How Airbnb Hosts are Joining Crime Networks to Steal from Guests

I never thought I would be writing after staying in an Airbnb apartment in Barcelona, Spain. But this journey has exposed a fundamental flaw in the Airbnb eco-system that puts everyone at risk.

Firstly this article is not going to speak about the flaws of the “host” verification model within Airbnb. If you want to learn more about that, you can view the www.airbnbhell.com which explains the game’s hosts play.

This post shares how we fell into one of the fast-growing organized crime Airbnb network scams in Europe.

Just like many others, we spent hours looking for the perfect apartment for our Barcelona trip. Even when our first host canceled three days before we left for our trip, we spent more hours finding a replacement apartment.

Here is how the Airbnb Scam Works:

Scammers will rent the apartment like anyone else for 2–3 days. During this time, they will document the floor plan, building access routes, and general building information.

Then the criminals will copy the keys to the apartment and the building keys at a local hardware store. That’s right; they create a copy of the keys so they can come back ANYTIME they want to access the apartment.

Criminals will checkout like usual and even leave a good review of their experience. For most Airbnb’s, this means leaving the keys on the table and closing the door, or putting the keys in a lockbox on the door. The checkout process helps criminals to understand if the apartment is occupied or not. Criminals are not stupid, and they are trying to avoid detection and invest time and effort into appearing normal.

Now the criminals have access to the apartment whenever they want because they have a set of keys. They can enter the apartment without force and steal from current guests without the need for ransacking the apartment or creating a mess.

When I think about this scam, it’s amazingly simple yet sophisticated at the same time. It’s guaranteed to net results that allow the criminals to repeat the crime many times without detection. What’s worse is the criminals can profile apartments to choose high-income tourist stays because of the nightly rates and location of the apartments. Resulting in a higher net return for the cybercriminals.

Here’s how it happened to us:

We checked into the apartment on Friday night. It’s easy to spot the Airbnb guests entering any building. They’re the ones with the large suitcases rolling up the street while looking like they are lost. Just walk down any street, and you will be able to spot them like tits on a bull.

We checked into the apartment by meeting the “host agent” at the building. We spent Saturday touring the city and came back earlier to the apartment. This meant we left Saturday morning with our DSLR camera strapped around our neck, ready to take photos. This is red flag number one for criminals.

What we didn’t realize is there were several spotters in the street waiting for us, watching to see who we were, what we look like, what bags we had, and our camera. Why types of shopping bags were coming back with us etc. etc.

TIP: Your big DSLR camera or “candy” the police call them are “Tourist Indicators” criminals look for when selecting a target.

My wife was walking back with the camera around her neck since she was the one taking photos. This is another WE ARE TOURISTS signal to criminals. Now the criminal spotters who we were hanging out in the street below knew what we looked like, how we were dressed, and the type of camera we had.

Sunday for us was a lazy day. We spent the day at the apartment, doing some laundry since we were six days into travel. My wife stayed in while I went to get lunch that we prepared in the apartment. This entire time the spotters were watching us waiting to strike.

Around 5.30 pm we decided to go for s stroll because the weather was nice. We were only out of the apartment for 2 hours, but it was long enough for the criminals to steal close to $50,000 worth of stuff. When we left, we did not have the camera, and my wife was not wearing any jewelry because we thought we would be quick. So everything was at the apartment.

Here is where it gets interesting.

When we returned from the stroll around the streets, we entered the apartment to find the balcony door open. We later come to find out that one of the spotters could have been standing on the balcony waiting for us to return to alert their partner, “it’s time to leave.”

The apartment was exactly how we left it. It was clean, the suitcases were still packed the way we had them, and the clothes in the cupboard were exactly as we left them.

We have since learned that the thieves want to leave the place exactly as they found it, to increase the detection time. The longer it takes for you to report the crime to police, the more likely they are going to be able to flip the products without issues.

At first, we didn’t notice anything out of place at all. It was only when my wife started to organize herself for tomorrow’s adventure did we realize something was not right. We had to leave the house at 6.30 am, and my wife is not an earlier riser, so she organizes everything the night before to allow for a sleep state departure.

As my wife was organizing her jewelry for tomorrow’s adventure, I hear the question, “Have you seen my wedding ring?”

At first, we thought it was just misplaced or fallen off the bedside table. But 57 minutes later after repacking every suitcase five times, and sweeping every inch of the apartment at least twice. We realized something else was at play.

Then started the questions:

Where is the camera?

• Nope, the camera is gone.

What about your purse?

• The purse was there, but the cash in the purse is gone.

What about the iPads

• They are still on the couch; they were not taken, which is strange to us.

What about the other cash?

• Nope, it’s still there.

What about the passports?

• Nope, it’s still here where we left it.

So what was missing?

• Sony DSLR Camera
• - Cash in Wallet
• - All jewelry, which included wedding bands.

After the quick checklist of what was missing, we realized we had been robbed.

There was no forced entry to the apartment door. Since we now know the criminals have their own set of keys.

The 4th-floor balcony door was open, but not forced. But we now know why it’s opened for a spotter’s viewpoint.

The apartment wasn’t ransacked. Nothing was out of place. Even the plain black pencil case that my wife uses for her jewelry was still there. It was zipped up and placed back into the bag the ways the thieves had left it. This is what confused my wife the most. Why did they leave the bag and zip it up back up?

The bag was in the suitcase, and it certainly didn’t scream, “here’s the expensive stuff!”

It was only later when we spent time with the private investigator we hired did we learn the details of these criminal networks. These types of attacks fall into two categories, and this is the major problem for anyone staying at an Airbnb.

1. Inside Job — This is when someone working for the landlord or the landlord’s management company is exploiting their Access to the apartment to steal from tourists who are only at the destination for a limited time.
2. Criminal Network — The criminal network is smart. They are spending time to understand the apartments and copy the keys. They can have 100 or more properties in which they have keys. They steal from the tourists who stay at these apartments. The Airbnb hosts don’t need to report this issue to future guests.

We have also learned that within the EU, these crimes are extremely hard to track. Because the items stolen in one country are sold over the border within a few hours. Therefore bypassing the reporting issues or stolen item databases within the country, the item stolen from.

The other issue is that these criminals are smart. They leave the crime scene clean. They are trying to avoid detection. They want to attack you on the last few days of your stay in the hope you will not notice. Or you won’t have the time to go to the police station that speaks your language to report the crime. This activity alone took us 4 hours of waiting just to report the crime and get a copy of the police report. What the criminals did not realize is that we were staying for 15 days, not just three days.

When the tourists leave, and if they haven’t yet realized they have been robbed. It’s hard for them to work then out when they lost their stuff. Was it in transit? Or was it at the Airbnb? Therefore, making this silent crime highly effective.

Who has keys and Access?

This is a major issue that Airbnb and the hosts are negligently avoiding. Keys are left in lockboxes, or under pot plants, or given to a booking agent who will copy keeps for any of their contractors.

Hotels, on the other hand, have digital access keys that are reset after every guest. This prevents this security and safety issue or reduces the chances of it happening significantly.

Many Airbnb apartments don’t make use of camera to record who is entering and existing. This is another issue which simple security cameras can resolve. Hotels always have access controls to prevent these types of crimes, yet it’s acceptable for Airbnb to neglect the safety and security of their guests in order for their hosts to make a quick buck.

Just because you are staying in someone’s house or apartment does not make you safe and secure! This is a trust myth that guests assume because of how they booked their stay.

Why is security not part of the ranking scale?

Security should be part of the ranking scale for any location you choose. We assume that a location is safe and secure, yet quite often, it’s only after the event of a crime do you discover how vulnerable you really are.

Airbnb apartments may be cheaper, but when you factor in the security risk of losing everything you own or worse being victimized during an attack. The cost of a hotel is no longer so expensive.

We learned from our host that they had not changed the keys to the apartment for eight years! That’s thousands of people who could have copied the keys. Our host also was extremely quick to use the defense; this has never happened before. But does that really make it acceptable?

Why are we allowing our safety and security to be treated with such low disregard?

I see the same thing happening in the world of cybersecurity and personal data protection. Companies blatantly disregard cybersecurity as something they’ve got sorted when they really don’t. It’s only when a data breach occurs, or they are held for a ransomware attack do they take action.

Travel safe and travel informed

Benjamin Bressington is a cybersecurity expert who travels the world to help companies reduce their cybersecurity risk for data breaches, impersonations, and fraud-related crimes. Benjamin is the CEO of ChatFortress.com