Ding Ziqian had found what looked like the perfect Airbnb rental in Washington, D.C., where she is going to study at Johns Hopkins School of Advanced International Studies (SAIS) this fall with three other students from China, but then the landlord asked her to pay a $1,500 (9,600 yuan) deposit in bitcoin.

Ding was suspicious. "The website looked official, but it seemed strange that it wouldn't allow us to pay by credit card," she said.

It turned out that the website and the email address were fake, crafted to resemble those of Airbnb. The name of Ding's would-be "landlord" was phony, too. If the email had asked for payment by credit card, Ding and her classmates might have been ripped off. Luckily, the red flags caused them to stop and investigate.

Since internet commerce began, online swindlers have been trying to hack, phish and steal. But new technologies and trends – such as cryptocurrencies, the "internet of things," and the so-called gig economy – have given scammers new ways to target unsuspecting victims. International students, who are getting used to a new and unfamiliar country, are among those targeted.

This particular scam involved multiple deceptive domain names registered in the months and days leading up to the sham email, and even a telephone number with a hold message claiming to be that of Airbnb. The invoice arrived in Ding's inbox on May 18, two days after the reservation was made on a website aping Airbnb.

The URL of the bogus website: Airbnb.com.lonlease.agency. In this case, the actual domain is not Airbnb.com, but lonlease.agency. Webmasters can put whatever subdomains they want in front of their domain names – mail.google.com is used for Google's email service, for example – but the text directly beside the final period is the real identifying information.

Following the last period is the so-called top-level domain, or TLD. The most popular TLD has been .com, followed by .org, .gov, .edu and sometimes .net. The number of TLDs continues to expand, but many obscure TLDs have become associated with spam and scams.

The sender's name appeared as "Airbnb" in Ding's email client, but clicking on the details showed that the message was actually sent from application@rent-invoice.online. A search of http://Whois.net, a site which lists publicly available information provided by domain name registrars, shows that the domain name rent-invoice.online was registered on May 18, 2018, the same day the fraudulent invoice was sent. Registration records often show the identity of the domain name owner as well, but some – like the owner of rent-invoice.online – pay extra to hide their names and mailing addresses from public view.

The email appears convincing. It lists fake details, including an invoice number, a reservation code and even an address purporting to be that of Airbnb headquarters. One small mistake was that it showed the deposit written as "$1.500" with a period instead of "$1,500" with a comma, which is how it would be printed in the United States.

The giveaway for Ding, of course, was the direction to pay in bitcoin, which remains a niche currency in America. Bitcoin users often tout the fact that payments are anonymous and untraceable – perfect for selling drugs and other illegal products, as it is often used for on the darknet, and for running scams. As there is no bank account involved, it may be harder to identify the recipient of funds. Unlike credit card payments, transactions using bitcoins cannot be canceled or refunded.

Scams involving bitcoin requests and fake Airbnb rentals have become common enough in 2018 that the website PayBis, which facilitates cryptocurrency payments, published a message on their website on May 15 warning consumers.

Entitled "Beware of Airbnb Bitcoin Scam," the message states: "There is a group of people who pose to be Airbnb representatives and are asking to make payments in Bitcoin. They created a phishing website that looks very similar to Airbnb's website. However, Airbnb does not accept payments in bitcoin for property rental."

Luckily, this scam did not ultimately succeed, but many other online customers are not as fortunate. For now, the best advice for consumers may simply be to watch out.

Related

Go to Forum >>0 Comment(s)