Fortra’s Intelligence and Research Experts team, known as FIRE, has documented a booking page that sits a live support chat beside a credit card form. When a hesitant visitor asked about the card request, the chat called it a routine security check and said the card would not be charged. The page belonged to a family of lookalike rental sites that copy the branding, host names, ratings and reviews of well-known short-term lodging marketplaces.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
A support window is a small detail, but it answers the exact doubt that stops a careful traveler at the payment step. Elyse Neumann of Fortra said the chat reduced hesitation and encouraged the submission of payment information, which is the whole purpose of the design.
A scripted reassurance beside the card form
Help Net Security’s Sinisa Markovic wrote up the findings on Nov. 6 in a report on rental phishing sites that use live chat. FIRE spotted the pages and took them down. One impersonated a global experiences-and-lodging platform from a lookalike domain ending in .space, and the booking flow walked visitors to a “confirm and pay” screen announcing a mandatory, free verification step.
The chat is the new element. Most rental phishing leans on urgency alone, with notices that a payment failed or a reservation will lapse. Here a seemingly attentive agent answers questions in real time, calms the objection that the card form looks unusual, and keeps the visitor inside the page, where the next step is typing in card digits. Nothing in the coverage says whether the replies came from a person or a script, a point that matters less than the result: a nervous traveler who might have closed the tab instead feels helped and goes on to pay. The trick works because it supplies the one thing a legitimate booking site also offers, a way to ask a question before spending money.
Card numbers, logins and booking details on the lookalike page
The sites gather more than a card number. According to the report, they collect card numbers, login credentials, social media credentials offered at sign-up, contact details such as name, email, phone number and country, and account information. A stolen social login can open other accounts, so the damage can outlast the one booking, and FIRE adds that data handed to a fake site can expose other accounts wherever a password is reused. Pages that ask for sign-in credentials right after an unsolicited link deserve extra suspicion even when the logos look right.
Listings look convincing because they borrow from real ones. Photos and descriptions come from legitimate properties, with locations, dates and prices shown, and the notices say a reservation is unconfirmed, a payment failed or a booking will be canceled. FIRE notes the attacks are timed for travelers whose trips are close. Neumann said cybercriminals know travelers click faster as a trip approaches, and she warned that urgent warnings can push people to click before checking the web address or confirming through an official channel.
Verification steps from Fortra and consumer regulators
Neumann’s advice is short: a polished listing does not prove that the property exists or that the booking platform is genuine, and the safest approach is to pause before completing a booking. FIRE recommends confirming reservations through an official channel instead of links in unsolicited messages, checking the site address carefully, avoiding credential entry after an unsolicited link even when familiar logos appear, and not reusing passwords across services.
Outside guidance lines up. The Federal Trade Commission’s page on rental listing scams says to walk away from anyone who pressures a renter to decide quickly, to be wary of payment requests by wire transfer, gift card or cryptocurrency, and, for vacation rentals, to get the contract before sending a deposit and to phone the resort’s front desk to verify details. The agency’s separate guidance on phishing adds that legitimate companies do not text or email a link to update payment details.
Lenders and travel writers say the same. A consumer-banking guide to vacation rental scams recommends keeping every step of payment on the booking platform and paying by credit card for stronger dispute options. In travel columnist Christopher Elliott’s advice on fake travel sites, BlackCloak chief executive Chris Pierson observes that generative AI has largely erased the spelling and grammar clues people once used to spot fakes, a change that makes a believable support chat easier to produce.
One older note is worth setting beside the new tactic. Oren Todoros of BrandShield wrote in 2023 that fake listings on large rental platforms were few and far between. The Fortra team now describes a rise in attacks that prey on booking urgency, though Help Net Security gives no count of how many chat-equipped pages exist. That gap leaves open how widespread the live-chat approach has become, and whether the page FIRE removed was an experiment or one sample of a larger kit that other operators are already copying across the holiday booking season.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
