QR Code Quishing Impersonating Airbnb at Properties
Criminals place fake Airbnb QR codes at short-term rental properties or in pre-arrival communications, redirecting guests to phishing pages that harvest Airbnb login credentials or attempt off-platform payment collection.
Part of: Quishing: Physical Payment Point QR Code Scams
Last reviewed: 8 June 2026
Airbnb guests increasingly interact with properties through QR codes — digital guidebooks, Wi-Fi network instructions, and check-in instructions for smart-lock access are all commonly delivered this way. Criminals exploit this expectation by placing fraudulent QR codes at properties or embedding them in fake Airbnb pre-arrival communications.
Unlike hotel-based quishing attacks, Airbnb QR code fraud can be perpetrated by bad-faith hosts who include fraudulent codes in a property's welcome materials, or by external criminals who compromise a host account and intercept guest communications. Both scenarios direct guests to phishing pages under the guise of legitimate Airbnb check-in or payment flows.
The particular danger of the Airbnb context is that guests are already navigating an unfamiliar property and are more likely to follow QR-based instructions without scrutinising the underlying URL, especially if the code appears to be an expected part of the check-in experience.
How this scam works on the Airbnb brand
A fraudulent Airbnb host includes a QR code in a printed welcome guide left in the property. The guide looks professional and is styled with Airbnb's brand elements. The QR code is labelled 'Scan to access the digital house manual' or 'Scan to leave us a review'. The code links to a page styled after airbnb.com and asks the guest to log in, capturing their credentials.
In the pre-arrival variant, a criminal who has obtained the victim's booking details sends a fake Airbnb message with a QR code for 'secure check-in identity verification'. Guests accustomed to this type of request in real Airbnb communications are more likely to comply without close inspection of the URL.
Some fraudulent hosts use the check-in QR flow to demand an off-platform deposit, claiming Airbnb requires additional security payment for the property. The QR code links to a fraudulent payment page.
Common red flags
- A welcome guide QR code opens a URL that is not airbnb.com
- The page asks for your Airbnb login credentials for what is framed as an access or review function
- A pre-arrival message asks you to scan a QR code to complete an identity check or make an additional deposit
- The host requests any payment through a link or QR code outside Airbnb's platform
- The QR code sticker appears to be placed over an original printed code in the property materials
- The check-in instructions reference an urgency or deadline not consistent with standard Airbnb messaging
How to protect yourself
- Access all Airbnb communications and documents through the official Airbnb app rather than scanning external QR codes
- Verify any QR-scanned URL begins with airbnb.com before entering any login or payment information
- Report any request for off-platform payment immediately to Airbnb — this violates Airbnb's terms and is often fraudulent
- Enable two-factor authentication on your Airbnb account
- If a property's welcome materials seem designed to harvest credentials, report the host via the Airbnb app
- Contact Airbnb via the Help Centre if you receive suspicious pre-arrival communications that reference your booking
How to report it
- Report the host or fraudulent communication to Airbnb via the in-app Help Centre
- Report to the FTC at reportfraud.ftc.gov
- If off-platform payment was made, contact your bank and file a report with the FBI at ic3.gov
- Leave an honest review of the property so future guests are warned
Frequently asked questions
Does Airbnb ever send QR codes in pre-arrival messages?
Airbnb may include QR codes for affiliated services, but genuine Airbnb identity verification and payment flows happen within the Airbnb app — not through external QR codes in emails. Be sceptical of any QR code requesting a login or payment.
Can a fraudulent host place fake QR codes in a property?
Yes. Bad-faith hosts can include fraudulent QR codes in printed welcome guides or on physical signs within the property. Always verify URLs after scanning and use the Airbnb app for all account interactions.
I paid an off-platform deposit via a QR code link. What should I do?
Contact Airbnb immediately via the Help Centre and report the off-platform payment request. Contact your bank to dispute the payment. Airbnb can investigate the host and may assist with recovery.