How to check a holiday rental

That is the short version. The rest of this guide covers what makes a rental different from a hotel, what the platform rules and the law actually say, and what to do if you find something.

The one real difference: the network

A hotel almost always isolates guests from each other, so a network scan reaches nothing and tells you nothing. A short-term rental usually gives you the household's normal Wi-Fi — the same network the television, the doorbell, the printer and the thermostat are on. Client isolation is uncommon on domestic routers, so devices tend to be reachable.

That makes scanning worth doing here. It also means you will see a great many ordinary things, and you need to be ready to interpret them without alarm. A typical rental network contains a router, one or two televisions or streaming sticks, a printer, some smart bulbs or plugs, a speaker, a thermostat, possibly a robot vacuum, and several devices that publish no name at all. Most of what you find will be unidentifiable and completely mundane. How to reason about unknown devices.

What is genuinely worth a closer look is a device that advertises a video service, or answers on the ports that IP cameras and recorders typically use — RTSP on 554 or 8554, or the web and vendor control ports such as 80, 443, 8080, 8000, 88, 37777, 34567 and 8899. A device combining one of those with a camera-suggestive name is the clearest signal a scan can give you. It is still a reason to go and look at the room, not a conclusion.

The inspection, in order

1. Read the listing again before you arrive. Platforms require hosts to disclose security cameras and recording devices in the listing. Note what has been declared and where. An undeclared device in an interior room is a different matter from a declared doorbell camera.
2. Walk each room and identify the sightlines. Stand where you would sleep, change and shower, and turn slowly. Objects with a clear view of those places are your list.
3. Examine the usual objects. Smoke detectors, alarm clocks, televisions and streaming boxes, plug sockets and any charger or adapter left behind, air vents, decorative items, shelves facing the bed, and anything in the bathroom with a view of the shower.
4. Do a torch pass. Hold a light close to your eye line and shine it at each object; a lens returns a small sharp point that flares as you shift your head. Expect false positives from screws, glass and glossy plastic.
5. Do a dark pass. Lights out, curtains drawn, eyes adjusted for a minute or two, then look for small points of light.
6. Join the Wi-Fi and scan. Note what you see, and re-run the scan once later in your stay — a device that appears only when it wakes up is easy to miss on a single pass.
7. Reconcile the two lists. If the scan shows something camera-shaped, work out which room it is likely in and go and look. If the visual pass found an object you cannot place, check whether anything on the network could correspond to it.

What you may and may not do

You are a guest in someone's property. Looking at objects, shining a light on them and photographing the space you have rented are lawful everywhere we are aware of. Network scanning is treated differently in different countries, and being given a Wi-Fi password is not necessarily permission to probe other devices on that network — check the rules where you are.

Damaging property can leave you liable regardless of what you suspected, and accessing a device or network you do not control is a criminal offence in most jurisdictions even when the device itself turns out to be unlawful. Document and escalate; do not investigate by hand.

What the rules actually say

Two separate things apply: the platform's rules and the local law. They are not the same and both matter.

Platform rules. Airbnb's policy prohibits security cameras and recording devices in interior spaces of a listing, regardless of whether they are disclosed, and requires disclosure of exterior cameras and other devices such as noise monitors. Other platforms have comparable policies. This means an interior camera is a violation you can report even where the local law is ambiguous.

Local law. In most jurisdictions, recording people in places where they have a reasonable expectation of privacy — bedrooms, bathrooms, changing areas — is a criminal offence. Exterior cameras covering a driveway, entrance or garden are lawful in many places, and a doorbell camera at the front door is extremely common and usually entirely legitimate. Rules on recording audio are often stricter than for video and vary widely by country and by region.

What Findy can help with

• The network scanner is the tool that earns its place in a rental. It browses Bonjour service advertisements — including _rtsp._tcp and _http._tcp — and probes the local subnet on the ports that cameras and recorders commonly use, showing you which addresses respond and why each was flagged. Subscription, $39.99 per year in the US.
• Re-scanning compares against your previous scan of the same network, so a device that has appeared since you arrived is visible as a change rather than lost in the list.
• The camera tools — lens-glint finder, automatic lens scan and infrared viewing mode — support the torch and dark passes. Subscription.
• The Bluetooth scanner and magnetic checks help you narrow down one specific unexplained object. Free.
• The guided checklist keeps the visual pass in a sensible order. Free.

What Findy cannot determine

• Whether any device is a camera. The scanner reports what responded and on which ports; it never classifies a device as a camera, and never says one has been confirmed.
• Who owns a device, what it is recording, or whether it is pointing indoors or outdoors.
• The manufacturer. iOS does not give apps access to the ARP table, so there is no hardware address to look up a vendor from. Any app claiming to name the maker of an unknown device on iOS is inferring it from a hostname at best.
• Anything on a network you are not joined to — a host's separate private network, or a guest network you were not given.
• Anything powered off, recording only to a local card, or connected over mobile data.
• A purely passive microphone, which emits nothing to find.
• A Bluetooth device that is not advertising, is shielded, or is out of range.
• Where a Bluetooth device actually is. Findy estimates a distance and shows a direction arrow, but both come from signal strength alone — a warmer/colder aid while you move, not a measurement.

The complete list of what Findy cannot see.

If you find something

Related guides

• How to check a hotel room — the same visual route, and why scanning is close to useless on hotel Wi-Fi.
• Unknown devices on a Wi-Fi network — how to read a scan result without alarming yourself.
• How camera lens reflections work.
• The network scanner in detail.