Could you spot a bogus Airbnb listing among the genuine ones?

An internet businessman based in Bath, who lost more than £4,100 to sophisticated Airbnb fraudsters after booking what he thought was a smart holiday villa in Sicily for three weeks.

He, his wife and their two children, who have asked not to be named, were supposed to start their holiday this week; instead, the listing turned out to be a scam. Rather than packing the sun cream, he says he spent the week contemplating whether legal action against Airbnb would be successful.

Over the past year or so fraudsters have been targeting the popular website that advertises thousands of holiday rentals, now in 191 countries. It has proven safe as long as users stick to its terms and conditions and only send payments via its own platform.

However, hundreds of scam listings have allowed conmen to persuade holidaymakers to instead send payments via bank transfers. The listing and/or the apartment later turns out to be fake. By the time the victim realises – sometimes only when they are standing outside the property, suitcases in hand – the money has long gone.

Guardian Money first warned about this problem back in 2016 when a reader lost £800. Fraudsters had stolen a legitimate Airbnb listing in Amsterdam, changed its details and set up a fake home page – complete with a “live chat service” – to convince her, and probably others, to send a bank transfer.

At the time we questioned why the fast-growing website wasn’t doing more to warn users, particularly first-time ones, about the problem.

Prompted by this and several similar stories, Airbnb did start putting warnings on all listings in April this year telling users to only make payments through its own platform. It also required users to use two-step verification of emails to help reduce account takeover, which sees fraudsters taking control of legitimate listings which they then change.

The payments warnings now appear on most Airbnb listings, except, of course, the faked ones that have been changed and still ask for bank transfers.

The measures will almost certainly have come too late for some holidaymakers who made bookings earlier this year and are probably still unaware they have been scammed. Anyone who sent a bank transfer for an Airbnb booking should check its status fast – certainly before they set off from home.

“I’m not an idiot and run a successful internet business,” says the latest victim. “I am well used to booking holiday accommodation which, in the past, has required money to be sent via bank transfers.

“Everything on the Airbnb listing seemed normal. I corresponded with the owner on dates etc, and then finally sent the money. It all seemed very similar to bookings I’d made previously using other property websites. Now Airbnb is denying any liability. I have lost a large amount of money, I’ve got no holiday, and a very pissed-off wife.”

The €200-a-night listing seen by Guardian Money was expertly done, and would have fooled many users, particularly anyone new to the website. It is not known where the image used on the fake listing was sourced from. It asked him to pay the money – €4,590 – to a Bank of Cyprus account based in Nicosia. The account was supposedly in the name of AIRBNB-A BRUUN.

The listing stated: “The payment is processed and collected by Airbnb in full. The security of your funds is ensured, and you’ll be protected by policies, such as cancellation policies and the Guest Refund Policy.”

Without any apparent irony, it went on: “The host will receive full payment from Airbnb 24 hours after you check in. Your payment is automatically covered against internet fraud up to €20,000.”

The victim says he is determined to seek compensation from Airbnb, which earlier this year was valued at $31bn on the US stock market. He says he feels that the company should employ pop-up boxes to drive home the message that all payments must go through the platform.

Any legal dispute would likely have focused on what security measures the site had put in place, and what ID checks it had done on the person who listed the fake website.

Airbnb initially told Money that the company has removed the listing in question and was providing support – but no refund. “Fake or misrepresented listings have no place in our community and our team is working hard to constantly strengthen our defences and stay ahead of fraudsters,” a statement said.

“We recently introduced new security tools to help tackle fake listings and educate our community about staying safe online, including more warnings.

“The most important thing to know is as long as you stay on the Airbnb.com platform and only send money through Airbnb, you will always be protected. There have been over 200m guest arrivals on Airbnb and bad experiences are extremely rare.”

However, following Money’s intervention, and in the face of a threatened social media campaign by the businessman, Airbnb performed an about turn: it has now agreed to send him the £4,139 he lost.

It declined to say what had prompted the change of heart.

And tenants take care too …

Renters and people seeking short-term holiday lets are being warned to think twice before signing up for “too good to be true” tenancies, after a sophisticated online scam was uncovered aimed at stealing thousands of pounds from would-be tenants, writes Alex Hern.

Martin, a local government worker, was targeted by the scammers after he requested a viewing of a flat in Bounds Green, north London. The email, ostensibly from “Damien & Caroline Wilson”, a couple in Thurso, Scotland, offered it for a low (for London) rent of £1,000, all bills included.

When he tried to arrange a viewing, there was an unusual response: the Wilsons claimed to be unwilling to travel from Scotland, even sending receipts for their previous flights, and instead offered up a video of the property.

But it was only when he asked for the house number that the real warning signs arrived. The would-be landlords claimed to be unable to tell him that, due to the terms and conditions of holiday site TripAdvisor, but assured him that if he started his tenancy by making a booking through that site, “TripAdvisor is guaranteeing the whole transaction between us”, even linking to the real site’s payment protection guarantee. The fact that the listing was on a faked TripAdvisor page rather than a standard long-term rental website was also a red flag.

“It wasn’t until they sent over the email asking for a deposit upfront that I was certain it was a scam,” Martin says. “Other red flags included linking to TripAdvisor’s refunds information page for no real reason – any hint of non-standard payment systems sets off warning bells for me – and the random receipts for their flights from Scotland.”

The pictures and video were taken from a completely different house – a short-term holiday rental in Marylebone which charges more than £300 a night.

The couple’s request for a deposit went through to an extremely well-crafted clone of the real TripAdvisor rental page, replete with fake reviews from previous inhabitants, a count of how many other potential tenants had viewed the page, and even a working Google Map showing the rough location of the flat. Clicking on “reserve now” takes the target to a second, equally accurate clone of TripAdvisor’s payment page, where credit card information is requested. The only obvious giveaway is the URL: it reveals the site is actually hosted at “tripadvisor.com-hrc85.com”.

Andy Norton, risk officer at cybersecurity firm SentinelOne, says the scam “seems innovative. Rental fraud and rental scams have been around in a very physical way for a long time – fake landlords collecting deposits for flats that don’t exist, or collecting multiple deposits on one flat. This puts a cyber spin on that.”

He traced the “com-hrc85.com” domain to an IP address in China shared with two other similar websites. “They’re all clearly connected. Someone’s already reported one of them because it’s picked up by Google’s anti-fraud measures on Chrome.” An identical scam was reported by another renter in Guildford, Surrey, and a third in Wimbledon.

Norton speculated that the end goal was to steal the credit card information of potential tenants, then use that to rapidly buy and resell valuable consumer goods. By gathering data through a rental scam, the criminals can ensure they secure cards with a high credit limit.

In a statement, TripAdvisor says: “We were very concerned to learn of this experience. It wasn’t connected to TripAdvisor and our sites remain safe and secure. We’ve now reported this scam to the relevant authorities, and to the domain on which the fake page was hosted, and we will remain on hand to help however we can.”

Emails sent to the Wilsons, and to the registrar of the fraudulent domain, were not responded to.