Fortra says rental phishing sites use live chat to reassure travelers
Fortra says copycat rental sites use urgency and live chat to collect cards and logins; verify the site address before booking.
- Published
- Ecosystem
- Websites and CMS
- Exploitation
- No software flaw involved; Fortra says it spotted and took down phishing sites, per Help Net Security. Victim numbers not confirmed.
What happened
According to Help Net Security, which reports findings from Fortra’s Intelligence and Research Experts (FIRE) team, phishing sites imitating popular rental platforms are targeting holiday travelers. Fortra says its team spotted and took down the sites, and that the pages ask for passwords, personal details and credit card numbers. Help Net Security
Help Net Security cites a blog post by Fortra’s Elyse Neumann. She says the sites use familiar branding, copied property listings and reservation details, plus urgent messages. Visitors are told a reservation is unconfirmed, a payment has not been processed or a booking will be canceled. Other prompts push a verification step or offer limited-time pricing. Help Net Security
Examples described in the report:
- Fake login page: one site impersonated a global experiences and lodging platform on a lookalike address. Its sign-up prompt asked for contact details and social media credentials. Help Net Security
- Unconfirmed reservation: a “confirm and pay” screen marked the booking “Unconfirmed” and demanded a “mandatory verification” the visitor was told would cost nothing extra. It then asked for name, email, country and phone number. Help Net Security
- Live chat: a separate page showed a credit card form next to a live support chat. Per Neumann, the chat answered the visitor’s concerns and framed the card request as a routine security check, which “reduced hesitation and encouraged the submission of payment information.” Help Net Security
Not confirmed in the source: the names of the impersonated platforms (beyond a description of one), how many sites or victims there are, who operates them, how visitors are directed to them, and any financial losses. This is a single-outlet report of one vendor’s findings, with no independent verification.
Am I affected?
This is not a software vulnerability, and no CVE or product version is involved. Per Fortra’s account, the risk is to anyone who reaches a copycat booking page, especially through an unsolicited link, and enters credentials, personal details or card data. Neumann warns that data submitted to such a site “can be used for identity theft, follow-on phishing, or account takeover,” and that reused passwords could put other accounts at risk. Help Net Security
If you have already submitted details to a rental site you reached by an unsolicited link, the source gives no specific remediation steps. The reasoning above suggests checking whether you reused that password elsewhere.
What to do now
- Pause before completing a booking, as Neumann advises. Check the website address before entering anything. She says a listing can be copied, but the official address is much harder to imitate. Help Net Security
- Do not enter credentials after following an unsolicited link, even if the page shows recognizable logos or familiar sign-in buttons. Help Net Security
- If a message says your reservation is unconfirmed, unpaid or about to be canceled, confirm it through an official channel rather than the link or chat you were given. Help Net Security
- Treat a support chat that says a card request is routine and will not be charged as no proof the site is genuine. Per the report, this is the tactic the fake chat used to lower visitors’ guard.
- Avoid reusing passwords across services, since Fortra’s Neumann notes that credentials submitted to a fake site could expose other accounts.