Summer Travel Scams 2026: The Five Patterns Hitting Travelers This Summer
Three weeks before Memorial Day weekend, a couple in our local Facebook group lost $2,400 on a beach rental in Destin that turned out to be someone else’s photos pasted into a stolen listing. They paid by Zelle because the “owner” said Vrbo was holding deposits for too long this season. The host page went dark forty-eight hours after the wire cleared. Three other families had paid for the same week.
Stories like that one are going to keep coming. The FTC’s Consumer Sentinel Network logged a record $15.9 billion in reported fraud losses in 2025, and Americans are now staring down a peak booking window with both more travel and more sophisticated scams than the summer before. McAfee’s Safer Summer Travel Report found that more than 25% of Americans have been affected by a travel scam — and one in five fell victim during the booking process itself.
Here’s the playbook for what’s happening this summer, what the data actually says, and the small set of habits that will save you a vacation.
The Summer Scam Atlas
The five patterns to know
1. Fake vacation rentals — still the biggest
A 2025 Apartment List survey found that over 5.2 million Americans fell victim to rental scams in a single year, with the average loss jumping 21% to $2,071. Forty-three percent of online renters encountered a fake listing; 43% of victims never got their money back. People aged 18–29 were three times more likely than other adults to lose money — anyone who thinks this scam targets seniors should look at the data again.
Where the listings come from has shifted. The FTC’s most recent breakdown shows that in the 12 months ending June 2025, about half of reported rental scams started with a fake advertisement on Facebook, with Craigslist a distant second at 16%. Airbnb and Vrbo are usually where the listing eventually gets copied to give it the look of legitimacy. The scammer’s goal is to push you off-platform: “Pay by Zelle and I’ll send the keys directly. Vrbo’s fees are crazy this year.” Once the money is gone, so is the listing.
The three rules that cover most of it
- Pay on the platform, every time. Airbnb at least controls the money in escrow until you check in. Off-platform Zelle, Cash App, wire — that’s gone the moment it sends.
- Reverse-image search the photos. Scammers re-use real listings; a thirty-second TinEye check often surfaces the original.
- A real host has a real address. If the “owner” refuses to share the street address until after payment, the property doesn’t exist.
2. AI-generated travel sites — the new wrinkle
This is the part that wasn’t true two summers ago. According to data published by McAfee in summer 2025, AI-powered travel scams surged roughly 900% year over year, with one in five Americans now getting scammed somewhere in the booking flow. The scams use image generators to produce photorealistic pictures of properties that don’t exist, then attach AI-written reviews and pricing tuned to undercut real listings by 12–18%.
The cleanest tell is a slightly off domain. We’ve seen listings on boooking.com, airbnh.co, and a long list of .xyz and .shop variants that screenshot beautifully and dissolve under inspection. If your booking confirmation tells you to verify on a domain you don’t recognize, take a breath, open a new tab, and go to the real site directly. This is the same defensive habit we wrote about in our breakdown of AI-driven neo-phishing: the surface is impeccable; the URL is the only thing that doesn’t lie.
3. Toll-text smishing — the road-trip tax
If you got “Your toll account is past due, click here to pay” in May, you are not alone. The FBI’s Internet Crime Complaint Center logged more than 2,000 reports about toll-text scams in 2025 alone, and the volume jumps every time school lets out and the highway miles spike. The texts spoof state systems (E-ZPass, FasTrak, SunPass, Peach Pass) and route you to a phishing page that captures your card.
The rule is the same as it was for the USPS package texts two years ago: real toll authorities don’t text. If you genuinely owe a toll, log into the toll authority’s actual app — never the text link — and pay it there. Forward the scam to 7726 (SPAM) and delete.
4. Fake passports, visas, and IDP sites
The pre-trip prep panic is its own scam window. The FTC has flagged a steady stream of fake International Driving Permit sites that look authoritative — embassy seals, government-style typography, an SSL padlock — but charge $150 or more for a worthless laminated card. Only two organizations are authorized to issue IDPs in the United States: AAA and the American Automobile Touring Alliance. Anyone else is selling you a souvenir.
The same logic applies to “expedited passport” services. If the site doesn’t end in .gov, you are not buying a passport, you are buying a phishing attempt with a delivery slip.
5. Recovery scams — the bill that comes after
The smartest scammers wait for you to be a victim already. The FTC has been warning about recovery-room fraud — calls and DMs from someone claiming to be a federal agent, attorney, or “fraud recovery specialist” who can get your rental money back for a small administrative fee. They have your story because you posted it on Reddit, or because they were the scammer in the first place and they’re double-dipping. There is no legitimate paid private recovery service for consumer scam losses. Report to the FTC and your card issuer; everyone else is a second scam.
When each scam peaks
A five-minute pre-trip drill
Before any of this matters, give yourself five minutes the week you start booking:
- Reverse-image search every listing. Google Images and TinEye are free, and most fake listings collapse on the first try.
- Pay with a credit card, on-platform. Credit cards are the only payment method with real chargeback rights. Zelle, wire, and gift cards are scammer logistics.
- Save the real toll authority’s URL as a phone bookmark before you leave. When the inevitable smishing text comes mid-drive, you already have the legit one to hand.
- Tell your family about the recovery scam. If anyone in your house gets scammed in June, they’re going to get the “specialist” call in July. Pre-warn them so the answer is “no, thanks” before the question even lands.
- Plan one safe word. If you get a panicky “stranded in Cancun” call in a voice that sounds like your kid, the AI voice-cloning playbook we’ve published before will get you through it.
If you think you’ve already been hit
- Call the card issuer first. Chargeback windows are short, and the bank cares less about the story than the date.
- Report the scam at reportfraud.ftc.gov and to the FBI’s IC3 at ic3.gov. Both feed the data the next traveler will need.
- Do not pay anyone who calls and offers to “recover” the loss for a fee. That is the second scam, every time.
The bigger pattern
What is true across all five is that the technology has caught up to the targets. McAfee’s data point — one in five Americans scammed during booking — isn’t an outlier; it’s what happens when the tools to generate a convincing fake property listing drop from “Photoshop expert” to “free chatbot prompt” in two years. The defense is the same one that has stopped a thousand pig-butchering attempts and a hundred USPS smishing waves: stay on the platforms, pay with a card you can dispute, and assume any urgency is a tell.
That, and call your mom about the toll texts before her road trip next week.
Run a vacation-scam drill before you actually go.
ScamDrill sends safe, realistic fake-rental and toll-smishing simulations to your family on a rotating schedule — with a friendly teachable moment when someone clicks. It’s the cheapest insurance you’ll buy this summer.
Start free →