Short answer: Airbnb does not offer a classic authenticator-app toggle. Its login security is built in: it sends a verification code by SMS or email whenever it sees an unfamiliar device, and it now supports passkeys on many accounts. So the job is different from most guides — add a passkey if offered, keep your phone number and email current, review logged-in devices, and secure the email account that everything recovers through.
Why hosts are a serious target
For a guest, a compromised account means a stored card and travel plans. Unpleasant, usually recoverable.
For a host, it is a business. An attacker with your account can change the payout bank account, so guest payments land elsewhere. They can alter listings, message guests as you, and damage a review history that took years to build. Payout redirection is the specific move — quiet, non-obvious, and discovered when a transfer does not arrive.
There is also a well-documented scam that does not require any account access at all: a “guest” or “host” who tries to move the conversation and the payment off-platform. More on that below, because it is more common than account takeover.
Step 1: Add a passkey if you can
- Sign in at airbnb.com.
- Click your profile → Account.
- Open Login & security.
- Look for Passkeys and add one.
A passkey is stronger than any code Airbnb can text you: it is bound to airbnb.com, so a phishing page cannot use it, and it combines your device with your fingerprint or face. See passkeys vs 2FA and what is passwordless authentication.
If the option is not present on your account, move to the steps below — the rest still matters.
Step 2: Get the recovery details right
Since Airbnb leans on codes to your phone and email, those two channels are your second factor. Under Login & security and Personal info:
- Phone number — current, and protected with a carrier port-out PIN against SIM swapping. If you are changing numbers, do it here first — see changing your phone number and 2FA.
- Email address — current, and secured with a passkey or authenticator app of its own. This is the most valuable thing you can do for your Airbnb security, because Airbnb’s recovery runs through it. Guides: Google, Microsoft.
- Password — long, unique, generated by a password manager. If it is reused anywhere, change it: credential stuffing is how most travel accounts fall.
Step 3: Review devices and connected accounts
- Logged-in devices — under Login & security, sign out anything unfamiliar or long gone. Hotel tablets, an old phone, a friend’s laptop.
- Connected social accounts — if you can sign in with Google, Facebook or Apple, that account’s security is now your Airbnb security. Remove links you do not use, and secure the ones you keep. See what is single sign-on.
Step 4: For hosts — check the money
- Payout method — verify the bank account under Payments & payouts. Check again after any login alert or suspicious message. This is the target.
- Co-hosts and team access — review who can manage your listings and remove people who no longer should.
- Notifications — make sure account and payout change alerts go to an inbox you actually read.
- Channel managers and PMS tools — if you use property management software connected to Airbnb, that integration holds real access. Treat its credentials with the same care and review them periodically, as covered in 2FA for small teams.
The scams that matter more than account takeover
Airbnb’s most common frauds do not require your password at all:
- Off-platform payment requests. A “host” asks you to pay by bank transfer for a discount, or a “guest” asks to book directly. Both remove every protection Airbnb provides. This is the single biggest rule: never pay or accept payment outside the platform.
- Fake listings with pressure to book immediately, then a link to a lookalike site.
- Phishing that mimics Airbnb messages — always read messages inside the app or on the site, never by clicking an email link.
- Fake support reaching out after you post a public complaint on social media.
- Requests for verification codes — Airbnb will never ask. See OTP scams.
If a conversation moves to WhatsApp and then to money, it is a scam every single time.
Frequently asked questions
Does Airbnb support authenticator apps?
Not as a standard user-configurable option. Airbnb uses device recognition with SMS or email verification, plus passkeys where available. If you see a passkey option, that is the strongest choice on offer.
Why does Airbnb keep asking me to verify?
Because it does not recognise your device, browser or location — often after clearing cookies, using private browsing, or travelling. It is the system working, not a fault. See 2FA while travelling.
What if I cannot receive the code while abroad?
Make sure your email address is one you can reach anywhere, and keep roaming or the ability to receive texts if your phone number is the registered channel. This is exactly the scenario where email being well protected matters most.
My account was accessed. What first?
Change the password and sign out all devices, verify the payout bank account if you host, check for changed email or phone details, and contact Airbnb support. Also check your email account — that is usually where it began (what to do if your email is hacked).
Is it safe to use Airbnb on hotel or café Wi-Fi?
Generally yes — the traffic is encrypted. The realistic risks are phishing and using a shared computer, not the network. Avoid signing in on machines you do not control.
Should I use “Sign in with Google” for Airbnb?
It is reasonable if your Google account has a passkey and no SMS fallback. It effectively gives Airbnb your Google account’s security, which is likely stronger than what Airbnb offers directly.
The bottom line
Airbnb’s security model puts the weight on your email and phone rather than on an authenticator app, so that is where your effort belongs — plus a passkey if the option appears. Hosts should add one more habit: check the payout bank account monthly. And whichever side of the platform you are on, never let a conversation about money leave it.
One Response