Someone Is Using Your Shortlet Photos: Cloned Listings, Deposit Fraud & Protecting Your Name

The short answer: if your apartment photographs well and sits in Lekki, Ikoyi or Victoria Island, assume your photos are already being reused by someone else. The defence is not secrecy — it is being the obviously verifiable version: one canonical booking link you control, a consistent payment account, watermarked images, and a stated rule that you never take payment through any other channel. When a guest can check you in ten seconds, the clone stops working.

Most host security advice is about screening the guests who book you. This is the opposite problem: the fraud that happens in your name, to people who never reach you, and lands on your doorstep anyway.

How the scam actually runs

The pattern is well documented in Lagos and it is more sophisticated than most hosts expect:

1. Photos are lifted from a real listing — yours — on Airbnb, Instagram, Jiji or a property portal.
2. A listing is rebuilt elsewhere, often on a classifieds site or an Instagram account, at a noticeably attractive price. Underpricing is the bait, and it is the clearest tell.
3. The conversation moves to WhatsApp fast. Fraudsters are fluent, responsive and professional — often more responsive than real hosts, which is part of why they win.
4. Trust is manufactured with a video tour, a fabricated lease or ownership document, and sometimes a cloned version of a legitimate platform's booking confirmation.
5. A deposit is demanded urgently, usually citing high December demand.
6. The account goes silent. One reported Lagos case cost a diaspora family ₦1.3 million.

The targets are predictable: returning diaspora travellers and out-of-town visitors booking sight-unseen for the festive season, into exactly the high-demand areas where genuine availability is scarce and urgency feels normal.

Why this is your problem even though you were not defrauded

Hosts tend to file this under "sad, but not mine". It becomes yours in five concrete ways:

• Guests arrive at your gate. They have your address, your photos and a receipt. They have also lost real money and they believe you are responsible. You will be handling this conversation in person, possibly at 11pm.
• Your estate gets involved. Repeated incidents of strangers arriving with fraudulent bookings is exactly the sort of thing that gets shortlets banned by residents' associations.
• Your name gets attached to it publicly. Defrauded guests post the photos they were sent. Those are your photos, and your unit becomes searchable alongside the word "scam".
• Genuine enquiries get harder to convert. Every host in a market with visible fraud pays a trust tax on every booking.
• The clone competes with you on price without any of your costs, dragging perceived market rates down.

Detection: find out before your guests do

Set aside twenty minutes a month:

• Reverse image search your three best photos. If the same image appears under listings you do not control, you have a clone. This is the single highest-yield check and almost no Nigerian host does it.
• Search your own listing text. Cloners copy descriptions verbatim. Paste a distinctive sentence from your listing into a search engine in quotes.
• Search your address and building name across Instagram, Jiji and the property portals. Look for units that are yours but are not you.
• Ask every guest where they found you. Put it in your standard enquiry reply. It doubles as channel attribution and as an early warning — the first sign of a clone is often a guest referring to a listing or a price you do not recognise.
• Watch for enquiries about prices you never set. "Is the ₦45,000 rate still available?" on a unit you list at ₦120,000 is not a haggler. It is someone who has seen the clone.

Hardening: make yourself the verifiable one

You cannot stop someone downloading your photos. You can make the clone easy to disprove.

One canonical booking link

The most effective single measure. A permanent link you control, showing live availability and real prices, that you send in every conversation and put in every bio. It gives a cautious guest something to check against and gives you one sentence that defeats the scam: "Our only booking page is this link, and we never take payment through any other account."

This is one of the things a booking page is quietly for. Nookpal gives each property a public page with live availability and a host-reviewed request flow, so the canonical version of your unit is a page you own rather than a platform listing anyone can copy.

Watermark, and stagger what you publish

A discreet watermark on your best images makes them meaningfully less useful to a cloner and instantly identifies the source when they are reused. Keep two or three unpublished interior angles in reserve — when you need to prove a listing is yours, a photo the fraudster does not have settles it immediately.

Control what is public

• Do not publish the full unit address publicly. Area and landmark until a booking is confirmed.
• Avoid photographing the building exterior, gate, house number or estate signage.
• Keep one payment account for bookings, and say so in writing every time.
• Use one consistent business name across every channel so an impersonating account looks wrong.

Say the quiet part out loud

Put an anti-fraud line in your listing descriptions and your Instagram bio, not buried in a message. Something like: "We only take bookings through [your link] and only receive payment into one account. If anyone offers this apartment elsewhere or asks you to pay a different account, it is not us — please message us to confirm."

Guests read this as professionalism rather than paranoia. It also means that when fraud does occur, you have a public record of having warned people.

Worth being concrete about what "a link you control" means, because a Linktree is not it. A Nookpal property page shows the unit's real rates and live availability, takes a booking request rather than an instant confirmation, and carries your business name — so a guest comparing it against a cloned Instagram listing can see within seconds which one is transacting and which one is fishing. It also gives you a single sentence that ends the conversation with a hesitant guest: this is our only booking page, and we never take payment through any other account.

Response playbook: when you find a clone

1. Capture evidence first. Screenshot the fake listing with its URL and a visible date before reporting — the moment you report, it may disappear, taking your proof with it.
2. Gather your own proof of ownership: original photo files with their metadata, your earliest published listing, your tenancy or ownership document.
3. Report to the platform. Every major site and Instagram has an impersonation and intellectual-property reporting route. Reporting as impersonation, using stolen images, is usually faster than reporting it as a scam.
4. Report the financial crime properly if a guest has actually lost money. That means the police and, for fraud of scale, the EFCC. The bank the money went to matters — account details give investigators something to work with, and the defrauded guest should report to their own bank immediately, since speed affects any chance of recovery.
5. Warn your estate security and gatemen. Tell them what is happening and agree what to do when someone arrives with a booking you have no record of. This protects the arriving guest as much as it protects you.
6. Post a short public notice on your own channels. Factual, unemotional, with your real booking link. This is what future guests will find when they search.

Estate security is easier to brief when there is something to check against. If tonight's arrivals are on a Nookpal calendar you can show them, "we have no booking under that name for tonight" becomes a fact rather than an argument at the gate at 11pm.

When a defrauded guest turns up at your gate

It will eventually happen, usually late, often with luggage and children. Decide your posture now rather than in the moment.

• Be kind first. They are a victim, not an adversary, and they are about to tell a lot of people how you treated them.
• Show them the clone and your real listing side by side. Understanding what happened is the thing they need most.
• Help them report it — their bank first, then the platform and the police, with the fraudster's account details.
• Do not admit liability or offer compensation. You did not take their money, and you cannot afford to become the insurer for every fraud committed in your name.
• If you genuinely have the unit free, offer it at your normal rate. Not free — but a stranded family who finds the real host accommodating is the single best review you will ever earn.

The uncomfortable connection to how you take payment

Cloned listings work because Nigerian shortlet booking is normally an informal WhatsApp conversation ending in a bank transfer, which is indistinguishable from a fraudulent WhatsApp conversation ending in a bank transfer. The fraudster is not imitating a broken process; they are imitating the standard one.

Which means every step you take toward a verifiable booking flow — a real booking link, a written confirmation with your business name, a consistent account, a stated refund policy — makes you both harder to impersonate and easier to trust. It is the same work as taking direct payments safely, viewed from the other side, and it pairs with guest verification and caution fees to cover both directions of risk.

This article describes commonly reported fraud patterns and general precautions. It is not legal advice; consult a lawyer for your specific situation, and report suspected crimes to the appropriate authorities.