Email fraud in
property management.
Property managers handle other people's money all day — rent, deposits, owner disbursements, vendor payments — and most of it is arranged by email. That makes property management one of the most consistently targeted small-business types for email fraud. Here are the specific schemes and a checklist to keep the money where it belongs.
Property managers are targeted through wire fraud on deposits and owner payouts, vendor invoice-redirect fraud, scammers cloning real listings to collect deposits from renters, and owner- or executive-impersonation. The common defense is one rule: treat every new or changed payment instruction — from an owner, vendor, or tenant — as unverified until confirmed by phone on a number you already had. Add dual approval for disbursements, consistent secure payment channels, and clear messaging to renters about how you actually collect money.
The schemes that target property managers
- Wire fraud on deposits and owner payouts. A fraudster impersonates an owner, a title company, or staff to redirect a security deposit, a disbursement, or closing funds to an account they control.
- Vendor invoice redirect. A message — often from a compromised contractor mailbox — says a vendor's bank details have changed, so your next payment for real work goes astray. See our invoice-fraud guide.
- Listing-clone rental scams. Scammers copy your genuine listings, pose as you or the owner, and collect deposits or first-month rent from hopeful tenants who never get the keys. It costs the applicant money and costs you trust and reputation.
- Owner- and executive-impersonation. A “property owner” or “regional manager” emails staff with an urgent, confidential request to move funds — classic business email compromise.
- Applicant and tenant-payment scams — fraudulent applications, overpayment “refund” scams, and fake payment confirmations.
The prevention checklist
- Verify every payment change out-of-band. New or changed bank details for an owner, vendor, or tenant get confirmed by phone on a number you already had — never one from the email.
- Use consistent, secure payment channels for rent, deposits, and disbursements, and don't accept or send changes to those by email alone.
- Require dual approval for disbursements above a set amount, especially owner payouts and vendor payments.
- Reconcile trust and escrow accounts daily. A daily reconciliation of rent-collection and trust accounts catches a redirected payment within a day — while there is still a chance to recover it — rather than at month-end. The title industry's 2025 best-practice guidance names this as a core wire-fraud control.
- Tell owners and tenants how payment changes work — and don't. State on invoices and portals that you will never change payment or banking instructions by email alone, so a spoofed “new account” message is recognized for what it is.
- Tell renters plainly how you collect money — and how you don't. State on your listings and site that you never take deposits by wire, gift card, or payment app before a verified showing and a signed lease. This disarms the clone-listing scam.
- Turn on multi-factor authentication on email and your property-management software, and watch for new inbox forwarding rules that signal a compromised account.
- Protect owner and tenant data — keep bank details and identity documents out of ordinary email; use a secure portal.
- Train leasing and accounting staff on these specific scams, and make clear that pausing to verify a payment is always the right call.
If a fraudulent payment or listing appears
For a redirected payment, call your bank immediately to attempt a wire recall — speed is everything — and report to the FBI at IC3.gov. For a cloned listing, report it to the hosting platform for removal, warn affected applicants, and document everything. In both cases, preserve the original emails with full headers, and secure any mailbox that may have been accessed.
Sources & further reading: FBI IC3 (ic3.gov) · U.S. FTC on rental scams (consumer.ftc.gov) · ALTA 2025 Best Practices and wire-fraud advisories · NAR real-estate fraud reporting. Loss figures are as reported to the FBI IC3 for the year noted. Educational only; not a substitute for advice from your bank, attorney, or a qualified professional.
Common questions
How does email fraud target property managers?
Property managers sit on top of rent, deposits, and owner disbursements, and they exchange money instructions by email constantly — which is exactly what fraudsters exploit. The common forms are wire fraud on deposits and owner payouts, vendor invoice-redirect fraud, scammers cloning your real listings to collect deposits from would-be tenants, and executive- or owner-impersonation asking staff to move funds.
Someone is using our listing to scam renters. What do we do?
Report the fraudulent listing to the platform hosting it and ask for removal, warn prospective tenants that you never take deposits by wire, gift card, or app before a signed lease and verified showing, and document it. You can also report to the FTC and the FBI. You can't always stop the cloning, but clear, repeated messaging about how you actually collect money protects your applicants.
How do we prevent wire fraud on security deposits and owner payouts?
Treat every new or changed payment instruction — from an owner, a vendor, or a tenant — as unverified until you confirm it by phone using a number you already had on file. Use consistent, secure payment channels, avoid taking or sending wire changes on email alone, and require dual approval for disbursements above a threshold.
What is vendor invoice-redirect fraud in property management?
It's when a fraudster, often from a compromised vendor mailbox, emails to say a contractor or supplier's bank details have changed, so your next payment goes to them instead. Because it can come from the real vendor address and reference genuine work, it looks routine. Confirm any banking change with a known vendor contact by phone before paying.
How does daily account reconciliation help against wire fraud?
Reconciling your trust, escrow, and rent-collection accounts every day means a redirected or missing payment surfaces within a day rather than at month-end, when the money is long gone and unrecoverable. Prompt reconciliation is one of the controls emphasized in the title-industry's 2025 best-practice guidance on wire fraud, and it applies just as well to property management, where recovery depends on catching a fraudulent transfer fast.
How should we handle tenant and applicant personal information?
Collect it through a secure application portal, not by email. Rental applications contain exactly what identity thieves want — Social Security numbers, bank statements, and ID copies — and a phished mailbox full of applications is a serious breach. Keep that data out of ordinary email, limit who can access it on a need-to-know basis, and be alert to phishing that impersonates your office to request it.
Watch the inbox where the money is arranged
Family Sentinel's Org Guard watches property-management email for the exact signals of these scams — lookalike domains, new-payee and wire language, and mailbox rules that hide replies — and alerts a person you choose before a payment moves. Read-only, and never able to send or delete.