Users of Airbnb should be wary of logging into the service from third-party websites. According to this post from Malwarebytes’ Christopher Boyd, “we saw a fake Airbnb login asking for credentials which appeared to be hosted on a compromised car rental service website.” There have also been a number of reported email phishing attempts which target Airbnb users and ask them to follow a link to confirm their account details. This sounds like a lot of effort to gather usernames and passwords for a website which helps people list, find, and rent temporary residences, as anyone could set up their own Airbnb account.

Boyd points to some possible motives for phishing Airbnb credentials, including advanced fee scams wherein someone asks a renter to send money upfront for a property that doesn’t belong to them. If they have hijacked an existing Airbnb host account, they can contact potential Airbnb guests and direct them to send money through a third-party service. The second motive is a travel scam, which is similar to the above – it asks users to send money to the scammer outside of the standard channels but in this case, the scammer puts pressure on the user to secure the property before it’s off the market.

These Airbnb phishing scams point to a growing trend in cybercrime – stealing account credentials for the value of their online reputation. As Boyd points out, “If the phisher can swipe an account which is both verified and has lots of good reviews, then it would be so much easier to convince a potential victim that a suggested impending wire transfer is above board.” In the online economy, reputation has become a valuable commodity – seller rankings, user reviews, and other crowd-sourced opinion-based analytics can have a noticeable impact on the success of business ventures. In the case of cybercriminals, it impacts the success of fooling victims into falling for the scam.