Airbnb QR Code Scam: What It Is and What to Do

The host QR code scam

Scammers post fraudulent short-term rental listings on Airbnb — or impersonate real hosts by messaging travelers who have recently booked. Before or after a booking is confirmed, the “host” reaches out outside the Airbnb platform — by text, WhatsApp, or a follow-up email — and asks you to scan a QR code. The stated reason varies: a refundable security deposit, an extra cleaning fee, a key-pickup portal, or a mandatory check-in verification.

The QR code opens a payment page that looks plausible but is not affiliated with Airbnb. You enter your card details, the charge goes to the scammer's account, and you either arrive to find no listing exists or discover the host never received the payment through official channels. In some cases the listing is real but the “host” contacting you is an impersonator who found your booking by other means.

The rule is absolute: Airbnb never asks guests to pay via QR code, and legitimate hosts have no reason to collect payment outside the platform. All deposits, cleaning fees, and service charges are handled entirely within the Airbnb booking flow — on the Airbnb website or app. If anyone asks you to scan a QR code to pay anything related to an Airbnb stay, stop and report it.

The fake confirmation email scam

A second variant arrives as an email designed to look exactly like an official Airbnb booking confirmation. It carries Airbnb's logo, color scheme, and formatting — but it was sent by an attacker using a lookalike domain or a spoofed sender address. Embedded in the email is a QR code labeled something like “Complete your booking,” “Verify your identity,” or “View your check-in details.”

Scanning the code opens a convincing Airbnb login page hosted on a domain the attacker controls. You enter your email and password thinking you're logging into your account — but you've just handed your credentials to the scammer. Within minutes they can log into your real Airbnb account, change the email or password to lock you out, access stored payment methods, and make fraudulent bookings charged to your card.

This scam is also used against hosts: a fake “payout verification” email containing a QR code prompts hosts to log in and confirm banking details — handing over credentials that give an attacker access to host earnings.

Genuine Airbnb emails and confirmation pages never include a QR code. If you receive one, go directly to airbnb.com in your browser — do not tap the QR code or any link in the email.

What to do right now

If you only scanned and immediately closed the page without entering anything: Your risk is very low. Monitor your accounts as a precaution.

If you entered card or payment details:

1. Call your card issuer immediately using the number on the back of your card. Report the number as potentially compromised and request a freeze and replacement card. Dispute any unrecognized charges.
2. Contact Airbnb support through the app or at airbnb.com/help. Report the fake host or fraudulent email so they can remove the listing and warn other travelers.
3. File a report with the FTC at reportfraud.ftc.gov. If the scammer was impersonating Airbnb, you can also report to Airbnb's trust team directly.

If you entered your Airbnb login credentials:

1. Go to airbnb.com immediately and change your password. If the attacker has already changed it, use “Forgot password” with your email address.
2. Enable two-factor authentication in your Airbnb account settings if it isn't already on.
3. Review your account for unfamiliar reservations, changes to payment methods, or altered personal details.
4. If you use the same password elsewhere, change it on those accounts too and consider a password manager.

For more on what happens after scanning a suspicious QR code, see what happens if you scan a fake QR code. If a rental scam was involved, see QR code rental scams: how to spot a fake listing before you pay.

Frequently asked questions