How do I verify a vendor's new bank account?

Call the vendor at a number you already had, from a contract or their website, not one in the message. Then hold the first payment for a few days or send a small test amount and confirm it by phone.

What should I do if I paid a fake invoice?

Call your bank's fraud line immediately to ask for a recall, then file at ic3.gov. Funds can sometimes be frozen if the report is fast.

How do I stop scammers from telling my tenants to pay a new account?

Tell tenants in writing that you will never change payment details by email or text alone, and give them a number to call. Use email authentication and two-factor sign-in on your own account.

Fake Bank Change Emails: A Landlord's Defense

Never change where money goes because of an email alone. Confirm every new bank detail by calling a phone number you already had, wait before paying the new account, and tell tenants in writing that you will never change rent payment details by email. If money already went out, call your bank at once and report it to the FBI's IC3, because speed decides whether funds can be frozen.

How big the problem is

The FBI calls it business email compromise: fraudsters take over or imitate an email account, or a phone number, to get someone to send a payment to the wrong place. In 2024 its Internet Crime Complaint Center recorded 21,442 business email compromise complaints with $2,770,151,146 in reported losses (FBI IC3, 2024 Internet Crime Report). Landlords are exposed from two sides: they pay contractors, and tenants pay them.

The three versions landlords see

The vendor switch: your roofer's email, or one that looks like it, sends an invoice with "our new bank details". The work was real; the account is not.
The rent redirect: tenants get an email that seems to come from you or your manager saying rent now goes to a new account. You find out when rent does not arrive.
The urgent partner: a message that seems to come from a co-owner or lender asks you to wire funds today, often citing a closing or a tax payment.

Common mistakes that let it through

Calling the phone number printed in the email that asked for the change.
Replying to the email to confirm. If the account is taken over, the scammer answers.
Paying the new account the same day because the invoice says it is past due.
Letting one person both change a payee's bank details and approve the payment.
Not telling tenants how you will, and will not, ever contact them about payments.
Leaving your email without two-factor sign-in, so one guessed password opens everything.

A verification rule you can follow every time

The FBI's fraud flyer reduces it to three words: check, call, wait. Turned into a rule for an apartment business:

Check: compare the sender's address letter by letter and look for a lookalike domain.
Call: phone the vendor at a number from your own records, a signed contract, or their website, never one from the message.
Wait: hold the first payment to any new account for a few business days, or send a small test amount and confirm receipt by phone.
Record: note who confirmed, when, and at what number, next to the vendor's file.

Example a made-up owner gets a $14,800 roofing invoice with new bank details on a Friday. She calls the roofer's office number from last year's contract, and they say they have not changed banks. A 10 minute call kept $14,800 from going to a stranger.

A short notice to tenants

Send this once a year and to every new tenant at move-in:

Where rent goes: the bank account named in your lease or welcome letter.
That you will never change payment details by email or text alone.
That any change will come in a signed letter and can be confirmed by calling the number in the lease.
Who to call if they get a message asking them to pay somewhere new.

The FTC adds two points if someone does impersonate your business: warn tenants quickly by mail, email or social media, leaving links out of the email so it does not look like phishing, and report it to local police, the FBI's IC3 and the FTC. It also recommends an email host that offers email authentication, which makes it harder to send mail that pretends to be from your domain (FTC, business email imposters).

If the money already went out

Call your bank's fraud line right away and ask it to recall the payment, then file a complaint at IC3. The FBI reports that its Recovery Asset Team, working with banks through the Financial Fraud Kill Chain, handled 3,020 complaints in 2024 and froze $469.1 million in domestic cases, a 66% success rate (FBI IC3, 2024). Freezing works only while the money is still in the receiving account, so hours matter.

How DoorKeeping reduces the openings

DoorKeeping never holds rent and sends a payment only when you approve it. Each tenant pays your own bank with a memo like 12B SMITH and an exact amount, so a missing payment shows up quickly when the bank feed is matched, which is often the first sign of a rent redirect. Anything involving money waits for your one-tap approval, and two-factor sign-in protects the account. You can email every tenant the payment notice above from DoorKeeping. It costs $2 per unit per month.

Sources

FBI Internet Crime Complaint Center, 2024 Internet Crime Report, read Oct 30, 2026
FTC, Cybersecurity for small business: business email imposters, read Oct 30, 2026

Questions

How do I verify a vendor's new bank account?: Call the vendor at a number you already had, from a contract or their website, not one in the message. Then hold the first payment for a few days or send a small test amount and confirm it by phone.
What should I do if I paid a fake invoice?: Call your bank's fraud line immediately to ask for a recall, then file at ic3.gov. Funds can sometimes be frozen if the report is fast.
How do I stop scammers from telling my tenants to pay a new account?: Tell tenants in writing that you will never change payment details by email or text alone, and give them a number to call. Use email authentication and two-factor sign-in on your own account.