Property managers handle other people's money all day — rent, deposits, owner disbursements, vendor payments — and most of it is arranged by email. That makes property management one of the most consistently targeted small-business types for email fraud. Here are the specific schemes and a checklist to keep the money where it belongs.
Property managers are targeted through wire fraud on deposits and owner payouts, vendor invoice-redirect fraud, scammers cloning real listings to collect deposits from renters, and owner- or executive-impersonation. The common defense is one rule: treat every new or changed payment instruction — from an owner, vendor, or tenant — as unverified until confirmed by phone on a number you already had. Add dual approval for disbursements, consistent secure payment channels, and clear messaging to renters about how you actually collect money.
For a redirected payment, call your bank immediately to attempt a wire recall — speed is everything — and report to the FBI at IC3.gov. For a cloned listing, report it to the hosting platform for removal, warn affected applicants, and document everything. In both cases, preserve the original emails with full headers, and secure any mailbox that may have been accessed.
Sources & further reading: FBI IC3 (ic3.gov) · U.S. FTC on rental scams (consumer.ftc.gov) · ALTA 2025 Best Practices and wire-fraud advisories · NAR real-estate fraud reporting. Loss figures are as reported to the FBI IC3 for the year noted. Educational only; not a substitute for advice from your bank, attorney, or a qualified professional.
Property managers sit on top of rent, deposits, and owner disbursements, and they exchange money instructions by email constantly — which is exactly what fraudsters exploit. The common forms are wire fraud on deposits and owner payouts, vendor invoice-redirect fraud, scammers cloning your real listings to collect deposits from would-be tenants, and executive- or owner-impersonation asking staff to move funds.
Report the fraudulent listing to the platform hosting it and ask for removal, warn prospective tenants that you never take deposits by wire, gift card, or app before a signed lease and verified showing, and document it. You can also report to the FTC and the FBI. You can't always stop the cloning, but clear, repeated messaging about how you actually collect money protects your applicants.
Treat every new or changed payment instruction — from an owner, a vendor, or a tenant — as unverified until you confirm it by phone using a number you already had on file. Use consistent, secure payment channels, avoid taking or sending wire changes on email alone, and require dual approval for disbursements above a threshold.
It's when a fraudster, often from a compromised vendor mailbox, emails to say a contractor or supplier's bank details have changed, so your next payment goes to them instead. Because it can come from the real vendor address and reference genuine work, it looks routine. Confirm any banking change with a known vendor contact by phone before paying.
Reconciling your trust, escrow, and rent-collection accounts every day means a redirected or missing payment surfaces within a day rather than at month-end, when the money is long gone and unrecoverable. Prompt reconciliation is one of the controls emphasized in the title-industry's 2025 best-practice guidance on wire fraud, and it applies just as well to property management, where recovery depends on catching a fraudulent transfer fast.
Collect it through a secure application portal, not by email. Rental applications contain exactly what identity thieves want — Social Security numbers, bank statements, and ID copies — and a phished mailbox full of applications is a serious breach. Keep that data out of ordinary email, limit who can access it on a need-to-know basis, and be alert to phishing that impersonates your office to request it.
Family Sentinel's Org Guard watches property-management email for the exact signals of these scams — lookalike domains, new-payee and wire language, and mailbox rules that hide replies — and alerts a person you choose before a payment moves. Read-only, and never able to send or delete.