Fraudulent activity on Airbnb has grown thirty times over since the first half of 2023, according to new research from Saily and NordStellar — and the nature of the scams is changing. Rather than building fake profiles from scratch, cybercriminals are increasingly compromising verified host accounts, exploiting the platform trust those accounts have already earned.
The research, conducted by travel eSIM provider Saily and cyber threat exposure management platform NordStellar, examined cybercrime marketplaces where Airbnb host credentials are bought and sold. Verified accounts — those with completed identity checks, platform history, and positive reviews — have become one of the most valuable commodities traded on these platforms.
A single hijacked account can be used to create multiple fraudulent property listings, collect deposits, and vanish before victims recognise the deception. Because the underlying host profile appears legitimate, guests have fewer obvious signals to warn them off.
"Travelers are getting better at spotting obvious scams. Criminals know this, so they are increasingly trying to steal trust instead of building fake trust from scratch," said Matas Cenys, Head of Product at Saily.
The research notes that fake Airbnb websites remain part of the fraud landscape, but the shift toward compromising established accounts represents a more sophisticated evolution. Victims are interacting with listings that carry platform verification badges, years of reviews, and histories of successful stays — none of which signals the account has been taken over.
For enterprise security and risk teams, the pattern illustrates a broader shift in how credential theft is being monetised: not just for corporate network access, but for consumer platform trust. Organisations running travel programs and booking accommodation for employees should factor account-takeover fraud into their travel policy guidance.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
