Skip to main content
Start free
Start free

How do you stop scammers from redirecting your tenants' rent payments?

DoorKeeping team

4 min read

Tell every tenant in writing that your payment details never change by email or text, and that any change will be confirmed by a phone call from a number they already have. Turn on two-factor sign-in for your email, and watch for any unit whose rent does not arrive on time. If a tenant does pay a scammer, the tenant's bank needs to hear about it the same day.

How the scam works

A scammer gets into, or imitates, the owner's or manager's email. Shortly before rent is due, tenants receive a message that looks normal: the bank account has changed, please send this month's rent to the new details. Some versions arrive by text, or attach an official-looking letter. The money goes to an account the scammer controls, and the owner finds out only when rent is missing.

The FBI calls the business version of this business email compromise: fraudsters compromise email and other communication to get people to send money to the wrong place. Its Internet Crime Complaint Center reported $2,770,151,146 in business email compromise losses for 2024, and its report describes a home buyer who received a spoofed email from a supposed real estate agent asking for a $956,342 wire (IC3 2024 report).

The notice to send before it happens

The best time to warn tenants is at move-in and again once a year. Keep it short so it is read. An outline:

  1. Subject: How to pay rent, and how we will never ask you to change it.
  2. The only way to pay: the bank and account you use today, and the memo you type (for example, 12B SMITH).
  3. The promise: we will never change payment details by email, text or letter alone.
  4. The check: if you get any message about new payment details, call us at the number in your lease before paying. Do not use a phone number from the message.
  5. Who to tell: forward any message like that to us so we can warn the building.

Put the same lines in the lease or a lease addendum so new tenants see them before their first payment.

Close the gaps on your side

  • Turn on multi-factor sign-in for the email account tenants write to. The FTC notes it makes it harder for scammers to log in even if they get your password (FTC on phishing).
  • Do not click links in messages about your own bank or software accounts. Go to the site or call a number you already know.
  • Keep one payment method for rent. A building that takes five methods gives a scammer five stories to tell.
  • Use a memo code and an exact-cent amount per tenant, so a missing payment stands out on the 2nd, not the 20th.
  • Look at the bank feed on the first business day after rent is due and call any tenant whose payment is missing.

If a tenant already paid a scammer: the same-day steps

  1. The tenant calls their own bank right away and asks it to stop or recall the payment and to report the receiving account as fraud.
  2. The tenant files a complaint at ic3.gov. The FBI's Recovery Asset Team works with banks to try to freeze fraudulent transfers, and most of the cases it starts are business email compromise. The sooner the bank hears, the more there may be to freeze.
  3. The tenant reports it to the FTC at ReportFraud.ftc.gov and forwards the email to reportphishing@apwg.org, or the text to 7726.
  4. You warn every other tenant in the building the same day, by a channel the scammer does not control.
  5. You change your email password, check its forwarding rules, and confirm two-factor sign-in is on.

Example a made-up 30 unit building's bank feed shows 29 rent deposits on the 2nd. The tenant in 7C, who pays $1,640.23 every month, is missing. The owner calls on the 2nd and learns 7C sent $1,640.23 to a 'new account' from an email the day before. 7C calls the bank and files at ic3.gov that afternoon, and the owner emails the other 29 tenants that payment details have not changed. Found on the 2nd, the bank has a day-old transfer to chase; found on the 15th, it would have had two weeks.

Whether the tenant's rent counts as paid when they paid a scammer is a legal question that depends on the facts and your state's law. Talk to your attorney before you charge a late fee or serve a notice in that situation.

How DoorKeeping lowers the risk

DoorKeeping never holds rent and sends a payment only when you approve it: tenants pay your own bank by bank transfer or Zelle, so there is no third-party payment page to imitate. Each tenant gets a memo like 12B SMITH and an amount with its own cents, and the bank feed shows on the first day which unit has not paid. You can email every tenant in a building from DoorKeeping, and two-factor sign-in protects your account. The price is $2 per unit per month, with no fees for tenants or owners.

Sources

  1. FBI Internet Crime Complaint Center, 2024 Internet Crime Report, read Oct 30, 2026
  2. FTC, How to recognize and avoid phishing scams, read Oct 30, 2026

Questions

A tenant got an email saying my bank account changed. What do I do?
Tell the tenant not to pay it, confirm your real details by phone, and warn every other tenant the same day. Then check your own email account for a break-in and turn on two-factor sign-in.
Where do you report a rent payment scam?
The tenant reports it to their bank first, then at ic3.gov and ReportFraud.ftc.gov. Phishing emails can be forwarded to reportphishing@apwg.org and texts to 7726.
Does the tenant still owe rent if they paid a scammer?
That depends on the facts and your state's law. Talk to your attorney before you treat it as unpaid rent or charge a late fee.

Keep reading