Example of deposit fraud
It is very important to us to offer our users maximum protection against fraudulent listings. Not only are the methods used by fraudsters constantly evolving, we are also working hard to detect fraudulent listings at an early stage. That is why we continually invest a lot of time in fraud prevention, be it via telephone verification or constantly updated fraud models for automatic scam recognition. In addition, we have had numerous discussions with the authorities and carried out mystery shopping. This report recounts our experience with a housing fraudster.
To better protect the Flatfox platform and therefore our users, it helps to know how the fraudsters operate, so we put this to the test.
We responded to a listing for a flat share in Zurich that had already been identified as a fraudulent ad and handled accordingly. For security reasons, we didn't want to communicate with the fraudster using a real name and email address. We used a free email provider to create an email address under an alias.
Initial contact with the fraudster
The first message suddenly mentioned the entire 3.5-room apartment instead of just one room – for the same price of CHF 940, mind you. We were also told to communicate with a private email address. This meant that the conversation would take place outside the property portal and therefore could not be monitored. Using the new email address, under the pseudonym Daniel Meier, we sent the fraudster a message using incorrect English:
«Hi I am very interessted in your flat, since I neet to get out of my appartment. please help me otherwise I have no home. Daniel Meier»
Reputable advertisers wouldn't even respond to such a message. The next day we received a long email in English:
«First of all many thanks for your interest in my apartment in [Strasse gelöscht] 8004 Zurich, 3.5 rooms 85 m². I bought this apartment for my daughter during her studies in Switzerland, but now she is back home, so I rent the place for an unlimited time. [...]»
There then followed a ‘moving story’ about why the owner was renting out the apartment and that she, a certain Sabrina Melani Jiminez, had to travel especially from Spain for the viewing. Of course, we really wanted to rent the apartment, especially as it cost just CHF 940 per month. Under the pseudonym Daniel Meier, we then wrote:
«okay that sounds great, I would rent it immidiately. Deposit or Rent is no problem for me, because its good price the 960! Best wishes from snowy Switzerland! Daniel Meier»
The next day, we received another reply from the fraudster:
«You seem like a very nice person, and I would be more than happy to have you as my tenant ! :) [...]»
Once again, we were ‘lucky’. Once again, the text looked like a standard email. This one was much more interesting, however, as it was slowly becoming clear what the fraudster was trying to achieve: it stated that we had to pay a deposit in order to even be able to view the apartment. At this point, alarm bells should be ringing – never transfer money before you have viewed the apartment.
‘Deposit via Airbnb’
The reason given for this deposit was that it would underline our integrity and intention to rent the apartment. Airbnb was named as the ‘safe partner’ for the deposit. That’s when things got exciting. How does the fraudster get our money via Airbnb?
We, or rather our alias Daniel Meier, responded, reaffirming our intention to rent the apartment. Melani told us that it was important to act quickly and then sent us a second email with a URL to an alleged Airbnb listing: due to the HTML formatting, the URL appeared to be ‘airbnb.com/rooms/9448967,’ but closer inspection revealed a hidden hyperlink to a malicious website. Despite the threat of viruses, we clicked on the malicious link and it opened a page that looked very similar to the genuine Airbnb.
The only difference was the other URL displayed in the address bar. To create trust, the listing even had four very positive reviews from (fake) users, full of praise for the ad. What made us suspicious was the fact that the alleged guests only rented the apartment for a short time as a regular Airbnb and described the hostess Melani Jiminez as very friendly: this didn't fit with the story we'd been given about Mrs Jiminez living in Spain. Or perhaps she flew to Switzerland for every short let?
Nevertheless, we did what we were told and booked the apartment for a month. We only provided basic information using fictitious data. When completing the ‘booking’, we were expecting to enter credit card details for payment. Thise was missing, but our booking was still completed. The next day we received an email from Melani Jiminez:
«Daniel,
Why did you made an empty booking ?
Melani»
Apparently, we had forgotten to enter the address when booking and of course all the details provided on the fake Airbnb page went straight to the fraudster. We immediately replied that this was a mistake and we would like to make a new booking and sent her Daniel Meier’s (fictitious) address as a precaution. The fraudster then apologised and said that the booking had probably ended up in her spam folder. She also confirmed that she had accepted our booking. Our alias Daniel Meier was of course delighted and immediately opened the second email, which now supposedly came from Airbnb.
Bank transfer to Poland
Upon closer inspection of the alleged confirmation email from Airbnb, we spotted the incorrect email address. The content of the email should have set alarm bells ringing: firstly, the booking was confirmed. Then reference was made to an alleged new Airbnb policy, according to which bookings of over CHF 1,000 could no longer be processed by credit card, but only by bank transfer. This is, of course, completely wrong. The genuine Airbnb has no official limit (except in Brazil, where the transaction limit is $ 3,000) and only accepts credit card payments (as well as Paypal, Google Pay and Apple Pay in some countries, but never bank transfers).
Fraudsters wouldn’t have much use for a credit card payment, as it can be charged back in the event of fraud. In this case, the fraudster posing as Airbnb wanted us to transfer CHF 1,940 (CHF 940 first month’s rent + CHF 1,000 deposit) to a Polish bank account with a major international bank. The account location was explained by the fact that it was a ‘neutral country’. Of course, the CHF 1,940 was just a deposit that would be refunded.
What is clear, however, is that if we had transferred the money, we would never have seen it again. We were not asked to name Airbnb as the beneficiary, but rather a person with a Polish address who was described as Airbnb’s ‘Financial Manager’. This situation should also immediately make you suspicious! Of course, we didn't transfer any money; but we still had what we wanted: we were able to find out how a housing scam works. This was out of pure curiosity and with the knowledge that a better understanding of fraudsters' actions helps us protect our users.
Basic rules against housing scams
Never transfer money before viewing an apartment
Notify the platform in the event of suspicious listings
On Flatfox, it is advisable to communicate via Flatfox Messenger until you have viewed the apartment and only then exchange email addresses/phone numbers
Always transfer the deposit to a rental deposit account (and not the landlord’s account)