The 'new' Airbnb: Too little, too late?

The popular travel site is trying to beef up its security after one member's nightmare experience went viral. But it's still too easy to game.

Anyone who’s followed the Airbnb saga earlier this summer is familiar with the story of EJ, a San Francisco woman who lent out her apartment via the short-term rental site and came home to find her place completely trashed, her identity stolen, and her life turned upside down.

Her blog posts – including some detailing Airbnb’s less than exemplary response to her plight, and its apparent attempts to keep EJ from going public with her story -  ignited a storm of bad publicity for the service and incited some changes in how Airbnb does business. In fact, yesterday Airbnb issued a new terms of use agreement, which now incorporates a $50,000 insurance policy against renters trashing your place.

I have a particular interest in this story, because I list a rental property on Airbnb and have booked people via the service. From personal experience I can tell you it is both extremely efficient and more than a little Big Brotherish.

Once you list your property (for free), Airbnb takes care of everything – it handles the reservation request, takes payment from renters, takes a security deposit if you require one, distributes your rental agreement and policies to the renter, disburses payment to you after they’ve checked in, and returns their security deposit (assuming there are no issues). And, of course, Airbnb collects from 3 to 12 percent of the total transaction from both the renter and the rentee for this service.

When someone wants to book your place, Airbnb sends you an email; you have 24 hours to accept or decline the reservation, or face penalties like having your property dropped lower on its list. There’s even a countdown clock like the one on the TV show “24” to goad you into responding more quickly.

Wait, did I say Airbnb takes care of everything? That’s not entirely true. What Airbnb doesn’t take care of is verifying that renters are who they claim to be. In fact, the new terms are explicit on this:

Airbnb does not endorse any Members or any Accommodations. In addition, although these Terms require Members to provide accurate information, we do not attempt to confirm, and do not confirm, any Member’s purported identity. You are responsible for determining the identity and suitability of others who you contact via the Site, Application and Services.

This is of course where EJ ran into Airbnb Hell. Whoever rented her place apparently used a false identity and a stolen credit card. Even then, this policy might be acceptable if Airbnb gave you some other way to verify renters’ identities. But it doesn’t. In fact, the service does everything it can to keep you from contacting potential renters in any way other than through Airbnb.

You can exchange information via Airbnb’s own messaging service, but you can’t exchange phone numbers, email addresses, or the addresses of other Web sites with someone until after you’ve said Yes to a reservation. Airbnb will literally censor your messages and remove this content.

This can get pretty ridiculous. For example, I recently responded to a potential renter by asking for more information about who he was, and suggested he Google “Airbnb nightmare” if he wanted to know why. Airbnb sent him the message but censored the word “Google” – so it reads

… given the recent well publicized stories about Airbnb ((website hidden) "Airbnb nightmare" if you're unfamiliar with them), I'd like to know a bit more about you.

You’re not entirely without protections, but they’re tissue-paper thin. You can require that anyone who wants to rent your joint post a photo of themselves, say why they want to rent your place (like that’s gonna help), and have their phone numbers verified via an SMS or robocall. (This is turned off by default.) You can also rely on reviews of the renter by other Airbnb members, if there are any, and/or only rent to people who’ve linked their Facebook, Twitter, or LinkedIn accounts to their Airbnb account.

The problem is that this system can be easily gamed. It took me about half an hour to create a fake Airbnb profile, upload a bogus picture, link it to a false Facebook account, and have the verification code sent to a free Internet VoIP number.

[img_assist|nid=194219|title=Tick tick tick: Is this renter real? You have less than 24 hours to decide.|desc=|link=none|align=center|width=546|height=550]

There’s no way to actually view a person’s Facebook, Twitter, or LinkedIn account to suss out if they’re real; you have to take Airbnb’s word for it. I did have to provide real payment information (via PayPal), so any scammers would have to steal someone else’s account or credit card number. But it’s not like that doesn’t happen thousands of times a day.

Airbnb is also planning to roll out an address verification service where it mails something to an address provided by the renter. It wasn’t in operation at press time, so I’m not sure how this would work. But anonymous mail drops have been used by scammers for decades, so I’m not sure this would make much difference.

The problem with Airbnb is that the risk isn’t evenly distributed. If you rent via Airbnb you risk getting a crappy place for your money. If you list your place on Airbnb, you risk having it destroyed and your life upended. That’s just too much incentive for scammers. 

Despite Airbnb CEO Brian Chesky’s public apologies and offers to fully reimburse EJ for her losses, from her most recent blog post it’s clear she’s not recovered from this experience and possibly never will. Money can only fix so much. Airbnb needs to fix itself.

TY4NS blogger Dan Tynan is still debating whether to continue to use Airbnb.Visit his snarky, occasionally NSFW blog eSarcasm or follow him on Twitter: @tynan_on_tech. For the latest IT news, analysis and how-to’s, follow ITworld on Twitter and Facebook.

ITWorld DealPost: The best in tech deals and discounts.
Shop Tech Products at Amazon