Fake “new bank details” emails to your tenants and owners

Property managers move money in every direction: rent coming in, payouts to owners, payments to vendors and contractors. Every one of those is a chance for a criminal to send a believable email that changes where the money goes.

One property manager we audited this month publishes a free webmail address as its main contact, and its own domain has no DMARC record, which means nothing stops someone sending mail that looks like it came from the company. That combination is what makes these scams easy.

The three versions we see

• To tenants: “We’ve switched banks. Please send rent to the account below from now on.”
• To owners: a message that looks like it’s from the owner, asking you to send their next payout to a new account.
• To your office: an invoice from a vendor you really use, with new payment details, or a contractor asking to be paid somewhere new.

What to change

• Use an address on your own domain for everything tenants and owners see. A free webmail address can be copied by anyone who registers a similar one, and tenants can’t tell the difference.
• Make your domain impossible to forge. SPF, DKIM and an enforced DMARC policy stop mail claiming to be from you that didn’t come from you. Check yours with our email forgery check.
• Put it in the lease. One line: we will never change where you pay rent by email; any change will be posted in your tenant portal and confirmed by phone. Repeat it in your welcome email and on the payment page.
• Take payment changes by phone, at a number you already had. That goes for owners and vendors too. Never use the number in the email asking for the change.
• Collect rent through a portal, not a bank account number sent by email, so there’s nothing for a scammer to swap.
• Turn on two-step sign-in for every mailbox in the office. The most damaging version of this scam comes from a real, broken-into account, and DMARC can’t stop that one.

If a tenant already paid the wrong account

Ask the tenant to call their bank right away and report the payment as fraud, and to file a report at ic3.gov. Save the email with its full headers. Then find out how it was sent: forged from your domain, a look-alike domain, or a real account that was broken into. The answer decides what you fix.