You log in to book a stay and find a password that no longer works, or you open your email to a notification that someone signed in from a city you have never visited. Maybe your payout method looks different, a reservation you never made is sitting in your account, or your contact email was quietly swapped. These are signs that someone has gotten into your Airbnb account, and the next hour matters. Move through the steps below in order to lock the intruder out, undo what they touched, and keep them out.
Make sure your account was actually compromised
Before you do anything else, confirm what you are seeing. The clearest signals of unauthorized access are a password that suddenly fails, login alerts from an unfamiliar browser, device, or location, and changes you did not make to your contact info, profile photos, listings, or payout methods. Airbnb emails you when your account is accessed from a new or unfamiliar browser or device, and that message includes the browser or device, the time, and the approximate location.
Those email login notifications cannot be turned off, which is helpful here because a genuine alert about a strange sign-in is a real warning, not noise. If a login was not you, treat it as a compromise and keep going. SMS and push notifications can be toggled in your notification settings, so the absence of one of those is not proof that nothing happened.
Open the Review your account flow right away
Airbnb's primary entry point for handling unauthorized access is the Review your account page. If you think your account was accessed without your permission, go to that page and follow the on-screen instructions. The guidance lives in Help article 359 at www.airbnb.com/help/article/359, and the same flow is referenced for responding to login notifications you do not recognize.
This flow walks you through checking and securing your account, so start here before poking at individual settings. Do this on a device and network you have used to log in to Airbnb before, since an unfamiliar device can trigger extra verification and slow you down.
Reset your password and lock the intruder out
Changing your password is the single most effective way to end the attacker's access. If you can still log in, set a new, unique password from the settings:
- 1.Open Menu > Account settings > Login & security on desktop.
- 2.Next to Password, click Update.
- 3.Enter and confirm your new password.
- 4.Click Update password to save it.
If you cannot log in at all, use the login-help and reset-password flow in Help article 76 at www.airbnb.com/help/article/76 to regain access first, then come back and finish securing the account. Make the new password unique and different from your email, social media, and bank passwords, because reusing one password is often how an attacker gets in. Never share a verification code, password, or 2FA code with anyone who asks, no matter how official they sound.
Check device history for sessions that are not yours
Once your password is changed, see who has been signing in. Go to Account and select Login & security, then look under Device history, which lists logins including the browser or device, the time, and the approximate location. The same login history is covered in Help article 900 at www.airbnb.com/help/article/900.
Go through the list and confirm you recognize each device and location. Anything you do not recognize is the intruder's session, which is exactly the activity your password reset was meant to cut off. Spotting it also helps you understand how long they had access.
Undo unauthorized changes to your profile and payouts
An attacker's goal is usually to redirect money or take over communication, so check the parts of your account they would target. Verify that your contact info, profile photos, listings, and payout methods have not been changed by someone else, and confirm that any reservations in your account were actually made by you.
If something is wrong, Help article 359 states that Airbnb can help you understand and undo changes an unauthorized user made. Document what looks off, such as a new payout method or an unfamiliar booking, before you contact support. The faster you flag changed payout details or a fraudulent reservation, the better your chances of getting them reversed.
Turn on two-factor authentication so it cannot happen again
With access restored and changes reversed, add a second layer that a stolen password alone cannot bypass. Per Help article 2842 at www.airbnb.com/help/article/2842, set up two-factor authentication under Menu > Account settings > Login & security, then choose Set up now on the banner.
- 1.Choose to get a verification code by text or phone call.
- 2.Create a PIN.
- 3.Add security questions.
Airbnb's 2FA requires your phone to access the account, so plan for the day you lose phone access. If you forget your PIN, use Forgot PIN and answer your security questions. If you do not have access to any of the phone numbers on your account and cannot receive a one-time passcode, select the Need Help option so support can add a new phone number. The official page does not mention downloadable backup codes or an authenticator-app option, so do not count on those. Note that 2FA, also called Strong Customer Authentication or SCA, is required for Hosts in the European Economic Area.
Contact Airbnb when you are locked out or money is involved
If you cannot solve the problem through the Help Center, or if the attacker changed payout methods, swapped your contact info, or made reservations, reach a person. You can message or chat with Airbnb by following up on an existing issue or selecting Report a new issue, or call +1-415-800-5959. The contact options are listed at www.airbnb.com/help/contact_us and detailed in Help article 1542 at www.airbnb.com/help/article/1542.
Use support to report unauthorized changes and reservations and to get help re-adding access if you are locked out. There is one official timeline to anchor your expectations: in the two-factor flow, if you cannot access any phone number on your account and cannot receive a passcode, selecting Need Help triggers Airbnb support contact within 12 to 24 hours to add a new phone number. Do not create a new account to appeal or report the affected one, and do not pay any third-party service that promises to recover, unban, or reinstate your account, as those offers are commonly scams.
What you can realistically expect from here
Be clear-eyed about outcomes. Airbnb's published guidance frames hacked-account recovery as regaining access, reviewing and undoing unauthorized changes through the Review your account page, and contacting support when you need help reversing what an attacker did. Outside of the 12 to 24 hour response for re-adding a phone number, Airbnb does not publish a guaranteed restoration outcome or a fixed recovery window for hacked accounts.
If the attacker changed payout methods, contact info, or booked reservations, those issues go through a manual support review, and resolution is not promised by any stated service-level agreement. Airbnb also notes that it can deactivate accounts, so reclaiming yours can depend on your account standing. None of the official pages promise a specific success rate, refund, or reversal, so go in expecting a case-by-case review rather than an instant fix.
Keep your account hard to break into
Once you are back in control, a few habits keep you there. Keep a unique, strong password that mixes letters, numbers, and special characters; longer is better, and avoid common words and word-plus-digit combos like dog1. Keep all payments and communication on the Airbnb platform, since moving off it is a classic setup for fraud.
Stay alert to phishing. Never click links in emails you are unsure about, and if a message or call seems suspicious, type www.airbnb.com into your browser directly instead of following a link. Airbnb will never ask for your password or your payment or payout details by phone, so any caller who does is an impostor. Confirm you are on the genuine airbnb.com domain before you ever enter your credentials or personal details.
Frequently Asked Questions
What is the first thing I should do if my Airbnb account is hacked?
Go to the Review your account page right away and follow the on-screen instructions, then reset your password from Menu > Account settings > Login & security. If you cannot log in at all, use the login-help and reset-password flow in Help article 76 to regain access first. Do this on a device and network you have used with Airbnb before.
How do I know which logins were not me?
Open Account, select Login & security, and look under Device history, which lists each login with the browser or device, the time, and the approximate location. Compare the list against your own activity, and treat any device or location you do not recognize as the intruder's session. Airbnb also emails you about access from a new or unfamiliar browser or device, and those email alerts cannot be turned off.
What if I lost access to the phone number on my account?
If you forget your PIN, use Forgot PIN and answer your security questions. If you do not have access to any of the phone numbers on your account and cannot receive a one-time passcode, choose the Need Help option, and Airbnb support will work to add a new phone number, typically within 12 to 24 hours. Airbnb's official 2FA page does not list backup codes or an authenticator app as alternative recovery methods.
Can Airbnb reverse changes or reservations the hacker made?
Airbnb support can help you understand and undo changes an unauthorized user made, and you should report any changed payout methods, contact info, or unfamiliar reservations to them. These cases go through a manual support review, so resolution is handled individually and is not guaranteed by any stated timeline or service-level agreement. Document what looks wrong before you contact support.
How do I reach a real person at Airbnb?
If the Help Center does not solve it, message or chat with Airbnb by following up on an existing issue or selecting Report a new issue, or call +1-415-800-5959. Use this to report unauthorized changes and reservations and to get help if you are locked out. The contact options are listed at www.airbnb.com/help/contact_us.
Should I pay a service that promises to recover or unban my account?
No. Paid third-party services that promise to recover, unban, or reinstate accounts are commonly scams, and you should not use them. Never create a new account to appeal or report the affected one, and never share a verification code, password, or 2FA code with anyone. If a message or call seems suspicious, type www.airbnb.com directly into your browser, because Airbnb will never ask for your password or payment details by phone.
