Holiday villa fraud that's hit countless British families: You arrive at that dream villa to find the owner's never heard of you - and you sent your cash to a chillingly plausible conman

The Peggs paid £1,650 for holiday home booked via Owners Direct website
But their money went to a fraudster rather than the French villa's owner
Hackers may have stolen £25m from holidaymakers in past five years
Victims believe that the police are doing little about the problem

By JILL FOSTER FOR THE DAILY

For Chris and Annia Pegg, a two-week break in the South of France every summer is the perfect way to unwind. The couple and their two little girls take a scenic drive down through the French countryside before arriving at their rented gite.

‘We choose locations with their own pool where the children can play and we can just get away from it all,’ says Chris, 42, an IT manager from Tamworth, Staffs.

This January, the couple and their daughters, Jessica, nine, and Emily, seven, were more in need of a quiet break than ever.

Devastated: Chris and Annia Pegg with their daughters Emily and Jessica. The couple were scammed after paying £1,650 to book a holiday villa in the South of France through website Owners Direct

‘My father-in-law had been diagnosed with cancer, so it had been a rather stressful few months,’ Chris explains.

Just after Christmas, Annia, 39, a teaching assistant, went onto the Owners Direct website to search for a property.

The family — like more than 500,000 Britons who booked their holiday through it last year — love the site for the sheer variety that it offers.

Owners Direct, which was launched in 1997, works like an online travel brochure. Thousands of properties are advertised on the site, from cheap, cheerful apartments to luxury houses costing several thousands a week.

Owners pay the site £219 a year to advertise their properties — and reach a much larger audience than if they had advertised privately in magazines and on the internet.

Holidaymakers browse through the properties to find one they like, then contact the owners ‘direct’ by clicking the ‘Enquire Now’ button.

During this process, the renters fill out an online form that asks for their email address. The villa owner then receives an email from Owners Direct to say someone wants to rent his property. He can access their details by clicking on the link and logging in to his Owners Direct account.

Retreat: The holiday home the Peggs thought they had booked. Owner Hamish Porter had no idea that the couple had booked his villa in the South of France - or that they had paid for the privilege

From then on, owner and renter deal directly to arrange contracts and payments.

Of course, there is always an element of caveat emptor — buyer beware — when buying anything online and this is no different. And now the website is at the centre of a scandal that’s affected at least 12,000 property renters worldwide.

It is thought hackers may have stolen more than £25 million from holidaymakers — hundreds or even thousands believed to be British — in the past five years. And victims believe the police are doing little about it.

‘We’ve used Owners Direct for years with no problem, so when Annia spotted a place in a pretty little town called Fiac, she emailed the property owner via the website,’ says Chris.

‘A man called Hamish responded and, after we’d corresponded over email, we agreed to rent out the property in the first week of August.

Final destination: Fortunately the couple were able to afford to holiday at another villa, where Emily and Jessica are pictured jumping into the pool

Hamish, emailing from a Hotmail account, asked if we could send the money to his online Barclays bank account.

‘I thought it a little odd to ask for all the money at once but because we didn’t want to lose it, we paid £1,650 into Hamish’s bank account and that was that.’

But the Peggs’ money had not been deposited into the property owner’s account at all. Yes, the property owner was called Hamish. But retired solicitor Hamish Porter had no idea the family were keen to rent his holiday home, let alone that he had allegedly been ‘paid’ for the privilege.

Hackers had intercepted the Peggs’ messages. It is believed they do this by sending owners like Hamish a fake enquiry from a potential renter — which looks just like a genuine Owners Direct enquiry.

When the owner clicks on the link, it takes him not to the genuine Owners Direct page, but to a fraudulent duplicate webpage created by the hacker.

When the owner enters his details onto this fake page, he unwittingly gives the fraudster access to his email account.

From then on, the scammer can pretend to be the owner, intercepting emails from would-be renters, replying, answering questions, sending out fake contracts and asking for payment directly into his own bank account — and deleting all evidence as they go.

Hamish — the real one — says the first he knew about the scam was two weeks after Chris had made his booking when he got a phone call — his genuine number appeared on the Owners Direct website — from another potential renter.

‘He thanked me for sending a rental contract when I knew I hadn’t,’ says Hamish, 62, from London.

‘When I asked him more about it, it was clear he’d been defrauded by someone pretending to be me and I asked him to send me the email chain. He did and I still didn’t receive it because the perpetrators were intercepting my emails and deleting them.

‘I spoke to him again, set up a different email account using Gmail and asked him to send it again. That’s when it became clear what had happened.’

Hamish forwarded this email exchange to Owners Direct, and two weeks later learnt that four people — including Chris and Annia — had tried to inquire about the property through the site.

Distraught: After several conversations, Owners Direct gave Chris and Annais (pictured left) back £700 - but the couple still lost nearly £1,000. Fortunately they were still able to go on holiday with their daughters (right)

‘I obtained their email addresses from Owners Direct and emailed them — that’s when I found out two couples had lost money,’ says Hamish.

‘I felt extremely sorry for them. The other couple said they had sent their entire holiday fund to the fraudsters and now couldn’t afford to go on holiday. It also made me feel very exposed. If they can hack into my email, what else can they hack into?

‘I emailed Owners Direct again and asked if they were going to report it to the police, but they said it wasn’t their responsibility as it was my email that had been hacked.

‘I wasn’t very happy, surely I wasn’t an isolated case? The police would be more interested if the incidents were reported to them as one larger fraud.

'We’ve had people turn up expecting to have their wedding here with nowhere to stay because they’ve been conned. Mostly, we manage to accommodate them at a discounted rate, but at other times they have been stranded'

‘But the website didn’t seem interested in pursuing it so, as far as I’m aware, nothing happened. My subscription lapsed in June, so I didn’t renew it, and now I’m only going to let it out to friends.’

When the Peggs learned the truth — after the ‘real’ Hamish contacted them — they were devastated.

‘My wife was distraught, in tears,’ says Chris. ‘The real Hamish told me that the villa was already booked for the week we wanted and there was nothing he could do to accommodate us.

‘He told me he’d contacted Action Fraud (the UK’s national fraud and internet crime reporting centre) and I did the same. I called my building society to see if they could get the money back, but there was nothing they could do.

‘We contacted Owners Direct customer services, who said at first that because we hadn’t taken out their insurance there was nothing they could do. But, after several conversations, they eventually gave us back £700. But we’ve still lost nearly £1,000.’

Thankfully, the family were still able to afford to go on holiday — to a different farmhouse that they also booked through Owners Direct.

This time they made sure they had proof the villa owners were genuine by asking to see an electricity bill for the rental property.

‘I’m just glad we found out before we’d set off or we might have turned up and had nowhere to stay,’ he says.

The Peggs are not alone. In just three days, a Mail investigation has uncovered 24 British holidaymakers who have been scammed using Owners Direct.

Many did not want to speak publicly about being conned, but they include a mother of a young boy with Down’s syndrome, who lost nearly £3,000 to a fraudster after booking a holiday on the Costa Del Sol, and a hen weekend that was ‘ruined’ when the bride-to-be paid £1,800 for a rental property only to find another hen party — the legitimate customers — in it when she arrived.

Beth King, 67, a retired maths teacher who owns a villa on the Indonesian island of Bali, is co-ordinating a campaign for holidaymakers using Owners Direct and other travel websites run by parent company HomeAway who have been scammed by fraudsters.

‘People have lost money ranging from about £1,500 to more than £10,000. For some reason, the UK was particularly badly hit by this scam but the police still refuse to treat it as one single crime.

‘Yet bank accounts the fraudsters use are British and the home addresses they use to set these up are also in the UK.

‘I’ve seen hundreds of fake emails and they all use the same phrases, the same kind of discounts, the same signatures and names. I’m convinced it’s one organised criminal gang.

Prepared: The next time the Peggs booked they made sure they had proof the villa owners were genuine by asking to see an electricity bill for the rental property

‘Yet even when we’ve offered the British police irrefutable evidence of an ongoing scam, they don’t seem interested in investigating it.’

Owners Direct is part of U.S. parent company HomeAway, the world’s biggest villa rentals company, which has more than one million listings of homes in 190 countries.

HomeAway’s chief executive Brian Sharples has publicly claimed that ‘phishing’ scams — when hackers pose as someone else to defraud a victim — account for around 0.1 per cent of the website’s transactions.

It may sound a small amount, but it’s no consolation to the thousands of heartbroken holidaymakers who lose money or find themselves stranded with nowhere to stay.

Of course, it’s not only holidaymakers being conned. Villa owners don’t lose money but they have their identities stolen and their reputations as honest landlords destroyed.

Nick Hyam, 55, is a UK citizen who owns five properties in Bali and looks after another 120 holiday homes there.

‘This scam is the bane of our lives,’ he says. ‘At least once a month someone turns up at the airport expecting to rent a villa and we’ve never heard of them.

‘We’ve had people turn up expecting to have their wedding here with nowhere to stay because they’ve been conned. Mostly, we manage to accommodate them at a discounted rate, but at other times they have been stranded.’

Nick admits his frustration lies not with the website itself, but with the British police.

‘They’re just not interested,’ he says. ‘The criminals know that they can get away with it. One of my friends who owns a villa recently sent an email to the hacker saying he had reported them to the police and we were going to catch them. The hacker wrote back: “F**k you mate, we could be your worst nightmare.”

What’s more, it seems there is no way to find out where these emails originate from.

IT security expert Graham Cluley explains that it’s all too easy for hackers to keep their identity and location private.

HOW TO MAKE SURE THAT YOUR HOLIDAY IS SAFE

Owners Direct and Action Fraud say following these simple tips will help you stay safe when renting a holiday home online:

Ensure that you speak on the phone (not just by email) with the person renting the cottage. Any legitimate individual letting a property will provide their direct phone number on the site — if they do not, exercise caution.
Never pay directly into a bank account until you verify that the owner is legitimate. Paying by direct bank transfer is like paying by cash — the money can’t be traced and is not refundable.
Where possible, pay by credit card or a debit card that offers insurance — they are traceable and refundable, according to the provider’s terms and conditions.
Check reviews on properties you are interested in to see what previous guests had to say about their experience.
Ask for a rental agreement — a signed rental agreement between the owner and the guest helps protect both parties. Typically, each owner or manager has their own payment and cancellation policies and house rules.

‘It’s trivial for criminals to hide their public IP address if they want to, making it much harder to track down where they might be in the world.

‘One typical method would be to leapfrog from compromised computer to compromised computer, and use someone else’s hijacked computer to access their email — hiding where the criminal is based. And many services online can help keep your identity and location private.’

The Mail has seen evidence of 28 fraudulent contracts sent out to different victims — from different ‘owners’ — all containing the same illegible signature.

‘These crimes are clearly executed in a manner that suggests organised criminal groups, but you’d need to be cautious about reaching a conclusion that it’s always the same group as methodologies are sold and traded within the criminal world,’ says a spokesman for Action Fraud.

A spokesman for the Metropolitan Police agrees: ‘Our ongoing investigation suggests more than one organised crime group is carrying out these offences. We are investigating a number of offences and have identified various lines of inquiry.’

Action Fraud says consumers must try to protect themselves by speaking directly to the person renting the villa — and never pay directly into a bank account until they have verified the legitimacy of the owner.

Affected holidaymakers are also angry with Barclays bank. About 90 per cent of the victims who have contacted Beth King’s campaign have sent money to Barclays bank accounts.

'We thought the holiday wouldn’t be happening and we’d lost all this money but, by stroke of luck, the villa was still available'

Campaigners believe this is because other banks have tightened security in recent years, making it harder for hackers to set up bank accounts using foreign ID. So why can’t Barclays identify scammers from their accounts?

A Barclays spokesman says: ‘We owe a duty of confidentiality to each of our customers. If we release information regarding these customers and their accounts without consent — or without a court order — Barclays is in breach of its duties.

‘Where appropriate we share details of customers involved in fraudulent activity via an industry-wide database to prevent further scams involving the same individuals. We also make reports to the National Crime Agency.

‘Barclays does not open accounts with dubious ID or inadequate verification.’

An Owners Direct spokesman says: ‘While the instances of fraud are extremely rare on our sites, we are always looking for ways to make the marketplace safer.’

In the meantime, more British holidaymakers are falling for the scam. Emilia Carslaw, 21, was one of 17 students from Jesus College, Oxford, who clubbed together to go on holiday.

They found a villa in Spain and inquired about booking it for a week in July. The ‘owner’ got back to them almost immediately, saying that if they paid upfront, they could have a discount price.

‘The villa looked incredible,’ says Emilia, who is about to begin her fourth year of studying Classics.

‘It had a lovely pool, a volleyball court, an outside bar with beer on tap and even a football pitch.’

‘We each paid £188 and we were all so excited about going on holiday that we thought we’d stumbled on a really great bargain.’

But as the departure date grew nearer, the group realised something was wrong when the ‘owner’ suddenly went AWOL. Then the real owners, realising their email had been hacked, got in touch.

‘They had no record of our booking. We thought the holiday wouldn’t be happening and we’d lost all this money but, by stroke of luck, the villa was still available. The owners said it had happened before and must have felt sorry for us because they gave us a big discount.

‘It was incredibly kind. Owners Direct were also very helpful and offered us £800 compensation.

‘We didn’t need to take it because I paid by Mastercard, which provides insurance against this sort of thing, and they had already refunded us the entire amount.

Thankfully our holiday wasn’t ruined. We were so lucky to get it sorted out but other people might not have been so fortunate.’

Follow @

Holiday villa fraud that's hit countless British families: You arrive at that dream villa to find the owner's never heard of you - and you sent your cash to a chillingly plausible conman

HOW TO MAKE SURE THAT YOUR HOLIDAY IS SAFE

0 comments:

Post a Comment

Popular Posts

Choose

Comments

Blog Archive

Holiday villa fraud that's hit countless British families: You arrive at that dream villa to find the owner's never heard of you - and you sent your cash to a chillingly plausible conman

HOW TO MAKE SURE THAT YOUR HOLIDAY IS SAFE

Next

Newer Post

Previous

Older Post

0 comments:

Post a Comment