How to Spot a Hidden Camera in an Airbnb or Hotel

TL;DR

Airbnb's official policy, in effect since April 30, 2024, bans any camera that monitors an indoor space in a listing, even one that is turned off, and requires hosts to disclose exterior cameras in the listing description. A camera that violates that rule is most likely a small pinhead or "button" lens set into an everyday object. The detection playbook is to do a focused visual sweep of the obvious hiding spots first, then run a flashlight pass in a darkened room to catch lens reflections, then run a Wi-Fi network scan with Fing to surface unknown devices on the local network. If you find anything, photograph it in place, do not touch it, leave the listing, and report to the local police non-emergency line and to Airbnb.

What Airbnb's policy actually allows, in plain English

The reason to start with the policy is that it tells you what a host is and is not allowed to do, and therefore what counts as a violation.

Airbnb's policy page on security cameras states that "We do not allow hosts to have security cameras or recording devices that monitor indoor spaces in homes, even if these devices are turned off," adds that "Hidden cameras have always been prohibited and will continue to be prohibited," and dates the current rules to April 30, 2024.^[1] The same page lists the interior spaces covered as the hallway, bedroom, bathroom, living room and guest house, says the ban also applies to the common areas and shared spaces of private room listings, and separately bars cameras over exterior areas where guests have a greater expectation of privacy, giving the inside of an enclosed outdoor shower and a sauna as its examples.^[1]

Exterior cameras are allowed but must be disclosed, with example disclosure language including "I have a camera in my front yard," "I have a camera over my patio," "I have a camera over my pool," and "I have a doorbell camera monitoring my front door and the hallway of my apartment building."^[1] The disclosure duty covers exterior cameras under the host's control, and the page's own examples are the hallway of the host's apartment building and a camera over the backyard.^[1]

Noise decibel monitors, which the page defines as devices that assess sound levels and duration but do not record audio, are allowed indoors if the host discloses their presence and they are not in bedrooms, bathrooms or sleeping areas; hosts are not required to disclose where they are.^[1] Smart home devices such as Alexa and Google Nest are permitted, and Airbnb "encourages" hosts to let guests unplug or disable them but does not require it.^[1] There is a narrow Japan-only exception that lets hotels operating under a Hotel Business License put a camera at the interior entryway, provided it is disclosed, records no audio, and covers no other space.^[1]

If the host is following Airbnb's policy, you should expect any disclosed cameras to be exterior, and any disclosed audio device to be either a disclosed decibel monitor (location not specified) or a smart speaker (which you are entitled to unplug). Any camera pointed at a bed, a bathroom, a shower, a hot tub, a sauna, or any other interior space is a violation of the policy, full stop, and should be treated as evidence of a crime rather than as a misunderstanding.

What a hidden camera actually looks like

Hidden cameras are built around the same pinhead lens module sold to anyone who can use a search engine. The smallest consumer models are a few millimetres across at the lens, small enough to sit behind a pinhole. The lens is the only piece you can reliably see, and it is set into something that already lives in the room: a smoke detector on the ceiling, a USB charger in an outlet, a digital alarm clock on the nightstand, a picture frame on the wall, a television, a router, a pen, a clothing hook behind a door, or a decorative object.

One recent case illustrates the shape. In Winter Park, Florida, three cameras were found in a coffee shop bathroom on March 22, March 25 and April 28, 2026, and police believe people were recorded between March 21 and April 28: two cameras were concealed in a hole where plumbing enters the wall, and the third was stuck to the back of a trashcan.^[2] Police said the cameras stored footage on removable SD cards and did not appear to be Wi-Fi capable, which is why a network scan would not have caught them.^[2] The objects in the list above share the two things a hidden camera needs, a power source or a long-lived battery and a clear line of sight to a bed or bathroom, which is why a sweep starts there.

The lens is the only part that has to be exposed, because the lens has to see the room. Everything else can be hidden inside the object. That is why a flashlight pass is the single most useful tool: any glass surface returns a specular highlight when a light hits it at the right angle, and a lens, even one set into a fake screw head, returns a noticeably brighter pinpoint of reflection than the surrounding plastic.

The flashlight pass: the fastest way to catch a lens

The flashlight pass works because every camera lens is a curved glass surface facing the room. When you sweep a flashlight beam across an object, the lens reflects the beam back as a small, bright, often bluish point of light. A screw head, a status LED, or a piece of trim returns a dull or scattered reflection; a lens returns a tight point.

The procedure:

Make the room as dark as you can get it. Close the curtains, turn off the lights, and turn off the television.
Hold a bright flashlight (your phone is fine) at roughly chest height and about three feet from the wall or object you are scanning.
Sweep the beam slowly across each object on your list, watching for a pinpoint of reflection that is brighter than the surrounding surface.
Change your angle and look again. A real lens reflects back toward the light source regardless of the angle you are looking from, while most non-lens reflections shift or disappear when you move.
Stop and investigate any reflection that does not move when you change angles.

What you are looking at, in practice: a tiny bright dot inside a smoke detector's vented grill, a point of light inside a clock display that should be uniform, a pinpoint inside a USB charger's plastic shell, or a small dot in a decorative object that does not have any visible reason to reflect. Any of those is a reason to take a photo of the object in place and move to the next step.

The flashlight pass does not detect cameras that are turned off, lenses that are behind an infrared-transparent dark plastic, or cameras in objects where the lens is recessed deeply enough that the reflection is diffused by the housing. It will, however, catch the bulk of the small pinhead lenses that are actually used in the cases that get reported.

Wi-Fi network scan with Fing: catching the cameras that broadcast

Many hidden cameras stream or upload over the listing's Wi-Fi. Fing, a network scanner for iOS and Android, markets a "Find hidden cameras" feature that it describes as "detecting cameras and spy-devices in a matter of seconds," and works by enumerating every device on the local network and identifying each one by manufacturer, model, and device class.^[3] Fing says it uses "AI-powered recognition" and its product page reports a catalog of 450K device models and 15M scans a month.^[3]

How to run it on a rental Wi-Fi network:

Install Fing from the App Store or Google Play. The base product is free; Fing's product page reports average scores of 4.6 across more than 110,000 reviews and 4.5 across more than 750,000 on the two mobile stores.^[3]
Join the listing's Wi-Fi network with the guest password the host gave you. A scan only sees devices on the network your phone is connected to, so a camera on a second, undisclosed network will not appear.
Open the app and run a device scan. Fing enumerates every device on the local network and labels what it can identify.
Read the device list. Anything Fing identifies as a camera, an unknown IoT device, or a device with a manufacturer name like "Hikvision," "Dahua," "Wyze," "Reolink," "Tuya," or "Xiaomi" is a candidate. Anything flagged as "Unknown" connected from an unusual location (inside a wall, inside a smoke detector) is also worth a closer look.
Take a screenshot of the device list, including MAC addresses. That becomes part of the evidence record if you need to report.

What Fing will not catch: cameras that record to a local SD card and never go online (the Winter Park case cameras were all SD-card-only, which is one reason the bathroom was recorded for nearly five weeks before the last camera was found), cameras on a separate cellular network, or cameras that are powered off at the moment of the scan.^[2]^[3]

The infrared check: catching night-vision LEDs

Most consumer hidden cameras include infrared LEDs for night vision, so the camera can record in a darkened room. Those LEDs are barely visible to the naked eye, but a phone camera sensor can show them as a white or purple glow, because the infrared-blocking filter in front of the sensor is not perfect. How much gets through varies by phone and by camera: front-facing cameras often have a weaker filter than the main rear camera, and 940 nm LEDs are much harder to see than 850 nm ones. Test your phone first by pointing a TV remote at each camera and pressing a button; whichever camera shows the remote's LED flashing is the one to use for the sweep.

The procedure:

Make the room as dark as possible. Close the curtains, turn off every light, and turn off the television.
Open your phone's camera app and switch to the camera that passed the remote-control test (often the front camera). Standard photo mode is fine.
Slowly pan the camera around the room, watching the screen. Most reflections from glass and metal go dark. IR LEDs from a hidden camera will appear as a small, very bright pinpoint that does not correspond to any visible light in the room.
Focus your sweep on the same high-yield spots: smoke detectors, alarm clocks, USB chargers, picture frames, decorative objects, and anything with a small hole or a dark plastic face.

The IR check is a complement to the flashlight pass, not a replacement. A camera without IR LEDs will pass the IR check clean, and a camera with IR LEDs will also be caught by the flashlight pass in most cases. Running both takes an extra two minutes and catches more devices.

RF detectors and bug sweeps: when to bother

A consumer RF detector is a handheld device that lights up or beeps when it picks up a radio transmission in the Wi-Fi, Bluetooth, or cellular bands. In principle, an active hidden camera that is uploading footage or broadcasting on a known wireless frequency should make an RF detector chirp when you walk it past the device. In practice, RF detectors in the consumer price range have limits you should know about before you buy one.

The honest list of what consumer RF detectors catch and miss:

Catch: an active camera on the listing's Wi-Fi network broadcasting at the moment you sweep, an active camera on a Bluetooth tether, and any device transmitting in the detector's frequency range.
Miss: an SD-card camera that is recording locally and not transmitting, an active camera on a cellular network your detector does not cover, a powered-off camera, and an active camera that transmits only briefly on a long interval.

For most travelers the flashlight pass, the Fing scan, and the IR check together catch the practical cases faster and cheaper than any consumer RF detector, and they work whether the camera is broadcasting or not. A professional TSCM (technical surveillance countermeasures) sweep by a licensed investigator is more capable than any consumer tool and is worth it if you have a specific reason to believe a sophisticated adversary has targeted you; it is not worth it for a routine travel sweep.

What to do if you actually find a camera

Once you have located a suspected camera, four steps, in order.

Photograph it in place. Multiple angles. Include something with a timestamp in the frame (your phone's lock screen, a newspaper, the listing's check-in confirmation email). Do not pick it up yet.
Do not destroy or unplug it. Disabling the device ends any live updates and may wipe the storage, both of which destroy evidence. Police and prosecutors need the device in the state the host left it.
Leave the listing and contact the local police non-emergency line. Covertly recording people where they expect privacy is prosecuted under state voyeurism, video voyeurism or unlawful surveillance statutes; in the Winter Park case the suspect was arrested on suspicion of digital voyeurism.^[2] Reporting to the police non-emergency line gets an incident number on file, which Airbnb and any later civil action will both ask for.
Report the listing to Airbnb. Airbnb's enforcement section says that "if we determine that any community member violated our policies, we take appropriate action, including issuing warnings, suspending or removing listings, or suspending or removing an account from the Airbnb platform – depending on the severity of the conduct."^[4] Use the in-app listing report flow, attach the screenshots, and reference the police incident number.

If you cannot safely stay elsewhere and you cannot reach police, the safest minimum action is to bag the device (without disabling it), put it somewhere outside the room, and change locations. The device itself, its storage card and any account it is registered to are the evidence; do not give that up.

The Bottom Line

Airbnb's policy since April 30, 2024 is straightforward: no indoor cameras, even turned off, and disclosed exterior cameras only. A focused sweep of smoke detectors, alarm clocks, USB chargers, picture frames, and decorative objects, a flashlight pass in a darkened room, a Fing network scan for unknown devices on the Wi-Fi, and a phone-camera IR sweep catch most of the devices that are actually in use. If you find anything, photograph it in place, leave the device alone, contact the local police non-emergency line, and report the listing to Airbnb.