Inside Airbnb’s Russian Money-Laundering Problem

As a recently unsealed indictment against former Trump campaign manager Paul Manafort showed, not even Airbnb is safe from money launderers. But Manafort isn’t the only one allegedly funneling dirty money through the mega-popular accommodation service. Scammers are leveraging Airbnb to launder dirty cash from stolen credit cards, according to posts on underground forums and cybersecurity researchers consulted by The Daily Beast.

The news shows how fraudsters will seize any opportunity they can, especially when there is an opening for pushing cash through online services, which sometimes require relatively little effort, a computer, and just a bit of creativity.

“People [have] been doing it forever,” one current and experienced credit-card scammer told The Daily Beast.

The Daily Beast found a number of recent posts on several Russian-language crime forums, in which users were looking for people to collaborate with to abuse Airbnb’s service. According to Rick Holland, VP of strategy from cybersecurity firm Digital Shadows, these operations rely on an individual or group using legitimate or stolen Airbnb accounts to request bookings and make payments to their collaborating Airbnb host. The host then sends back a percentage of the profits, despite no one staying in the property. 

In essence, it’s a way to extract value out of stolen credit cards. In another case, fraudsters might buy electronic goods such as iPhones with stolen cards to then resell at a profit. This is the same idea of laundering funds, just with Airbnb.

“The money is 50/50,” one apparent scammer wrote on a Russian crime forum in August. “You receive the money within two days after the booking date,” it continues, and adds that there are “story-telling hosts” ready, likely referring to hosts who are in on the laundering.

Another poster on the same forum says they are looking for “hosts for cooperation,” and a third implies they will launder the funds specifically through Russian hosts who already have reviews on Airbnb.

When a customer stays at a host’s property, the customer is encouraged to leave a review, so other potential vacationers, and perhaps Airbnb, can know if the host is legitimate. The scammers appear to circumvent that protection by, in some cases, using real but corrupt hosts.

A fourth apparent fraudster on a second Russian-language crime forum says they are looking for people to receive and withdraw funds from Airbnb, but “we need long-term cooperation on an ongoing basis,” the post adds. A fifth carder on another Russian forum said they were looking for “permanent” hosts to funnel between $1,000 and $3,000 at a time.

The laundering may work outside Russia as well. In another post, a sixth scammer, who is also willing to split the cash 50-50, says they are looking for hosts and “the country does not matter,” their post reads. Another post on a Russian-language forum is looking for EU-based hosts. The majority of the posts The Daily Beast found were from this year.

Rather than hunting out current hosts, scammers may also want to use hacked Airbnb accounts, or purchase some in bulk. In February, an apparent fraudster posted on an English-language forum looking to buy Airbnb accounts, and said they were willing to pick up a maximum of 10 a day. 

Holland from Digital Shadows added “this is yet another example of how criminals creatively exploit online marketplaces and peer-to-peer sharing platforms for their nefarious activities.” 

“Airbnb itself is not being targeted here as such. Instead, the platform itself is being leveraged and misused to facilitate a wider card-fraud operation. Airbnb is used in this example, but cybercriminals opt for a range of services, be it e-commerce sites and retailers or money-transfer services,” he said.

The experienced carder said that, compared to other forms of fraud such as laundering funds through payment processors like Stripe, Airbnb might be more expensive because of the need for approved seller accounts and history to get past the service’s fraud protection.

Although the scam is discussed across several different forums, it is not clear how widespread or narrow this abuse of Airbnb is. In its terms and conditions, Airbnb writes “user verification on the Internet is difficult and we do not assume any responsibility for the confirmation of any member’s identity.”

For transparency and fraud-prevention purposes, Airbnb may ask users to provide a form of government identification in order to verify their identity or background. It’s unclear how effective that might be at weeding out hosts who have legitimately signed up for the service, but then decided to funnel some cash for scammers.

Airbnb takes a cut, usually around 3 percent, from the host with every booking. And the company also adds on a service fee for guests of between 5 and 15 percent. Presumably, these commissions would still apply even while a listing may be used for laundering purposes. 

Nick Shapiro, Airbnb’s global head of trust and risk management, provided a statement to The Daily Beast.

“We have a real-time detection system that scores each and every Airbnb reservation ahead of time for risk. Using machine learning and predictive analytics, models instantly evaluate hundreds of signals to flag and then stop any suspicious activity,” Shapiro wrote.

The statement also said “Airbnb uses a multi-layer defense strategy to prevent fraudsters from ever accessing the platform in the first place,” but how that squares with the reality that one half of this scam relies on real hosts or legitimate but hijacked accounts is unclear.

“When we are made aware of suspicious credit-card activity, we employ micro authorization friction and 3D-Secure to verify if a credit card is being used by its owner and assess the level of risk associated with a transaction. We also do a number of things to safeguard Airbnb accounts themselves, including using multi-factor authentication whenever a login is attempted from a new device,” Shapiro continued.

But in the modern world, carding is just a reality.

“If long-established and reputable e-commerce and retail providers are struggling with carding activity, then it’s no surprise that a relatively new service like Airbnb is also affected,” Holland said.