The rental villa on the French Riviera that Sonia Guillaume found online looked picture-perfect. It featured an impeccably manicured garden, spacious living areas, a pool and stunning views of the medieval village of Saint-Paul-de-Vence.
And there was the price: 10 percent off the weekly 1,700-euro rate in August, a time when pretty much all of France is on vacation.
"It was a scam," says Guillaume, a subcontracting manager who lives in Poissy, a suburb of Paris.
I've been following similar incidents since the fall. In a report that I wrote in January, HomeAway promised to crack down on phishing and to work with victims to save their vacations. But since then, more defrauded renters and homeowners with listings on HomeAway have come forward to tell their stories.
Rental owners complain that they're being unfairly blamed for the phishing. And customers allege that the company's attitude is dismissive, that it's showing little interest in rescuing their ruined vacations or bringing the scammers to justice.
HomeAway, which also operates VRBO.com and has a commanding share of the vacation rental market, says that nothing could be further from the truth: It hasn't been contacted by any law enforcement officials about a phishing case, but if it were, it would fully cooperate with any investigation. The company has added phishing warnings to its sites and recently posted a job notice for a director of global fraud prevention to help manage its efforts to "detect, prevent and mitigate fraud and other undesirable events."
I tried to reach the victims. One of the customers, Guillaume, says that no one from HomeAway has contacted her with a resolution. (I brought her case to HomeAway's attention March 16, and the company says that it has tried to reach her but that she hasn't responded.)
Another would-be renter, Tania Rieben, says that the company hasn't helped her, either. HomeAway says that the property manager has offered her a resolution that she hasn't accepted.
Kathryn Bowden, an artist in Sorrento, Fla., who says she lost $3,800 on a vacation rental in Kissimmee, Fla., that HomeAway listed, told me a story that matched many details of Guillaume's case, including the location of the fake homeowner, the size of the discount and the way the scam was perpetrated. I contacted HomeAway on her behalf in mid-February.
"The only thing I have heard from HomeAway is that they expect the owner of the property we tried to rent from to resolve any issue," she says. "It makes it sound as though they feel the owner is somehow to blame and must make restitution. That's their choice of words, not mine."
Bowden says that she and a group of other unhappy customers plan to file a class-action lawsuit against HomeAway.
Some HomeAway customers didn't respond to my inquiry because they'd been required to sign nondisclosure contracts as part of their settlement with the company.
But one customer who was privy to the details of a HomeAway settlement agreed to tell me her story. Alisa Golson, a former human resources consultant and a stay-at-home mom in San Francisco, contacted me in December after her mother-in-law wired $7,300 to a scammer for a rental property in Capistrano Beach, Calif., that she'd found through VRBO. She says that the company has urged the homeowner to settle with her family, but that he has refused. HomeAway insisted that it wasn't to blame, either.
"They appeared to do little or no investigation into what happened," she says. "They took a very strong stance that they were not responsible."
So her mother-in-law hired an attorney, who contacted HomeAway. The company eventually agreed to cover the $7,300 she lost in the scam, Golson says.
Carl Shepherd, HomeAway's co-founder, says that his company doesn't take the phishing attacks lightly and cares about the outcome of every case. "We are taking this seriously," he says. "We launched a significant education effort to travelers and our owners. We're working with other people in the industry, and we've had two summit conversations with them to collectively combat phishing. Also, we're developing some product changes that we hope to announce soon."
He added that even though HomeAway has "no legal responsibility" for phishing, "we work diligently with both the owner and the traveler to find an appropriate solution, and when all parties are looking for something equitable, they usually work something out."