About this guide
Vacation rental security problems usually start small: a fake booking message, a lookalike payment request, or a door code shared with the wrong person. This guide gives you ready-to-use templates to help prevent these issues, and to respond quickly and calmly if something does go wrong.
Each section includes a template you can copy from this page, and a matching PDF you can download, edit and share with your team, guests and owners.
What's inside
|
Section |
Use it to |
|---|---|
|
1. Security incident email |
Tell guests and owners what happened and what to do next |
|
2. Trust card |
Show guests which messages and requests are genuine |
|
3. SMS or WhatsApp alert templates |
Send short, safe messages by SMS or WhatsApp that do not look like phishing |
|
4. Frontline support script |
Help your team handle worried calls and messages consistently |
|
5. Prevention checklist |
Reduce risk before anything happens |
How to use it
Replace every [bracketed placeholder] with your own details, such as your company name, official website and support contact. Remove anything that does not apply to your business. These templates are general guidance and not legal advice. Notification requirements after a security incident vary by region, so check the rules that apply to you.
1. Security incident email
Send this to guests, owners or clients as soon as you know personal information may be at risk. Fill every bracket, delete lines that do not apply, and have someone review it before sending.
Subject: Important security notice from [Company Name]
Hi [First Name],
We are writing to let you know about a security incident that [may have] affected information we hold about you. We want you to hear it from us, with clear steps you can take.
What happened
[One or two plain sentences: what occurred and the date it was found.]
What information was involved
[For example: name, email address, phone number, booking dates. State clearly if payment details or access codes were NOT involved.]
What we have done
[For example: secured the affected systems, reset affected access codes, notified the relevant authorities where required.]
What we will never do
- Ask for your password, PIN or verification codes by email, text, chat or phone.
- Send a link demanding urgent payment, or say a booking will be cancelled unless you act within hours.
- Ask you to pay or re-pay for a stay outside our official booking channel.
- Send you door or lock codes through any channel other than [official guest channel, for example our guest messaging].
Steps to take now
1. Turn on multi-factor authentication (MFA) on your account with us and on your email and other key accounts.
2. If you reuse your password anywhere, change it to a strong, unique one. A password manager helps.
3. Be careful with unexpected messages about a booking, payment or check-in, even if they look like ours. Do not click the link. Contact us using the details below.
4. Check your bank or card statements for charges you do not recognize.
How to reach us
Our only official channels are [website], [support email] and [phone]. We will not contact you from any other address or number.
We are sorry for the worry this causes. If you have questions, our team is ready to help.
[Name]
[Company Name]
2. "Can you trust this message?" quick-reference card
A one-page card property managers can attach to booking confirmations, pin in a guest portal, or print in the property guidebook.
|
Green light: what we do |
Red light: what we never do |
If in doubt |
|---|---|---|
|
Email from @[yourcompany.com] only |
Email from free accounts (Gmail, Outlook) or look-alike domains such as @[your-company-support.com] |
Do not reply or click |
|
Send booking and payment links from [official booking site or platform] |
Ask you to pay by gift card, wire transfer, crypto or a payment app outside the booking |
Open the booking from the official site or app yourself |
|
Send check-in details and door codes through [official channel, for example the booking platform or our guest app] |
Send access codes outside [official channel] |
Call us on [official phone number] |
|
Answer questions in [official support channel] |
Ask for your password, PIN, card number or verification code |
Forward the message to [security email] |
|
Tell you about any change to your booking in your account |
Threaten to cancel your stay unless you act within hours |
Call us on [official phone number] |
3. SMS and WhatsApp alert templates
Short messages that do not look like phishing, for SMS and WhatsApp. Only link to [official domain], never ask guests to reply with a code, and keep each to about 160 plain characters.
|
Use case |
Message |
|---|---|
|
General alert |
[Company]: We saw unusual activity. We never text login links or ask for codes. To check your account, open our website or app directly. |
|
Password reset |
[Company]: A password reset was requested. Not you? Ignore this text. Never share your code with anyone, including our team. |
|
Check-in details |
[Company]: Your check-in details are in your booking at [official site]. We never text codes from unknown numbers. Questions? Call [phone]. |
|
Payment warning |
[Company]: We never ask for payment by text or outside your booking. Unsure about a request? Call [phone] before you pay. |
|
Code change notice |
[Company]: Your door code for [property] was updated. Find it in your booking. We will never ask you to share it. |
Before sending
-
Replace every bracket and re-check the final character count
-
Confirm the sending number matches the one listed on your official site
-
Check local rules on consent and opt-out wording for business texts (for example, add "Reply STOP to opt out" where required, and check the length again)
4. Frontline support script
For guest-facing and owner-facing staff, including after-hours and field teams, when worried people call or message.
The first draft had three lines. This version keeps that core, adds a fourth step for reporting, and adds a short list of things staff must never do.
|
Step |
What to say |
|---|---|
|
1. Empathize and reassure |
"I understand why this is worrying, and thank you for checking with us. Our team is looking into it and I will help you with next steps." |
|
2. State the golden rule |
"Just so you know, I will never ask for your password, card number or verification codes, and nobody from [Company] will." |
|
3. Verify safely |
"If you got a message about a booking, payment or door code, please do not use any link in it. Open your booking on [official site or app] and tell me what it shows." |
|
4. Direct to safety |
"If you need to change any details, please go to [URL] yourself and sign in there. I can stay on the line while you do." |
|
5. Capture and report |
"Could you forward the message to [security email]? We will use it to protect other guests." |
If the caller is a guest who is locked out or has a door-code problem
- Confirm identity using details already in the booking, not new details the caller offers
- Reissue or resend the code only through the official channel on file
- If the caller sounds unsure about who they are speaking with, offer to call back on the number in the booking
Staff must never
- Ask for or accept a password, full card number or verification code
- Send a door code to a new email address or phone number given on the call
- Say what caused an incident or what was taken beyond the approved wording
- Promise outcomes such as refunds or compensation unless authorized
Escalate to [security contact] when a caller reports a payment already made, a code already shared, or an account already accessed by someone else.
5. Prevention checklist for property managersMost problems start with a stolen login, a lookalike message or a shared code. Review this checklist every quarter.
Accounts and logins
☐ Turn on multi-factor authentication for email, booking platforms, property management and operations tools
☐ Give every team member their own login; never share one account
☐ Use a password manager and unique passwords for every system
☐ Give people only the access their role needs (cleaners, owners and contractors see less than managers)
☐ Remove access the same day someone leaves or a contractor finishes
Door and access codes
☐ Use a different code for every guest and stay, set to expire after checkout
☐ Do not use a guest’s phone number digits, such as the last four, to create codes
☐ Review who can see or issue codes, and remove anyone who does not need to
☐ Change codes and review access after any suspected incident
Guest and owner communication
☐ Tell guests in the booking confirmation which channels you use and which you never use
☐ Include the trust card (Section 2) in your guidebook or welcome message
☐ Verify any request to change bank or payout details by calling a number you already have
☐ Keep one official support phone number and email, and publish them in the same places every time
Team habits
☐ Train staff on spotting fake booking, payment and check-in messages, and repeat it every few months
☐ Give staff one place to report a suspicious message, and thank them for reporting
☐ Keep devices, apps and browsers updated
☐ Write down who does what when an incident happens, and keep contact details for your insurer and legal advisor
Practice once a year
☐ Run a short drill: a guest receives a fake payment text. Who finds out, who replies, and how fast?
Download the complete kitAll five templates are in one PDF, one per page, ready to edit, print and share: Download the complete kit (PDF).