When It’s This Easy To Take Someone’s Money…

Earlier in the month I wrote about fraud in the advertising technology ecosystem – a post which has spawned dozens of fascinating conversations that I will continue to write about here and elsewhere. But this past weekend I encountered another kind of scam – a combination of time-honored phishing (online identity theft via social manipulation) and good old-fashioned wire fraud.

My family has been going to a small island off the coast of Massachussets for my entire life – my grandparents are buried there, my great grandmother moved there around the turn of the century (1900, not 2000!). My mother owns a cottage near the beach, a cottage that my great-grandmother purchased nearly 100 years ago.

Suffice to say, I have a deep history with the place. But with a bevy of kids and friends descending upon us each summer, my family has outgrown the cottage, so we’ve started looking for a larger place to rent. Like most folks these days, we turned to the Internet. We fired up VRBO.com, a popular marketplace for quality vacation rentals. It’s a great site for checking the market, and my wife and I figured we might get lucky and find just the right place.

We refined our search to mid-sized homes in Edgartown, MA available on the dates we wanted to stay. Most of the good places were above our desired price range, but one listing really stood out:

We are very familiar with the location of this house, having stayed nearly across the street a few years back. And boy, was the price right – about one-third that of similar homes in the neighborhood. This was a “new listing,” VRBO told us, meaning we were one of the first folks to find it. We better act quick, before this deal goes away!

We emailed the owner using VRBO’s contact widget (shown at right in the screen shot). Within hours, the “owner” had contacted us back. She was ready to send us a contract with payment information right away.

Now, I’ve been around long enough to sense when something wasn’t quite right. First off, she was using a non-personal email from Yahoo (the handle was “livinghome1234” or somesuch). And the owner’s last name (her first was Kathy) seemed vaguely machine-generated – I won’t repeat it here just in case a real person’s identity has been stolen and re-used to portray the “owner.” When I put the name into Google, I got the kind of results that aren’t exactly comforting – a barely used Facebook page of a person in rural Pennsylvania, and a ton of “find this person” websites. It struck me that someone who owned a million-dollar home on Martha’s Vineyard probably had more of a digital footprint than this.

Secondly, the deal did seem too good to be true. Was I about to take advantage of some poor elderly woman who didn’t understand the true value of her home? Given my history with the island, I didn’t want to be the guy who did that. I decided to cross check Kathy’s name with public real estate records for the address in question.

Turns out, they didn’t match. The real owner of the property was a very nice-looking older woman who was obviously a real person – a year or so ago she had penned a sweet obit in a local paper for her dearly departed poodle. (I know the type very well, she reminded me of my Mom, who spends a lot of time on the island with her beloved golden retriever). Hmm. Well, could be that the person who contacted me – Kathy – was just an agent working on the owner’s behalf. That certainly happens a lot. I called the real owner’s number (it was listed in public real estate records), but got a full answering machine. Darn.

Cautious but still optimistic, I told “Kathy” to send me the contract.

It was about this time I got the following email from VRBO:

Ah, drat. The listing was believed to be a fake.

But hope springs eternal, no? I awoke the next morning to a contract from Kathy. It included wire transfer instructions for the full amount of the rental, to a bank based, interestingly, in the same town as the rural Pennsylvanian’s hollow Facebook page. And it had a phone number at the top – which, when dialed, informed me that the Google Voice subscriber I had called was not available.

At this point I abandoned all hope of snagging that swell house in Edgartown, and called VRBO’s fraud department. They  were nice, but not very helpful, reminding me that the site is “just an advertising service” that does its best to protect its users, but, to summarize: Buyer beware. I asked what made VRBO suspect that the listing was fraudulent, but the nice man on the other end of the phone refused to give any more information, citing privacy concerns.

So, why am I writing all of this up? Isn’t this just another pedestrian case of Internet fraud? Well, yes, and that’s kind of the point.

Think about how easy it was for the fraudster to run this scam. First, scrape all the information from a real listing (probably last summer’s in this case), and resubmit it under a different identity.  Second, create a free email account and Facebook page for an owner’s identity, just in case a renter Googles the fraudulent name (as I did). Third, leverage Google’s free phone service to provide a contact number. And fourth, set up a bank account to collect the dough. Lather, rinse, repeat! After all, if only one in 10,000 attempts gets you a hit, it costs you nothing but time to create those 10,000 opportunities. And with some simple programming scripts, even your time isn’t really that taxed.

When it’s this easy to set up fraudulent transactions, they will flourish – and indeed, within a few hours of my being told about the listing’s suspicious nature, it was up again on VRBO, under a new listing number but otherwise unchanged. (I told VRBO about the new listing, and they once again banned it. But apparently, they don’t have any way to stop someone from listing it yet again.)

A quick perusal of the community boards on VRBO (or any other rental marketplace) reveals that this kind of scam happens a lot in the listings business. And there are some pretty basic steps one should take to insure you don’t get fooled. But to my mind the larger story here is one of incentive, trust and identity. If you take a look at the incentives working on VRBO, it becomes clear how easy it is to game the platform. VRBO wants to make it as frictionless as possible to list hot properties on its site. Renters like me want to quickly score the best deal on a hot property. And owners want to connect to VRBO’s vast market of potential renters.

But VRBO’s business model is also based on trust – as consumers of the service, we want to trust that the identities of those listing their homes for rent are in fact authentic. And clearly, for the vast majority of listings, that is the case. But given how easy it is for scammers to game the system with false listings, I don’t think I’ll ever be sending money to anyone I’ve met via their platform. And that’s a shame – because if VRBO and others took the time to qualify their marketplace up front, this kind of fraud would be far less rampant.

I think there’s a lesson here for all of us in the marketing industry. There are always going to be bad actors trying to game complex systems. Back when click fraud was a major issue, our industry had one major player who had the incentive to clean it up – Google. Google was the dominant player in search, and was a newly public company that couldn’t afford to be seen as profiting from fraud. But the programmatic adtech space is deeply fragmented, with scores of players, all of who are – according to many sources – reaping untold millions in revenue from fraudulent behavior. In short, the incentives to clean this up aren’t exactly aligned.

But imagine if just one major marketer – playing the role of the defrauded rentor – decides to make a public stink about fraud in programmatic exchanges, declaring they’ll never again spend money there. When that happens, our burgeoning ecosystem is imperiled. So once again, I say: It’s time for us to get further out in front of this problem. I’ll have more on how we might do so in future posts. Meanwhile, wish me luck in finding a place to stay this summer – from now on, I’ll be working with real humans who work on the island and know the owners personally. It might cost me more, but at least I’ll have a place to stay at the end of the day.