Vacation Rental QR Code Scam: What It Is and What to Do

The off-platform deposit scam

Scammers post convincing vacation rental listings on major platforms — VRBO, HomeAway, Facebook Marketplace, and direct-booking sites — complete with professional photos (often stolen from legitimate listings) and glowing fake reviews. Once you express interest or make an inquiry, the “owner” contacts you directly — by text, email, or the platform's messaging system — and asks you to scan a QR code to pay a deposit or secure your reservation.

The reason given sounds plausible: they want to hold the dates for you, the platform's payment system is having issues, or paying directly saves you the service fee. The QR code opens a payment page that looks credible — it may even mimic the rental platform's branding — but your money goes straight to the scammer. There is no property, or someone else owns it and has no idea their listing is being impersonated.

The rule is simple: every legitimate vacation rental platform processes all payments inside its own checkout. No deposit, no cleaning fee, and no booking confirmation ever requires you to scan a QR code. If an owner or a message asks you to pay via QR code — for any reason — treat it as a scam until proven otherwise.

The fake confirmation email

A second variant arrives in your inbox shortly after you search for rentals or make an inquiry. The email is designed to look like an official VRBO or HomeAway booking confirmation — correct logos, familiar formatting, urgent language about securing your dates. Embedded in the email is a QR code labeled “Complete your booking,” “Verify your payment,” or “Confirm your identity.”

Scanning the QR code opens one of two pages: a fake payment portal that collects your card details, or a phishing login page styled to look like the rental platform. If you enter your login credentials, the attacker accesses your real account, can make bookings on your stored payment methods, and locks you out by changing your email or password.

Genuine confirmation emails from VRBO, HomeAway, and similar platforms contain links back to the platform's own website — they do not include QR codes. When you receive a booking confirmation, open the platform's app or go directly to its website in your browser to confirm the reservation details. Never scan a QR code from an email, no matter how official it looks.

Why vacation rentals are a top target

Vacation rentals combine several factors that make fraud easy to execute and hard to detect until it's too late. Bookings often happen weeks or months in advance, giving scammers time to disappear before the victim arrives and discovers the problem. The transaction amounts are high — deposits of several hundred to several thousand dollars — making each successful fraud highly profitable.

Travelers are emotionally invested and time-pressured: a desirable property at peak season feels scarce, and the urgency of securing dates overrides caution. The off-platform payment request is framed as a convenience or a cost-saving measure, which sounds reasonable. And unlike hotel bookings processed by a well-known chain, direct rental payments to an individual owner are already somewhat unusual — making a QR code payment seem less out of place.

What to do right now

If you only scanned and closed the page without entering anything: Your risk is very low. Monitor your accounts as a precaution and delete the message.

If you entered card or payment details:

1. Call your card issuer immediately using the number on the back of your card. Report the charge as fraudulent, request a chargeback, and ask for a replacement card number. Do not wait for the charge to post — report it now.
2. If you paid via Zelle, Venmo, or another peer-to-peer app, contact that app's fraud or support team. These transfers are harder to reverse, but acting quickly improves your chances and creates a paper trail.
3. Report the listing to the platform where you found it. Use the “Report listing” or “Report abuse” option. Include the scammer's username and any messages they sent you.
4. File a report with the FTC at reportfraud.ftc.gov. If the scam involved a wire transfer or significant loss, also file with the FBI's Internet Crime Complaint Center at ic3.gov.

If you entered your rental platform login credentials:

1. Go directly to the platform's website and change your password immediately. If the attacker has already changed it, use the “Forgot password” option with your email address.
2. Enable two-factor authentication if it isn't already active.
3. Review your account for any bookings you didn't make or changes to your payment methods.
4. If you use the same password on other accounts, change those too and consider a password manager going forward.

For more on how to recover after paying a scammer, see QR code rental scams: how to spot a fake listing before you pay. For what typically happens after scanning a suspicious code, see what happens if you scan a fake QR code.

Frequently asked questions