Managing properties means working with a long list of people, from maintenance contractors and service providers to property owners and accounting teams. With invoices, payment requests, and financial information regularly moving between these groups, it’s easy to assume that an email from a familiar contact is legitimate.
Unfortunately, that’s exactly what cybercriminals are counting on.
Hackers are finding ways to impersonate trusted business contacts and send convincing messages designed to redirect payments or steal sensitive financial information. For property management companies handling multiple properties, vendors, and transactions, one fraudulent request can quickly turn into an expensive mistake.
When a Familiar Email Isn’t What It Seems
Imagine receiving an email from a contractor you’ve worked with for years. They’ve recently completed repairs at one of your properties and are following up on an outstanding invoice. Everything looks normal, except for one detail: the email includes updated banking information for the outstanding invoice.
Would you question it?
This is a common example of Business Email Compromise (BEC), a type of fraud in which criminals impersonate trusted individuals or businesses to trick employees into transferring money or sharing confidential information.
Sometimes, scammers create email addresses that closely resemble legitimate ones. Other times, they gain access to legitimate email accounts, allowing them to insert fraudulent payment instructions into existing conversations.
For property management businesses, these scams can take several forms:
Vendor Impersonation: A scammer poses as a landscaping company, maintenance provider, or other vendor and requests payment using fraudulent banking details.
Property Owner Impersonation: Someone pretending to be a property owner contacts your accounting team, requesting that future distributions be sent to a new account.
Compromised Email Accounts: A criminal gains access to a legitimate vendor’s email account and uses an existing conversation to send fraudulent payment instructions.
Fake Invoices: Fraudulent invoices arrive looking like legitimate business expenses, sometimes referencing real properties or services to avoid suspicion.
What makes these scams particularly concerning is how ordinary they can appear. There’s not always an obvious spelling mistake, suspicious attachment, or unusual request. Sometimes, it’s simply a familiar name asking for something that seems reasonable.
Five Warning Signs Your Team Shouldn’t Ignore
Even convincing scams can leave clues. According to the FBI, cybercriminals often rely on urgent requests, altered email addresses, and unexpected changes to payment instructions to trick businesses into sending money or sharing sensitive information. Knowing what to look for can help your team catch suspicious requests before money changes hands.
1. Unexpected Changes to Payment Information
A vendor suddenly has a new bank account or asks to switch payment methods. Even if the request comes from an existing email conversation, changes to financial information should always be verified.
2. Pressure to Act Immediately
Messages claiming that a payment is overdue, service will be interrupted, or funds must be transferred before the end of the day may be attempts to rush employees into making decisions without checking the details.
3. Slightly Different Email Addresses
A sender’s display name may look familiar while the actual email address contains an extra letter, a missing character, or an unfamiliar domain. These small differences are easy to overlook.
4. Unusual Requests for Sensitive Information
Be cautious if a contractor, vendor, or property owner unexpectedly requests banking credentials, financial documents, passwords, or other confidential information.
5. Requests That Don’t Follow Normal Procedures
If a longtime vendor suddenly requests payment through an unfamiliar platform, asks you to bypass an approval process, or requests changes outside your established procedures, take a closer look before proceeding.
How Property Management Companies Can Protect Their Payments
Preventing payment fraud doesn’t have to mean adding complicated steps to every transaction. A few consistent security practices can make a meaningful difference.
Verify payment changes directly through a separate communication channel. If a vendor or property owner requests new banking information, call them using a phone number already on file or another previously established contact method. Never use contact information provided in the suspicious message requesting the change.
Establish clear payment verification and approval procedures. Require additional verification for changes to bank accounts, new payment recipients, or unusually large transactions. Make sure your team knows who has the authority to approve them.
Strengthen email security. Use email protection tools that help identify phishing attempts, suspicious attachments, and potentially malicious messages before they reach employees.
Enable multi-factor authentication (MFA). Adding another layer of verification to business accounts can make it harder for criminals to gain access using stolen passwords.
Keep employees informed. Regular security awareness training can help staff recognize impersonation tactics and feel comfortable questioning unusual requests, even when they appear to come from a trusted contact.
One of the most important habits is to never assume a payment request is legitimate simply because the sender looks familiar. Taking a few minutes to verify a change could prevent a much larger financial problem.
What If a Fraudulent Payment Has Already Been Made?
If you discover that money has been sent to a fraudulent account, acting quickly matters.
Contact your financial institution immediately, explain what happened, and ask whether the transfer can be stopped or recalled. Notify your IT team or security provider as well, especially if you suspect an email account has been compromised.
While recovering stolen funds isn’t guaranteed, a quick response may improve the chances of limiting the damage.
Protect More Than Just Your Property Management Software
Your property management software is just one part of your company’s technology environment. Email accounts, employee devices, and business networks are all potential entry points for cybercriminals. Protecting your business means taking a broader approach to cybersecurity, one that addresses the technology and people involved in your everyday operations.
With advanced cybersecurity solutions that include email protection, multi-factor authentication, endpoint security, and security awareness training, LCS IT Services helps businesses strengthen their defenses against threats targeting everyday operations.
No security solution can replace careful payment verification, but combining strong technology with informed employees can help reduce the risk of costly mistakes.
Protecting your business means protecting the transactions, information, and relationships that keep it running. By combining strong security practices with the right technology, you can better protect yourself against payment fraud.
