Guest Screening Tools for Direct Bookings

A guest who books through Airbnb has passed whatever checks Airbnb runs. One who calls, emails, or books on your own site has passed only the checks you add. Hostaway's check-in form can ask every adult guest for an ID photo and a selfie. Yet its support article states that "Hostaway does not check the ID of the Guest to make sure that it is not fake."

Guest screening for direct bookings is the identity or background check a vacation rental host runs on a guest who booked through the host's own website, phone, or email, where no marketplace check sits behind the reservation. Ten tools document a way to do it: ChargeAutomation, Stripe Identity with Radar, Authenticate, Autohost, Chekin, Safeguest, Truvi, Enso Connect, Linkbase, and Safely.

Does your booking engine already screen direct bookings?

Guest screening for direct bookings is built into few booking engines, and most need a separate tool. Of eleven engines and property management systems, or PMSs, reviewed in October 2026, three document how their identity check works: Hospitable's Direct Premium plan, Guesty's paid GuestVerify add-on, and Uplisting's paid Stripe Identity add-on. Streamline markets a check without saying what it covers.

Online travel agencies, or OTAs, keep their checks in-house, and what Airbnb verifies about a guest never reaches your own site. Track and the website layer Boostly document no check, and a native OwnerRez check is still a forum request marked Requested. Lodgify hosts lean on a connected tool too, because Lodgify documents no check-result condition for its entry-code message. Seven of the ten tools below connect to Lodgify, all but Stripe, Autohost, and Safeguest, which marks its connection coming soon.

Hospitable's Direct Premium takes payment as merchant of record with damage and chargeback protection, but Hospitable leaves manual bookings, such as a phone booking you type in, without either.

A vacation rental security deposit can also lapse mid-stay. Guesty caps a card hold at 7 days, or 5 on a Visa credit card, as Stripe does for a Visa card used without the guest present. The average direct stay runs 5.3 nights in Key Data's October 2025 figures, so a hold placed two days before arrival can expire before checkout unless your tool re-authorizes it. OwnerRez and Hostaway do that automatically on Stripe, while Lodgify voids a hold at five days and emails you to place another.

10 guest screening tools for direct bookings

Start with how bookings arrive, because a PMS-fed tool never sees a phone booking you did not enter.

• No PMS, payment on your own site: pick ChargeAutomation for payment, ID, deposit, and agreement in one flow, or send a link from Authenticate, Autohost's Checktiv, Truvi, or Chekin if your site already takes payment.
• A developer and a Stripe checkout: add Stripe Identity and a Radar rule that asks new customers for 3D Secure (the cardholder check the guest's bank runs), or embed the Autohost or Chekin SDK, and code the door-code hold.
• A PMS booking engine plus phone or email bookings: use Authenticate, Checktiv, Truvi, Chekin, or Safely for bookings that never enter the PMS. Enso Connect and Linkbase see only what the PMS sends, and Safeguest's product pages route its link through the PMS. With those three, enter phone bookings in your PMS first.
• A stolen card as the main worry: choose ChargeAutomation's 3D Secure plus a booking-name ID match, Stripe Radar plus Identity with a developer-coded name match, or Authenticate's ID check beside a 3D Secure payment tool.
• Hosting in Spain, Italy, or Portugal: registration law there applies to direct bookings too. Match your country to the filing lists of Chekin, ChargeAutomation, and Enso Connect, which files through Chekin.

A tool qualified if you can buy it alone, its guest flow needs no front desk, and the vendor describes screening a booking that never touched an OTA. The first rule ruled out Alertify's WelcomeLink, sold with noise monitors, and the second ruled out Duve, which sends a guest whose selfie fails to match to reception. Capabilities come from vendor sites as of October 18, 2026, without hands-on testing. Entries are grouped by where each tool meets the booking, then alphabetized, with no ranking implied.

ChargeAutomation

Best for: a host with no PMS who takes payment on their own site and wants the card, the ID, the deposit, and the signed agreement handled in one guest flow.

If the card is the first thing you collect from a direct guest, ChargeAutomation builds the rest of the screening around it. It needs no PMS or channel manager, although nothing starts until a reservation is received. Because rules run by booking source, you can require ID verification on direct bookings and route certain OTA reservations through a different workflow. Deposit holds can re-authorize automatically every few days, its answer to the hold expiry above. Access codes can also wait for the whole flow and release once every step is confirmed.

ChargeAutomation splits its chargeback defense by dispute type, and says every transaction goes through 3D Secure to answer fraud-coded disputes. The ID check and the signed agreement answer friendly fraud, where a real guest disputes a stay they took. The ID check matches the guest's name to the booking and a live selfie to the ID. If a check fails, the booking is flagged with a retry offered, and you can approve or follow up with one click. Each booking stores the agreement, verified ID, check-in records, guest messages, and proof of 3D Secure authentication, the file you would answer a dispute from.

Outside the US, ChargeAutomation lists automatic guest registration filing in Spain, Portugal, Bulgaria, Dubai, Austria, and Germany, with Italy's Alloggiati Web on a separate page. Registration deadlines there apply to a direct booking as much as an OTA one. Italy, for example, wants guest details within 24 hours of arrival, and Portugal's SIBA allows three working days to report each foreign guest.

Pricing model: freemium, with per-property subscription plans and an optional payment-processing fee; ID verification depends on the plan.

Stripe Identity + Radar

Best for: a host with a developer and a booking site whose checkout already runs on Stripe.

Stripe sells both halves of a direct-booking check and documents no join between them. Identity checks a document's authenticity and matches it to a selfie. Radar Pro's name_verification attribute compares the cardholder name given at checkout with names Stripe infers for the card. We found nothing in the Identity or Radar documentation that connects either name to the verified ID. That comparison falls to your developer, built from Identity's verified result and the payment's billing details.

Identity's liveness check blocks a verification when the selfie might not have come from a live person in front of the camera. International guests can hit a limit, because Stripe cannot extract document fields written in Arabic, Chinese, Cyrillic, Greek, Hebrew, Korean, Tamil, or Thai script.

Radar covers the card, and its default rules screen every Stripe payment. On plans that support custom rules, Stripe's own example requests 3D Secure for every payment that supports it from a new customer. Every first-time direct guest counts as a new customer by that rule, but Stripe adds that requesting 3DS does not necessarily mean the issuer performs it. Its deposit holds also run on the short clock described above, and Stripe counts only payments it processed itself as past stays under Visa's Compelling Evidence 3.0 rule.

All of it is a developer's job. Setup starts by installing a Stripe code library on your site's server, and the door code waits for the check only if your developer codes that hold too.

Pricing model: per verification for Identity; Radar per screened transaction or as a monthly plan, with standard card processing on top.

Authenticate

Best for: a host who wants an identity check sent as a link on any channel, including a phone booking, with US criminal and watchlist screening on top.

A phone booking with no PMS behind it can still get a check. From the Authenticate dashboard you can generate Medallion™ verification links with no integration, and a +Verification Link button creates one to email or paste anywhere. For a booking made months out, send the link closer to arrival, because a link can stay valid for up to three weeks. For a regular who rebooks, Authenticate also offers ReAuthenticate™, which re-verifies a guest it has verified before with a selfie, and asks for a government ID if the selfie doesn't match.

Authenticate also integrates with SuiteOp, Guesty, Hostaway, Hostfully, Lodgify, and OwnerRez. On the last five, a Manage Booking Channels setting picks which bookings get a link by the channel the PMS reports: Airbnb, Vrbo, Booking.com, Expedia, or your direct site. To screen only direct bookings, switch the OTAs off, since every channel starts selected.

Authenticate's guest verification page for rental hosts lists more than 7,500 government ID types. The check can add active or passive liveness detection, a sex offender registry search, and 60+ sanctions and watchlists, including OFAC. Two checks are US-only, the 7-year criminal search and the US database check. Authenticate holds no card, deposit, or rental agreement and runs no 3D Secure, so pair it with whichever tool takes the card.

The US-only database check matters if you copy Authenticate's example automation, which sends check-in codes only when the identity and US database checks both pass. Because "Non-US guests always get No for the database check", a Canadian or other non-US guest never clears that rule. Build a separate code-release path on the ID and liveness result.

Pricing model: prepaid, pay-as-you-go per check, with credits that do not expire.

Autohost (Checktiv)

Best for: a host with no PMS who wants ID, watchlist, and criminal checks behind one link, or a booking platform embedding screening through an SDK.

The door-code hold Autohost documents runs through its guest portal. There, the check-in message goes out only after the guest is verified through the portal or approved by hand. The booking confirmation still goes out once the reservation is confirmed, and a flagged reservation stands until you act. We found nothing confirming the same hold for a bare Checktiv link, which leaves a host who sends only the link with no documented gate on the door code.

Checktiv is the self-serve product Autohost points individual hosts to, since Autohost's own site is aimed at software platforms. With no integration needed, a host with no PMS sends a link and picks checks from a menu. The menu runs from a government ID with an optional live selfie through fraud and device signals, sanctions and watchlists, and US criminal records to global criminal and adverse-media screening. With the global checks picked, a guest from abroad can be checked for more than an ID scan.

Its payment verification reads the billing address, cardholder name, and transaction history, although Autohost does not say the cardholder name is matched to the ID. Autohost names your direct-booking website alongside Airbnb, Booking.com, and VRBO as booking channels. Platforms can embed the same flow through a Web SDK, REST API, or hosted page.

Pricing model: Checktiv is pay-per-check from a prepaid wallet, with optional plans; Autohost charges platforms per verification plus a platform fee.

Chekin

Best for: a host in Spain or another registration market who needs police filing and ID matching on direct and OTA bookings alike.

Spain's Real Decreto 933/2021 gives a host two deadlines, and what Chekin describes covers one of them. The decree applies to hosting "de modo profesional o no" (professionally or not). It requires one report within 24 hours of the booking and another within 24 hours of check-in. Chekin sends guest data "automatically to police on the night of the check-in date", which matches the second deadline. For the first, ask Chekin how it files the booking-time report.

Chekin files Spanish registrations with SES Hospedajes, Mossos d'Esquadra, and Ertzaintza and stores the data for three years. It also claims compliance coverage across 15+ countries for its SDK. If you have no PMS, you add properties, create each booking by hand, and send the guest a unique link by WhatsApp, SMS, the platform chat, or email. That route covers a phone booking that never touches a booking engine.

Chekin reads the guest's document and compares it with its machine-readable zone, the coded lines along the bottom of a passport's photo page. A selfie or short video is then matched to the photo through a faster photo tier or an anti-spoofing video tier. Chekin puts both under 10 seconds. Any short-term rental background check has to come from another tool, because Chekin lists no criminal or watchlist check. It can block or pre-authorize a deposit, and a booking site can embed the flow through its SDK. Online ID verification needs the Premium package, and once a guest is approved, access details can go out automatically.

Pricing model: a Basic or Premium per-property subscription plus per-transaction fees for deposits, payments, and damage protection.

Safeguest

Best for: a host on Guesty, Hostfully, Uplisting, Hostaway, or OwnerRez who wants ID, a signed agreement, and a deposit choice in one guest flow.

Screening is free to hosts at Safeguest's Prevent tier, and a guest who skips the damage deposit pays a No Deposit Fee instead. The guest flow collects contact details, a government ID, a biometric selfie, a signed agreement, and either the deposit or the No Deposit Option. Each booking then gets a Green, Yellow, or Red risk status. Safeguest does not block bookings, though, and its API blog leaves the door code to your PMS: "Ensure your PMS holds back door codes until the API returns an approved status."

How a direct guest reaches that flow is less clear, because Safeguest's own pages disagree. Its partner page offers hosts a setup with no integration and welcomes direct-booking hosts. Its product pages, however, describe a link "sent to the guest via your PMS" and never show how a host with only a direct booking website creates one. For bespoke booking engines, the Safeguest blog points to a direct guest verification API, although no public API documentation is linked from the site. Until Safeguest documents that route, enter direct bookings in your PMS first.

Pricing model: free screening for hosts, a guest-paid No Deposit Fee in place of a deposit, and an optional host-paid Protect service per stay.

Truvi

Best for: a host whose main exposure is damage, who wants protection tied to screening and a link that creates the booking with no PMS.

Truvi, formerly Superhog, applies its damage protection only to bookings that went through its screening. A booking with protection attached gets a risk rating from Low to Critical, based on characteristics including lead time, length of stay, booking patterns, and historic guest behavior. A Critical booking is not protected. And although "Block problem guests before they book" heads Truvi's screening page, the steps beneath it begin with "Your guest books", so screening starts once the reservation exists.

Every booking gets a base screen against Truvi's internal watchlist of problem guests, with emails checked for disposable addresses and phone numbers for burners. A watchlisted guest comes back Rejected with a cancellation recommendation, but the cancelling is yours to do. Everything else is an add-on: an ID and selfie match, a US sex offender search, and a seven-year US criminal search of 2400+ criminal databases. The ID add-on confirms that the name and date of birth on the ID match the booking. The criminal check "will only run on guests with a US address".

Any gate on the door code comes from your PMS or from you, because Truvi holds no door code. Of its guides for Guesty, OwnerRez, and Lodgify, only Guesty's describes results written back into the reservation as fields an automation can wait on before a message goes out. The other two cover importing bookings, leaving an OwnerRez or Lodgify host with no documented gate. For a booking with no PMS behind it, the One-Step Link creates the booking and starts verification in one go. With a PMS connected, you can exclude Airbnb bookings and screen the rest.

Pricing model: per booking, billed monthly in the month of check-in, with add-ons charged only when they run.

Enso Connect

Best for: an operator on a supported PMS who wants direct bookings to get a heavier check than Airbnb bookings, inside one guest app.

Enso Connect can hide check-in directions, listing details, and smart lock codes inside its guest app, Boarding Pass, until a set time or until you approve the guest. The checks behind that gate come from Autohost, Truvi, and Chekin, white-labeled inside the app. Rules sort them by channel: you can skip ID checks for Airbnb bookings, step up verification for last-minute direct bookings, and collect IDs only for Booking.com reservations.

Enso's free tier collects IDs and selfies for you to review, with no automated verification or risk scoring. Automated screening starts at the paid Screen tier, which evaluates every booking against Autohost's risk models before check-in. The Verify and Safeguard tiers then add an ID check against government and biometric databases and a full background check with OFAC and sex offender searches.

Enso promises a chargeback report that bundles the ID, signed agreement, IP address, device, location, and lock history into one download. Authority reporting runs in 18 countries through Chekin. Without a PMS, though, Enso's pricing FAQ names Airbnb as the only way in, so the one path shown for a phone booking is entry in a connected PMS.

Pricing model: quote-based subscription priced per listing, with screening tiers, background checks, and authority reporting as add-ons.

Linkbase

Best for: a manager already on a supported PMS who wants the arrival code kept out of the guest app until paperwork and checks are done.

On default settings, Linkbase's door code is "the last four digits of the guest's phone number", a number every guest already knows. Change it before you rely on the gate that hides it. Linkbase says the gate runs on its servers. Until every required step is complete, the guest app keeps the guest on the steps page instead of showing their stay details or code.

Linkbase is a guest-messaging and guest-app company first, and three outside services do the screening work. Autohost checks the ID and selfie on a hosted page, Truvi handles background screening and damage waivers, and Stripe holds deposits. Each requirement lists the booking channels it applies to, plus an Any Other catch-all. Linkbase suggests asking for ID and documents on direct bookings and skipping them where the platform already verifies guests. Each property is set to either a one-time waiver fee or a refundable card hold, and both include background screening before arrival.

A phone reservation has to be entered in the connected PMS first, since Linkbase lists no standalone link or public API for one. Check that your PMS is on Linkbase's list: of the eighteen it marks available, Streamline and Escapia still carry a check-availability label.

Pricing model: quote-based, with Stripe's standard processing fees on upgrade payments; screening and waiver pass-through pricing is not published.

Safely

Best for: a property manager whose priority is insurance on direct stays, with screening as an optional step they enforce themselves.

Safely is an insurance platform for professional short-term rental operators, with screening attached. Its property-manager page says Airbnb, Booking.com, and Vrbo insurance gives property managers no coverage options for renters who booked directly, and that Safely's direct APIs for direct booking sites cover every stay automatically. That page targets portfolios of 10 or more rentals, and a host with one to nine homes gets a separate program on the homepage.

Screening at Safely is optional, and, Safely says, coverage of a reservation does not depend on the guest completing it, so keeping an unscreened guest out is your job.

Safely checks identity first, from photos of an ID, front and back, and a selfie. The background check itself then needs only the guest's name, date of birth, and address. The search reaches past US records to Europol, Interpol, and other international watchlists. It also covers county and court records, national and criminal databases, sex offender lists, and the SafelyScore, Safely's own database of bad stays.

Safely also sells Chargeback Protection against eligible revenue losses from fraudulent or disputed guest charges, and its eligibility terms decide what a direct stay gets. Damage claims must be filed within 60 days of checkout. If a phone booking has no email on file, you add the guest's email and trigger the screening request by hand.

Pricing model: per screening, or per night when bundled with Safely's protection policy; operators set the guest-facing insurance fee.

How do you screen guests for direct bookings?

To screen vacation rental guests on direct bookings, take payment through a link that can run 3D Secure, get the rental agreement signed, match the guest's ID to a live selfie before the door code goes out, and save proof of who arrived plus each booking's IP address and device. Those are the records a card dispute asks for.

1. Pay through a checkout or link that can run 3D Secure: 3D Secure's liability shift moves the loss to the guest's bank on fraud claims only. A stay disputed as not received or not as described is fought with the signed agreement and proof of arrival from steps 2 to 4 and with your guest messages. Keying in a phone guest's card makes it a mail or telephone order (MOTO), where an approved Stripe exemption leaves the liability with you. For a phone or email booking, send a payment link that can run 3D Secure, then the verification link, and release the door code after both clear.
2. Get the rental agreement signed before arrival: Stripe's vacation rental guide lists signed rental agreements first among the documents needed to win a dispute filed after checkout.
3. Check the ID against a live selfie before the door code goes out: once a code is sent, a failed check cannot take it back.
4. Keep proof of who arrived: one host on Facebook lost disputes on two direct bookings to guests who said they "never stayed at the place", though both had provided an ID matching the payment method. An ID sent at booking shows only who booked, but Visa's April 2026 Core Rules list a link between "the person receiving the merchandise or services and the Cardholder" as allowable compelling evidence in fraud disputes. That host now requires that "the booking person be the staying guest", putting that person on the doorbell camera. The direct-booking marketplace Houfy counts lock logs and codes sent and used as proof of access.
5. Record the IP address and device on every stay: Visa's Compelling Evidence 3.0 rule lets you answer a returning guest's fraud dispute with their own earlier stays. Two undisputed stays on the same card count if they are 120 to 364 days old and match on IP address and device, or on one of those plus the guest's email address, if you saved them.
6. Know how long the dispute window stays open: Stripe puts the typical window at 120 days from the original payment, but Visa counts a not-received claim from the date the stay was expected, up to 540 days after payment. With the average direct booking made 80 days before arrival in Key Data's October 2025 figures, that clock can start almost three months after payment at booking, so keep records well past checkout. A fraud claim counts from the payment date, and once a dispute lands, Stripe gives 7 to 21 days to respond, depending on the card network.
7. Treat the deposit as damage money only: a deposit stops no chargeback, because card disputes run through the payment processor and the issuing bank, and Truvi's protection and Hostfully's Screen & Protect both exclude "Credit card chargebacks." How a chargeback plays out for the merchant covers the rest.

Say a family who stayed last winter emails to rebook. Their booking gets the same payment link, agreement, and check as a new guest's. If Authenticate verified them before, ReAuthenticate re-verifies them with a selfie and asks for a government ID if it doesn't match. Save the new booking's IP address and device too, because Compelling Evidence 3.0 counts only earlier stays whose details you kept.

Illinois's Biometric Information Privacy Act (BIPA) requires written notice and a "written release" before collecting a "scan of hand or face geometry". Texas requires notice and consent. A 2025 Texas amendment in effect since January 2026, though, exempts AI systems used to prevent or detect identity theft or fraud. Pick a vendor with a guest consent step, and ask counsel who counts as the collector.

Frequently asked questions

Can I move a good Airbnb guest to a direct booking?

Asking an Airbnb guest to move a booking off Airbnb breaks its Off-Platform Policy, which bans "Asking or encouraging users to move current, future, or repeat bookings (including reservation extensions) off of Airbnb" and "Offering or soliciting discounts to book off of Airbnb." Repeated or severe violations can lead Airbnb to suspend or deactivate listings or accounts.

How do you screen a repeat guest who books direct?

Screen a repeat guest on each new direct booking, even one who emails to rebook. On Vrbo, identity confirmation "isn't currently required" to book, so a guest met there may never have shown a document or selfie. Guesty's GuestVerify currently re-verifies guests for each booking, and Authenticate's ReAuthenticate re-verifies a guest it verified before with a selfie. Safeguest lets trusted repeat guests skip verification with a passcode, but warns this "could impact the accuracy of the Risk Status."

What happens when a direct-booking guest refuses verification?

When a direct-booking guest refuses verification, the call is yours unless registration law decides it, so state the requirement before payment. Autohost's launch guide recommends telling guests at booking that screening stands between them and their check-in instructions. An Airbnb guest who balked at a Truvi selfie wrote on Reddit that "This requirement was never mentioned in the listing."

Does the FCRA apply to guest screening for direct bookings?

Guest screening vendors frame the FCRA differently, whatever the booking channel. Safely tells hosts that if you deny a guest on its findings, "we follow the Fair Credit Reporting Act (FCRA) to inform them," and Autohost's Checktiv lists adverse-action workflows as coming soon. Authenticate positions short-term rental guest screening as Non-FCRA risk mitigation, treating a failed check as a flag for review. Ask counsel how the law applies to you.

Do you need to screen every guest on a direct booking, or only the lead guest?

Screening every guest or only the lead guest on a direct booking depends on the tool and local law. Truvi screens only the lead guest, as the person responsible for the booking, Guesty's GuestVerify verifies the main guest, and ChargeAutomation lets you collect ID from the primary guest or all guests. Spain's registration form, though, must be signed by "toda persona mayor de catorce años," every guest over fourteen.

How long can you keep a direct-booking guest's ID and selfie?

Keeping a direct-booking guest's ID and selfie falls to you or your vendor, whereas Airbnb does not share a guest's government ID with hosts. Illinois's BIPA requires a written, public retention policy for permanently destroying face-geometry and other biometric data once its purpose "has been satisfied or within 3 years of the individual's last interaction," whichever occurs first, and Safeguest says it deletes ID and biometric images right after verification. Check other states with counsel.

What guest screening for direct bookings cannot promise

We found no published comparison of direct and OTA fraud or chargeback rates, and no set of records guarantees how a dispute ends. Even ChargeAutomation, whose homepage claims its fraud detection "eliminates Chargebacks entirely", answers "Not completely" when its own FAQ asks whether chargebacks can be eliminated. Before the next direct booking, pick the tool that checks the guest and have your PMS or that tool hold the door code until it passes. Authenticate's link runs the check on any channel, phone included, and adds the verified ID, with an optional selfie and liveness check, to the records a dispute asks for, while PMS rules hold the code.

Related resources

• Our comparison of ten short-term rental guest screening platforms
• What each Guesty guest screening integration writes back
• Top 10 guest screening platforms for Hostaway
• Authenticate's criminal background checks