Vrbo

Is Vrbo safe to use?

Mostly yes, as long as the money moves through Vrbo. It is a large, established rental site owned by Expedia Group, its app collects less for tracking than most travel apps, and we found no fine against it. The risk sits with listings and the people behind them: copied homes and "owners" who want to be paid by Zelle, Venmo or wire. We score Vrbo 57/100.

The off-platform payment scam

Vrbo rents whole homes from owners and property managers, so the person you deal with is usually a stranger rather than a hotel. That is the opening for fraud. In a case reported by ABC7 New York in August 2021, a scammer copied a real Fire Island listing word for word and posted it on Vrbo. When the family made contact through the site, he asked them to call his mobile instead, then took a $1,000 deposit by Zelle and the rest by Venmo, split between two people. In all they sent $7,000. The real owner said he had reported the fake listing to Vrbo each time it appeared.

Vrbo's answer was its Book with Confidence Guarantee, which, it said, protects customers who pay through the website. Because the family had paid outside it, the guarantee did not apply. Cash apps recovered $5,000, and Vrbo refunded the rest only after the station asked, as a goodwill gesture.

The pattern has not gone away. A June 2026 consumer report from Scripps stations warned of fake summer rental listings on both Airbnb and Vrbo, and Consumers' Checkbook told the reporters that Vrbo's guarantee does not guarantee a refund.

What the app collects

Vrbo's App Store label is unusual. The only data listed as used to track you across other companies' apps and websites is "other user content". A lot more is linked to your identity: purchase and search history and device IDs for analytics and personalisation, and payment info, precise location, physical address, email, name, phone number and photos for app functions.

Google Play says the Android app shares no data with third parties. It lists device IDs and in-app search history as collected partly for advertising or marketing, and also installed apps, calendar events and files.

Vrbo's privacy statement, checked in October 2026, is the Expedia Group statement. It names Expedia, Inc. as the party responsible for data the group's companies use jointly, the same arrangement as on Expedia. It says data shared for targeted ads may count as "sharing" under California law and lets some US residents opt out, which sits uneasily with Google Play's "no data shared". You can access or correct your data and ask about deletion through your account or Contact Us, and in some countries get a copy, port it or opt out of sale. The privacy score still rests mainly on what Vrbo told Apple and Google, as on the Expedia page.

Security

We found no reported breach of Vrbo's own systems in the last 10 years. Expedia Group's public bug bounty on HackerOne, opened in November 2022, covers vrbo.com and the Vrbo and former HomeAway apps and pays up to $20,000 for a critical flaw, much like Airbnb's HackerOne programme. A separate disclosure programme takes other reports without pay. The weak link is the owner side: an owner's hijacked email or account lets a criminal speak with the authority of a real listing.

What regulators have done

Very little has touched Vrbo directly. In November 2018 Mexico's consumer agency, Profeco, opened proceedings against Airbnb and Booking.com and began enquiries into HomeAway, mainly because it could not find a Mexican address or anyone responsible for the platform there. We found no outcome. Expedia's 2019 undertakings to the UK Competition and Markets Authority covered Expedia, Hotels.com and ebookers, not Vrbo. HomeAway was among the booking sites that signed the CMA's voluntary consumer law principles that year, which is not an enforcement action.

How to rent on Vrbo safely

1. Keep every message and every payment inside the Vrbo app.
2. Refuse any request to pay by Zelle, Venmo, wire transfer or gift card, whatever reason the owner gives.
3. Search a few lines of the listing text or a photo online: a copy of another home is a warning sign.
4. Read reviews going back at least six months and look for mentions of fake listings.
5. Pay by credit card through Vrbo, so you have both the guarantee and a chargeback route.

How we scored it

Regulatory record (85) is the strongest factor, since we found no fine or order naming Vrbo, though no major regulator has examined it closely either. Privacy (48) is the weakest, because the store labels link location, address and payment data to you and the group statement allows sharing for targeted ads. Transparency and control (56) matches Expedia, since both apps run on the same privacy statement. Scams and harmful content (50) reflects the off-platform payment fraud that the guarantee does not cover. Security (61) credits a clean record and Expedia Group's paid bug bounty. Airbnb scores 60 and Expedia 54.