Section 1. Introduction

The technology today enables us to perform a big part of our activities online. Finding a romantic partner, working, doing weekly grocery shopping, learning a new language, or investing—everything can be done through the Internet. The search for a new home can also be conducted online on a number of websites that help to rent and sell real estate.

However, professional real estate managers and security authorities continuously report about online rental scams in which criminals target potential victims by offering fictitious property for rent and later requesting deposit money through a wire transfer service. Eventually, the victim remains without a property and experiences a financial loss. Such scams affect holiday as well as long-term rental markets. In 2014, the FBI received about 10,000 complains from real estate scam victims, and losses of more than $19 million were reported.

See Infosec IQ in action

From gamified security awareness to award-winning training, phishing simulations, culture assessments and more, we want to show you what makes Infosec IQ an industry leader.

Demo Now

Criminals use two main tactics for rental scam, namely, posting advertisements online and phishing. This article will discuss the two tactics. Firstly, rental frauds using online advertisements will be examined (Section 2). Next, rental frauds using phishing will be analyzed (Section 3). Finally, a conclusion is drawn (Section 4).

Section 2. Rental Frauds Using Online Advertisements

Nowadays, a person who is looking to rent a new property first visits a number of websites offering rentals. Such websites allow the people to view and compare the properties for rent. However, a person who believes that he/she has found a perfect place to live for more than a reasonable price may become a victim of real estate fraud. Online rental scammers usually target either young inexperienced students who are looking for university accommodation or mature people who lack knowledge in the field of information security. The FBI report indicates that, in the U.S. in 2014, the biggest financial losses related to rental frauds were experienced by 50-59-year-old people. A big part of the online rental scams use a scheme that will be discussed further.

In order to commit online rental fraud, cybercriminals steal advertisements from legitimate real estate websites. The scammers modify the images and descriptions of the properties as well as the contact information of the owners. Then, the scammers post new advertisements featuring the property on another website with their own contact details, usually, only email address. Occasionally, fraudsters obtain personal information about the actual owner of the property and create an email address resembling the name of the owner. This strategy strengthens the illusion that the fraudulent advertisement is true.

[download]Download the BEST PRACTICES FOR DEVELOPING AN ENGAGING SECURITY AWARENESS PROGRAM whitepaper[/download]

Alternatively, for establishing a contact with a potential victim, scammers hijack the email accounts of real estate agencies or owners of the property. There are also cases in which scammers post advertisements that feature phantom properties, that is, houses and apartments that do not exist. However, such advertisements are not effective, because the potential tenants often check the property on Google Maps Street View.

In order to seduce the potential victims, the crooks choose well-maintained properties. Moreover, they put the price significantly lower than the market price for such a property. For instance, in a fraudulent advertisement, the rent for a 3-bedroom house in a good neighborhood could amount to $700, whereas its rental value is $1,200. This strategy is chosen in order to differentiate the advertisement from a number of other offers and to attract a large number of potential victims.

After the potential victim contacts the supposed owner and expresses his/her interest in the property, a positive reply from a fraudster is received and the crime evolves. The initial letter normally contains several important elements that can be used for the identification of an online rental fraud. One such element is the sense of urgency created by the "owner" of the property. For example, the scammer claims that there many other people interested in the property. Nevertheless, the place can be reserved because the "owner" feels sympathy towards the potential victim. Another element is the statement that the supposed owner is not in the country or had to leave the country unexpectedly due to volunteering, work, or family issues. Mostly, the fraudsters claim to reside in one of the countries in Africa. Such sudden missions become a good justification for an urge to rent a house or an apartment. Other elements include grammatical mistakes, a description of the owner's life and the family, excessive capitalization, and neutral forms of address, such as Sir/Madam.

In the initial letter or during the further communication, the "landlord" provides information that, in order to secure the property, the potential tenant has to wire a deposit. However, the payment should be done not with a credit card or through a bank transfer, but using a money wire service. The scammers use this payment option because it allows the crime to remain untracked. Moreover, as soon as the money is taken by the receiving party, it is impossible to get them back. In case a payment is made with a credit card, a dispute can be opened and the money might be returned to the sender. Thus, the fact that a person renting a property asks for a security deposit or a first month's rent before meeting in person or signing a lease might be a warning signal of an online rental scam.

Since the scammer claims to be abroad, the victim is told that, after wiring the money, the keys of a property will be sent through a courier or a trustworthy person, such as a relative or an agent. If the address of the property is revealed, the victim is allowed to inspect the apartment or a house without entering inside it.

Occasionally, the targeted tenant is requested to add information to the fraudulent agreement, thus revealing other personal information, such as social security number, credit card or bank account information, and driving license. Later, this information can be used for identity theft.

The climax of the fraud is reached when the person who has wired the deposit arrives to pick up the keys and to finally check the potential home. The scam might have three possible ending scenarios. In the first scenario, it may appear that the property simply does not exist. Such incident is possible only if the exact address of the property was not revealed earlier or the Google Maps Street View was not explored in advance. In the second scenario, the victim reveals that the property has been rented to multiple tenants at the same time. Such victims can identify the fraud after arriving to move in and meeting other scammed victims at the property. In a third scenario, the property can appear to be already occupied by people (tenants or owners) who have no intention to move out.

Probably the most confusing climax of the scam is reached when a prospective tenant learns that the property featured in the advertisement is inhabited by a person who does not have a clue about the scam that has been taking place. There are two victims in such a scenario, namely, the person who wired the deposit and the person whose property was featured in the fraudulent advertisement. Some scammed landlords report that they are regularly approached by people who signed rental agreements for the property. For example, ABC News reported that S.D., an owner of a Bali-inspired property, was visited by a number of groups and families believing that they rented the house for their vacation. However, the scammed owner had to convince the visitors that they were victims of a sophisticated online rental scam.

In all of the aforementioned scenarios, the fraudulent "landlord" disappears without a trace, leaving the victim without accommodation and with financial losses. Tracking such cybercrimes and sentencing the offenders is difficult due to the international nature of the online rental scams.

Section 3. Phishing Schemes in Online Rental Scams

In order to commit online rental frauds, scammers may send fraudulent rental offers to potential victims. Since fraudsters often use email spoofing, the letters received by potential victims may look like original messages from well-known real estate agencies. The targeted person is asked to submit or confirm personal details, such as email and password, credit card information, or a telephone number. The process of luring the potential victim to provide such data is called phishing. Phishing may include a variety of methods to gain personal details, email credentials, or credit card information. In some cases, the recipient is warned that the offer is valid only if the information is submitted immediately. Moreover, if the email appears to be a message from a well-known real estate website, the targeted victim is occasionally threatened to lose the online account on that website if the data is not submitted instantly. The personal data may also be obtained through requesting the targeted person (1) to click on a link that redirects the victim in a fraudulent third-party website, (2) to download and send back an attachment, (3) to install a software, or (4) to receive a message on a cellphone. The email credentials obtained by scammers through phishing may be used not only for rental scams, but for other fraudulent purposes, e.g., sending spam, unauthorized access to user accounts, and identity theft.

Sometimes, the potential buyer is asked to wire a deposit to the owner. After the money is sent, the "property owner" disappears, leaving the victim scammed. For example, a retired couple from California received an online offer to rent an apartment in New York with attractive extras and a discount of 20%. Seduced by the attractive offer, the couple transferred deposit money to England and even received a fake rental agreement with a letter thanking for the booking. Later, the couple understood that they were scammed.

The major worldwide real estate websites, such as Craigslist and RE/MAX, are often used by cybercriminals for committing rental fraud. In order to avoid further phishing scams, real estate companies take security measures and warn their customers about potential threats. Lisa Campbell, the national marketing and communications manager at RE/MAX, says: "We have kept at the forefront with email notifications, pop-ups on our website, along with social networking the scams through our public pages to ensure the general public and our network are all aware to be careful and that we will never ask for money nor your log-in details ever."

Section 4. Conclusion

Cybercriminals are taking advantage of the increasing number of online activities. In addition to a variety of online security issues, such as romance scam and auto fraud, the online rental scam is taking the leading position in the domain of cyberfraud.

This article has discussed two schemes of online rental scams, namely, schemes using fraudulent online advertisements and schemes using phishing. Both schemes can be difficult to detect by people who are not aware of the characteristics of online rental fraud. The damage caused by such schemes can be not only financial, but also emotional.

Since the victims of online real estate scam are usually people who lack knowledge about information security, the best mean of prevention from such a scam is acquiring information security awareness. Such security awareness can be acquired by self-training or attending specialized security courses. Pertaining to self-training, it is worth mentioning that the websites of governmental authorities (e.g., FBI.gov) provide extensive information to anyone interested in online rental fraud.

See Infosec IQ in action

From gamified security awareness to award-winning training, phishing simulations, culture assessments and more, we want to show you what makes Infosec IQ an industry leader.

Demo Now

References

1. https://www.fbi.gov/news/news_blog/2014-ic3-annual-report
2. https://www.youtube.com/watch?v=Bp_jN9xSiNU
3. http://www.propertyobserver.com.au/forward-planning/investment-strategy/property-news-and-insights/18434-wednesday-remax-global-online-phishing-and-rental-scams-spread-to-australia-with-pop-up-home-page-warning-for-consumers-to-be-vigilant.html
4. https://www.craigslist.org/about/scams
5. http://www.news.com.au/finance/real-estate/phishing-scammers-raid-real-estate-site/story-e6frfmd0-1226170297339
6. https://www.scamwatch.gov.au/types-of-scams/attempts-to-gain-your-personal-information/phishing
7. http://abcnews.go.com/Travel/summer-vacation-nightmare-couple-scammed-fake-rental-listing/story?id=24096402
8. http://www.remax.com/c/general/caution

Co-Author

Rasa Juzenaite works as a project manager in an IT legal consultancy firm in Belgium. She has a Master degree in cultural studies with a focus on digital humanities, social media, and digitization. She is interested in the cultural aspects of the current digital environment.