Rent payment fraud: how agencies and property managers can protect tenants and owners

Rent payment fraud follows a simple script: a tenant, a landlord or a leaseholder receives an email that appears to come from their agency, announcing new bank details. The next payment (a month's rent, a deposit, a service charge) goes to an account controlled by a fraudster. It is the property version of payment diversion fraud, and estate agents, letting agents, property managers and block managers are natural targets.

This guide is written for agencies and managers, and for the people who pay them. It explains why the sector is exposed, the scenarios to expect, a prevention plan any agency can put in place without a large budget, a ready-to-use notice for tenants, and what to do when a payment has gone to the wrong account.

Why real estate is exposed to rent payment fraud

Property management combines every condition a fraudster looks for.

• Recurring payments. Rent and service charges fall due on predictable dates, so a fraudster knows when to send the message.
• Large one-off amounts. Deposits, holding deposits and reservation fees, and the sums involved in a sale, are paid once, often by someone who has never paid the agency before and has nothing to compare with.
• Many parties. Tenants, applicants, landlords, leaseholders, contractors and the agency's own staff all exchange bank details.
• Email as the default channel. Tenancy agreements, rent statements, invoices and payment demands travel by email, so one more email announcing new bank details does not stand out.
• Public information. Agency names, staff, addresses and listings are online by design, which makes a convincing message easy to write.

A lookalike of the agency's domain is all a fraudster needs to write to every one of these contacts from a credible address. Our guide to detecting lookalike domains shows how these domains are built.

Typical scenarios of property management fraud

A fake email to tenants announcing a new account

This is the classic tenant bank details scam. Tenants receive a message in the agency's style: the agency has changed banks, rent must now be paid to a new account, standing orders must be updated. The sender is lettings@dupont-imm0.fr instead of lettings@dupont-immo.fr. Every tenant who updates their standing order sends the following months' rent to the fraudster, until the landlord reports missing payments.

Deposit fraud on a new tenancy

An applicant has been accepted and is waiting for instructions to pay the deposit and the first month's rent. A message from a lookalike domain arrives before the agency's, with different bank details. The applicant has never paid this agency before, so nothing looks unusual. To time it this precisely, the fraudster generally needs to read the conversation, through a compromised mailbox on either side.

A fake email to or from a landlord

The fraud can also target the money the agency pays out. A message that appears to come from a landlord asks the agency to pay future rent into a new account. In the other direction, a landlord receives an invoice for works, apparently sent by the agency, with bank details that belong to someone else.

A fake service charge demand to leaseholders

In a managed building, leaseholders receive a service charge demand or a request for funds for major works, in the managing agent's layout, with altered bank details. One message reaches every owner in the building at once.

In every case the email itself can look flawless. What gives it away is the sender's domain, the request to change bank details, and the absence of any confirmation through a channel the recipient already knows.

A rent payment fraud prevention plan for your agency

None of these measures requires a large budget. Together, they make the scam much harder to pull off.

1. Put a standing message on every document

Every tenancy agreement, rent receipt, statement, invoice and payment demand should carry the same sentence: our bank details never change by email. Repeat it in your email signatures and your client portal. The goal is that a tenant who receives a fake message already knows it cannot be genuine.

2. Give one known phone number for checks

Choose one number, printed on the tenancy agreement and on your website, that clients can call to check any payment request. Ask them to dial it themselves and never to use a number given in an email. Apply the same rule internally: a landlord's or contractor's change of bank details is confirmed by calling the number already on file, and approved by a second person.

3. Lock down your domain with DMARC

Publish SPF and DKIM for every service that sends email on your behalf, including your property management software, then move DMARC to p=reject. Fraudsters can then no longer send emails using your exact domain. Our DMARC p=reject guide explains how to get there without blocking your own messages. Turn on multi-factor authentication for every mailbox too: DMARC does not help if a real account is taken over.

4. Monitor lookalikes of your agency's domain

DMARC cannot stop a lookalike such as dupont-imm0.fr or dupont-immo-lettings.com, which the fraudster owns. A free lookalike domain scan on Spamr checks several hundred variants of your domain (typos, lookalike characters, other extensions, added words) using public DNS and registration data only. A recently registered lookalike with a mail server (MX record) is the most urgent case: it can receive the replies of the tenants it writes to. Continuous monitoring rescans daily and alerts you by email when a new one appears; the real-estate page details what is checked for agencies.

5. Prepare a response plan

Decide now who does what when a client reports a suspicious email: who calls the bank, who warns the other tenants and owners, who preserves the evidence, who requests the takedown of the lookalike domain. Keep your bank's fraud contact and your IT provider's number in the same document.

A notice template for tenants and owners

Copy this text into your welcome emails, tenancy agreements, rent receipts and service charge demands, and adapt it to your agency:

Important: our bank details never change by email. If you receive a message asking you to pay rent, a deposit or a service charge into a new account, do not make the payment. Call us on our usual number, shown on your tenancy agreement, to check. Also check the sender's address carefully: fraudsters use addresses that look almost identical to ours.

Sending this notice before any incident is what makes it work: a tenant who has read it once has a reason to pick up the phone.

What to do when a tenant or owner has paid the wrong account

1. The payer calls their bank immediately to ask for the transfer to be recalled. If your agency's account is involved, call your own bank too. Recovery is never guaranteed; speed gives the best chance.
2. Warn every client who may have received the message: the other tenants of the same landlord, the other leaseholders in the building. Write from your genuine address and follow up by phone where you can.
3. Keep the evidence: the fraudulent emails with their full headers, the bank details given and the payment confirmation.
4. Report it to the police. In France, file a complaint and get help from Cybermalveillance.gouv.fr. In the UK, report it to Report Fraud, the national service that replaced Action Fraud, or to Police Scotland if you are in Scotland.
5. Find the source. Check your mailboxes for unknown forwarding rules and suspicious sign-ins, and change passwords. If a lookalike domain was used, ask the registrar and the host to take it down: our guide to taking down a lookalike domain describes the steps.
6. Get advice. A lawyer can explain the respective responsibilities of the agency, the landlord and the payer. If a mailbox was compromised, your clients' personal data may have been exposed: ask your data protection adviser or lawyer whether a notification is required. Inform your insurer as well.

Key takeaways

• Rent payment fraud exploits predictable payments, large deposits and the habit of sending everything by email.
• Tell every client, in writing and repeatedly, that your bank details never change by email.
• Give one known phone number for checks, and require two people to approve any change of bank details.
• DMARC at p=reject protects your exact domain; lookalikes need monitoring and takedown.
• Prepare the response plan before you need it.