How should a landlord verify who is asking before sharing tenant information?
Share account information only after you confirm the person through something you already hold: the phone number or email on the lease, a call back to that number, or a sign-in to the tenant portal. Callers who claim to be a tenant, a spouse, an employer, a lender or the police should be asked to put the request in writing. A short, calm script protects your tenants and you, because information given to the wrong person is exposure that you caused.
The risk is not a hacker, it is a friendly voice
Attackers who want a tenant's information often skip the technical part. They call the landlord and sound confident. They say they are the tenant's spouse who lost the lease, an employer checking income, a locksmith, or a relative who needs a unit number. Each story asks for one small piece: a balance, a move-out date, a lease copy or a door code. Put together, the pieces help a stalker, a thief or a scammer.
The FTC's guide for businesses says to keep personal information only where it is needed and to control access to it. Treating a phone call like a login is the human version of that rule.
What counts as proof
- Calling or texting back the number already on the lease, not the number that called you.
- A request from the email address on file, with a reply sent to that same address.
- A signed-in request through a tenant portal or app.
- For a third party such as an employer or lender, a written request on letterhead plus a call to a number you look up yourself, and tenant consent where required.
What does not count: a name, an apartment number, a story, a voice that sounds right or a person standing at the door who says they live there.
A script you can use word for word
"I can help with that. For privacy, I confirm requests through the contact details on the lease. I will call the number we have on file, or you can send it from the tenant portal. Is that okay?" Then do it. Most real tenants appreciate it. A caller with a bad purpose usually hangs up.
Use the same pattern for door codes. Never read a door or gate code over the phone to someone you have not confirmed. If a tenant is locked out, a call back to the number on the lease takes a minute and costs far less than an unauthorized entry.
Special cases
| Who asks | Safer handling |
|---|---|
| Spouse or roommate | Share only what the lease lets them see, and confirm they are on it. |
| Police | Ask for a name, badge number and agency, call the agency using a number you look up, and ask for a written request or legal process. |
| Lender or employer | Get tenant consent and a written request, and reply to a verified contact. |
| Someone who says they are a tenant who lost a key | Confirm through the number on file before any entry or code. |
| A tenant in danger | Call emergency services first. Then follow your state rules for the next steps. |
Write it down and train your helpers
Log each request that asked for tenant information: who asked, how you confirmed them and what you shared. A communications log also helps if a tenant later disputes what was said. Give every helper the same short script, and tell them that it is fine to say "I will call you back."
DoorKeeping's agent answers tenant messages around the clock, and anything involving money or legal steps waits for your approval. Copy that rule in your own process: a request for details or money gets a check first.
Sources
- FTC, Protecting Personal Information: A Guide for Business, read Oct 30, 2026
- FTC, Cybersecurity for Small Business, read Oct 30, 2026
- FBI, Scams and Safety, read Oct 30, 2026
Questions
- Can I tell a spouse the rent balance?
- Only if the spouse is on the lease or the tenant has agreed. Confirm through the contact details you hold first.
- Should I read a door code over the phone?
- Not before you confirm the person by calling back the number on the lease.
- What if a caller gets angry about the check?
- Stay polite and repeat the offer to call back or use the portal. Pressure is a warning sign.