Invoice scams are becoming increasingly prevalent in the property industry, exploiting predictable payment schedules attached to high-value transactions like rent. As a property company or a commercial tenant, it is essential to be vigilant about the security of your transactions to prevent falling victim to such fraudulent activities. This article will outline the nature of these scams, provide tips on how to recognize them, and offer guidance on how to safeguard your business and tenants.
Understanding Invoice Scams
Invoice scams typically involve fraudulent attempts to divert payments from legitimate businesses to accounts controlled by scammers. Scammers impersonate property companies or managers by compromising email accounts through phishing attacks. The primary methods we see are:
- Scammers access a property manager's email and monitor for upcoming payments. They then request payment to a different account.
- Scammers access a tenant's email, intercept an invoice, change the bank details, and resend it asking for payment to their account.
Identifying Suspicious Email Activity
To detect potential email account compromises, check for unusual activities such as:
- Unexpected auto-forwarding rules on accounts receivable-related email accounts.
- Unfamiliar auto-filtering rules that you did not set up.
- Odd login hours or unfamiliar IP addresses in your email access logs.
Prevention Strategies
To prevent email compromise and protect your business from scams, consider the following measures:
- Two-factor authentication: Add an extra layer of security to your email login process.
- Password integrity: Use strong, unique passwords and a password manager.
- Security training: Equip staff with security awareness to defend against phishing and other attacks.
Enhance your invoice payment process by:
- Always verifying new bank account details by contacting the business directly.
- Checking the business’s official phone number from their website and not relying solely on the invoice.
- Implementing dual review and confirmation for payments above a certain threshold.
- For additional security, Re-Leased customers can utilize Re-Leased Pay to ensure payments are sent directly to the correct bank account.
Reacting to a Potential Scam
If you suspect you or your tenant has made or is expecting a payment that could be a scam:
If you've made the payment:
- Contact the apparent receiver to verify if the payment was received and to confirm account details.
- If account details are incorrect, immediately notify your bank to attempt to halt the transaction.
- Report the incident to your IT department or an IT security specialist to assess for breaches.
If you're expecting the payment:
- Confirm with the paying tenant the details of the bank account they used.
- Suggest they contact their bank to stop the payment if it was sent to the wrong account.
- Recommend that they report the incident for a potential investigation into email breaches.