Email security for property management companies: rent fraud and how to stop it

A property management company moves money in every direction: rent and deposits in from tenants, distributions out to owners, invoices out to maintenance vendors. Most of the instructions for that money travel by email. This guide covers the email fraud that targets property managers specifically, what FBI guidance on payment fraud and FTC guidance on rental and fake check scams say about it, and a checklist your office can work through this week.

Why are property management companies targeted by email fraud?

Property managers are targeted because their email controls predictable, recurring payments between many parties who rarely meet. A criminal who reads one manager's inbox learns when rent is due, which vendor gets paid next and which owner expects a distribution, and can then send a convincing "new bank details" message at the right moment.

Business email compromise (BEC) is the name for this kind of fraud: a criminal impersonates or takes over a trusted email account to redirect a payment. The FBI's IC3 recorded $55,499,915,582 in exposed BEC losses worldwide between October 2013 and December 2023 (IC3 PSA I-091124-PSA). Rental fraud aimed at the public is also large. The FBI's 2025 IC3 report lists 12,368 complaints and $275,110,419 in losses under its Real Estate crime type, which it defines as loss of funds from a real estate investment or "fraud involving rental or timeshare property." The FTC says people reported nearly 65,000 rental scams with about $65 million in losses from January 2020 through June 2025 (FTC Data Spotlight).

What email scams target property managers, tenants and owners?

Property management fraud falls into six patterns. The table shows who each one targets and the check that stops it.

Fake rent payment notices sent to tenants

The highest-volume threat is a message to tenants that changes where rent goes. It comes from one of two places: a lookalike of your domain, such as oakview-properties.com instead of oakviewproperties.com, or your own mailbox after someone stole a password. The second is worse, because the message is sent from your real address, arrives in an existing conversation and passes every authentication check. Here is an example of a message tenants should never act on:

Example: "Dear Resident, due to an audit of our banking provider, rent for next month must be paid to our new account below. Payments to the old account will be returned and late fees may apply. Please email a screenshot of your transfer to accounts@oakview-properties.com. Oakview Property Management."

Signs that something is wrong: a deadline or late-fee threat, a request to pay outside your usual portal, a request to send proof of payment to a different address, and a sender domain that's one character off. The FBI's BEC advice applies directly: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information," and verify the sender's address carefully, "especially when using a mobile or handheld device" (IC3 PSA I-091124-PSA).

Owner and vendor payment redirection

Owners and maintenance vendors are paid on a schedule, which makes them easy to impersonate. A criminal sends a request from a lookalike of an owner's personal email or a contractor's business domain, or from the real account after a takeover, asking you to update bank details before the next payment run. Treat every bank change as unverified until you've called a number you already had. Our guide to vendor invoice fraud gives a full call-back procedure, and fake invoice and payment emails shows common invoice lures.

Cloned listings that use your company's name

Scammers copy real rental ads to collect deposits from people who never see the unit. The FTC says they take "the pictures, description, or virtual tour" from a real listing and "replace the agent's contact information with their own" (FTC). Its 2025 data spotlight adds that some copy listings from landlords who use self-tour services, then send the victim a lockbox code. The renter loses money, and your company takes the angry phone calls. Publish on your website how you take applications and payments, so a renter can check, and ask listing sites to remove clones.

Fake applicants and overpayment checks

A fake applicant sends a check for more than the deposit or fee, then asks you to refund the difference. The FTC explains why this works: "By law, banks have to make deposited funds available quickly," but "fake checks can take weeks to be discovered," and by then "you're stuck paying the money back to the bank" (FTC fake check scams). Never refund an overpayment until your bank confirms the funds have truly cleared.

Phished staff mailboxes

All of the payment schemes get easier once a criminal is inside a staff mailbox. The usual route is a fake sign-in page for Microsoft 365, Google, your property management software or a shared document. Once in, attackers add rules that hide replies from tenants and forward mail about payments. Our guides to malicious inbox rules and signs your email account is compromised show how to check.

How do you stop tenants from paying rent to scammers?

Give tenants one payment channel and tell them, in writing and repeatedly, that it will never change by email. Technology reduces fake messages; the tenant's knowledge of your rule is what stops the payment.

1. Use one payment method (your resident portal or a fixed bank account) and list it in the lease.
2. Add a lease clause or welcome-letter line: "We will never change our payment details by email or text. If you receive such a message, call the office at the number on your lease."
3. Repeat the message on rent reminders and portal announcements, especially after any staff change.
4. Publish DMARC at enforcement so mail faking your exact domain is rejected by tenants' mail providers (see below).
5. Protect staff mailboxes with MFA so your real address can't be used against tenants.
6. If a tenant reports a fake notice, check your own mailboxes for compromise, warn other tenants at that property, and report the fake domain to its registrar.
7. If a tenant has already paid, tell them to contact their bank immediately to try to stop or recall the payment and to file at ic3.gov. Whether the tenant still owes rent is a legal question; ask a local attorney rather than deciding on the spot.

How do you stop criminals sending email as your company?

Publish SPF, DKIM and DMARC for your domain. SPF lists the servers allowed to send your mail, DKIM adds a cryptographic signature, and DMARC tells receiving servers to quarantine or reject mail that fails both. Include every service that sends as you, such as your property management software, resident portal and maintenance ticketing, or their notices will fail too. A DMARC record at enforcement looks like this example:

_dmarc.example-properties.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-properties.com"

Start at p=none, check reports for a few weeks, then move to quarantine and reject. Our DMARC from none to reject guide and authenticating third-party senders cover the steps.

DMARC doesn't stop lookalike domains. Use the Lookalike Domain Generator to see which near-copies of your domain already exist, and read lookalike domain phishing and what to do when customers are phished by a fake version of your company.

Is Microsoft 365 or Google Workspace protection enough for a property manager?

For many small companies, Microsoft 365 or Google Workspace configured properly is a reasonable baseline. Both filter spam and malware and support MFA and external sender warnings. If you've never reviewed the settings, start with Microsoft 365 preset security policies or Google Workspace advanced phishing and malware protection.

An MX-level filter adds a checkpoint before mail reaches your leasing and accounting staff. MX-level filtering means your domain's MX records point to a filtering service that checks mail before your platform delivers it. It helps when phishing keeps reaching staff, when leasing agents need to release a held application themselves from a quarantine digest, and when you manage several company or property domains. iBlockSpam prices per domain with unlimited mailboxes; see email security for small businesses for how it fits a small office.

Property management email security checklist

1. Turn on MFA for every staff mailbox, your property management software and your bank portal.
2. Give each person their own login; replace shared "leasing@" passwords with a shared mailbox opened by individual accounts. See shared mailbox spam protection.
3. State your single rent payment channel in every lease and welcome letter.
4. Require a phone call to a known number and a second approver for any owner, vendor or tenant bank change.
5. Refund overpayments and deposits only after funds clear, and only to details on file.
6. Publish SPF, DKIM and DMARC, including your software and portal senders.
7. Check every mailbox for forwarding and inbox rules you didn't create, each quarter.
8. Search for cloned listings of your units monthly and report them.
9. Train leasing and accounting staff on payment-change fraud, fake sign-in pages and fake applicants.
10. Write down who to call after an incident: your IT contact, your bank, your attorney and ic3.gov. Our after clicking a phishing link guide covers the first hour.

Next steps

• Run the free Email Health Check on your company domain to see your MX, SPF and DMARC setup.
• Add the "we never change payment details by email" line to your next rent reminder.
• Read business email compromise prevention for the wider set of controls.
• If you want an inbound filtering layer each staff member can manage from a digest email, see email security for small businesses. Pricing is per domain, not per mailbox.

More threat guides are in our phishing and threats topic.