.

In the fake CAPTCHA scam, the consumer will follow "verification steps" that often involve a series of keystrokes, such as pressing the Windows key + R, CTRL + V and then enter, according to Ohio State University’s Office of Technology and Digital Innovation. The commands allow cybercriminals to install malicious software, or malware, into your computer and steal your personal information. Once the sabotage is complete, you may receive an error message in place of a booking confirmation.

"You think you’re going to a site to get a great deal and you end up having your social security number or your passwords stolen right off your computer," Grobman said.

How to spot it: Tech security experts say to be wary of verification requirements outside the norm, such as actions unrelated to logging in, creating an account or executing a financial transaction. Make sure the website address is legitimate, and never perform keystroke commands for a CAPTCHA test.

The fake travel website

Fraudsters create copies of popular travel websites with a slight permutation in the web address. As an example, Grobman shared a Booking.com knockoff with the URL www.booking-confirmation.com.

"They’ve essentially set up a site with the same look and feel, including the images and the layout of the real Booking.com," he said. "They can harvest your credit card and other personal details."

When it’s time to pay, instead of purchasing a hotel room, you are handing over your credit card information to the cybercriminals. Grobman said they may even start shopping while you are still on the site. You won’t realize you’ve been conned till you show up at the hotel and discover that you’re not on the guest list.

How to spot it: Carefully inspect the web address and site for any stray or suspicious letters or words. Don’t jump on the first site that pops up in your hotel or airline search, even if it shares the same name as an established travel company.

The urgent text scam

An urgent text appears on your phone. Your frequent-flier miles are about to expire or you have an unpaid toll and could face late fees or legal action. You must act now or else ...

"Scammers really focus on the emotional manipulation that will drive fear and a sense of urgency to act," Grobman said.

In your frenzy to protect your miles or pay your delinquent bill, you may call the fraudulent phone number or click on the corrupt link, sharing valuable information.

How to spot it: Most companies will not text unless you signed up for this form of communication. The frantic tone should also set off alarms. Even if you opted in, don’t click on any links. Log into your frequent-flier or toll pass account and check for any alerts or discrepancies. If you are still concerned, call the airline’s reward program or the toll authority. Just be sure to use the correct phone number. The web is a minefield of sham customer service numbers.

The personalized hoax

That Instagram photo of you lounging by a resort pool might attract more than the attention of your friends. Scammers might like it, too.

Grobman said cybercriminals don’t need a location or hotel name to know your whereabouts. To craft a personalized scam, they will use technology to determine your vacation spot based on your social media post.

"If you think you’re being careful because you’re not saying where you are, artificial intelligence can help the scammers identify exactly where you are, even down to the restaurant or the hotel," he said. "Then they can use that information to create a scenario that becomes a lot more believable."

For this deception, the guest might receive an email, text or WhatsApp message from the hotel, notifying them of an unpaid charge. The message will stress the importance of settling the bill as soon as possible. Grobman said the link might be authentic, to avoid detection, but the phone number could be fake.

"They’re trying to get you to call," he said. "Or sometimes they’re just trying to get you to reply to the text message and then they’ll call you back."

How to spot it: As with the urgent text scam, ignore the message if you didn’t opt in for this type of communication. Even if you did, call the hotel directly and ask about any unsettled invoices. Don’t pay without proof.