VRBO QR Code Scam: What It Is and What to Do

The host QR code scam

Scammers create fraudulent vacation rental listings on VRBO — or impersonate real hosts by contacting travelers who have recently booked. After a booking is confirmed, the “host” reaches out outside the VRBO platform — by text, WhatsApp, or a follow-up email — and asks you to scan a QR code. The stated reason varies: a refundable security deposit, an additional cleaning fee, a key pickup verification portal, or a mandatory guest check-in form.

The QR code opens a payment page or form that looks plausible but is not affiliated with VRBO. You enter your card details or personal information, the money or data goes to the scammer, and you either arrive to find the property does not exist, belongs to someone who knows nothing about the booking, or discover that the “host” contacting you was an impersonator entirely.

The rule is absolute: VRBO never processes payments or check-ins outside its official platform, and legitimate hosts have no reason to collect payment via QR code. All deposits, fees, and security charges are managed within the VRBO booking flow at vrbo.com or through the VRBO app. If anyone — even someone who appears to be your real host — asks you to scan a QR code to pay or verify anything, stop and report it to VRBO immediately.

The fake confirmation email scam

A second variant arrives as an email designed to look exactly like an official VRBO booking confirmation. It uses VRBO's logo, color scheme, and layout — but it was sent by an attacker using a lookalike domain or a spoofed sender address. Embedded in the email is a QR code labeled something like “Complete your booking,” “Verify your reservation,” or “Confirm your payment method.”

Scanning the code opens a convincing VRBO login page hosted on a domain the attacker controls. You enter your email and password thinking you're signing into your account — but you've just handed your credentials to the scammer. Within minutes they can access your real VRBO account, change the password to lock you out, view saved payment methods, and make fraudulent bookings charged to your card.

Genuine VRBO confirmation emails do not contain QR codes. All reservation details, payment receipts, and host communications are accessible inside the VRBO app or at vrbo.com. If you receive an email with a QR code claiming to be from VRBO, go directly to vrbo.com in your browser — do not scan the code or tap any link in that email.

Why this scam works

Vacation rentals involve large sums, unfamiliar processes, and communication with strangers — a combination that scammers exploit deliberately. Many travelers expect some back-and-forth with a host before arrival, so a message requesting a small additional action (scan this code, confirm your deposit) feels routine rather than suspicious.

The stakes are also high on both sides. Guests are often traveling soon and worry that failing to complete a step will cost them their booking. Scammers time these messages close to travel dates to maximize urgency and minimize the chance you'll pause to verify.

One additional pattern worth knowing: scammers sometimes compromise a real host's VRBO account and send fraudulent QR-code payment requests to that host's existing guests. The message appears inside your legitimate VRBO inbox — making it far harder to spot. The tell-tale sign is always the same: the QR code takes you to a payment page outside of vrbo.com.

What to do right now

If you only scanned and closed the page without entering anything: Your risk is very low. Monitor your accounts as a precaution and report the suspicious message to VRBO.

If you entered card or payment details:

1. Call your card issuer immediately using the number on the back of your card. Report the number as potentially compromised, request a freeze and replacement card, and dispute any unrecognized charges.
2. Contact VRBO customer support at vrbo.com or through the app. Report the fake host or fraudulent email so they can investigate the listing and protect other travelers. VRBO also has a dedicated Trust & Safety team for fraud reports.
3. File a report with the FTC at reportfraud.ftc.gov. If you lost money, also file with the FBI's Internet Crime Complaint Center at ic3.gov.

If you entered your VRBO login credentials:

1. Go to vrbo.com immediately and change your password. If the attacker has already changed it, use “Forgot password” with your email address.
2. Enable two-factor authentication in your VRBO account settings if it isn't already active.
3. Review your account for unfamiliar bookings, changes to payment methods, or altered personal details.
4. If you use the same password elsewhere, change it on those accounts too and consider using a password manager going forward.

For more on what to do after scanning a suspicious QR code, see what to do if you scanned a suspicious QR code. If a rental scam was involved, see QR code rental scams: how to spot a fake listing before you pay.

Frequently asked questions