Property scams take two forms: a deposit paid for a rental the "landlord" does not control, and the interception of a completion or deposit payment in a genuine purchase by someone reading the conveyancer's email. US losses rose 58% in 2025 to $275 million. Bank details must be confirmed by voice on a number you already held.
Two quite different crimes share this category, and they have almost nothing in common except the asset.
Rental fraud is high volume and moderate value. Someone copies a genuine listing, reposts it at a slightly better price, and explains in advance why the property cannot be viewed — they are working abroad, doing missionary work, on a military posting. A deposit and a month’s rent go by transfer, and the keys never arrive. Losses are typically a few thousand dollars, and the victims are disproportionately people moving to a new city who cannot view first.
Completion fraud is low volume and catastrophic. Somebody is inside a mailbox — usually the conveyancer’s or the estate agent’s, sometimes the buyer’s — reading a real property transaction. At the right moment they send revised payment instructions, and an entire deposit goes to the wrong account. This is business email compromise aimed at the largest payment most people ever make, and in the UK it has a nickname: Friday afternoon fraud, because completions cluster when everyone is rushed and the banks are closing.
US reported losses rose 58% in 2025, from $173.6 million to $275.1 million, on complaints up 32%.
Photographs and description lifted from a genuine listing and reposted, usually a little under market. The property exists; the person advertising it has nothing to do with it.
Working abroad. A missionary posting. Keys with a relative. A managed handover. The excuse is prepared before you ask, which is what distinguishes it from an awkward but genuine seller.
Credential phishing against a conveyancer, an agent, or the buyer. The attacker does nothing at all for weeks, learning the transaction, the tone and the completion date.
A deposit request for the rental, or revised completion instructions inside the genuine email thread — sometimes from a lookalike domain, sometimes from the real account.
Where it could have stopped
Bank details for a property payment are confirmed by voice, on a number you already held for that firm, before any money moves. Never a number in the email, and never by replying to the thread — the attacker may be reading it. Many conveyancers now supply account details once at the outset and state in writing that they will never change them, precisely so that any change is self-evidently fraudulent.
Completion is today. Another applicant has offered. The chain will collapse. Property supplies more genuine deadline pressure than almost any other transaction, and the attacker only has to arrive at the right moment.
Correctly authorised, by someone doing their job properly, through the normal process. Nothing anomalous happens from the bank’s point of view.
The keys do not exist, or the conveyancer asks why the funds never arrived. In the completion variant this is often hours later, and hours are usually too late.
Property transactions are unfamiliar. Most people buy a home a handful of times in their life and have no baseline for what is normal. A change in payment instructions is not obviously strange when you have never seen the process before.
The amounts are large but not surprising. A six-figure transfer is alarming in most contexts and completely expected in this one, so nothing about the size triggers a second look.
Deadlines are real. Completion dates, chains and tenancy start dates all supply genuine urgency without the attacker inventing anything.
In the rental version, viewing is often impossible. Someone relocating cannot inspect a flat two thousand miles away, and the scheme is aimed at exactly that constraint.
The professionals are the weak point, not the buyer. Small conveyancing firms and estate agents hold enormous transactional value and often have modest email security. The buyer can be careful and still lose everything through someone else’s mailbox.
And it happens once. There is no pattern for a buyer to recognise, no earlier smaller version to learn from. The first time this happens to someone is usually the only time.
The completion-fraud variant follows the business email compromise enforcement record closely, with West African networks prominent in the documented cases and credential-access markets supplying the mailbox compromise. The money lands in domestic mule accounts and moves within hours.
Rental fraud is more diffuse and largely opportunistic — a copied listing, a burner account, a mule account to receive the deposit. It is heavily domestic by necessity, because the story requires a local property and a local bank account.
The structural point is that in both variants the victim’s own care is not the deciding factor. In the rental version they cannot inspect what they are paying for; in the completion version the compromise is at a professional firm they have no visibility into. That is why the recommendations here are about process — a confirmed number, an agreed rule, a payment made in a specific way — rather than about vigilance.
US real estate fraud complaints rose from 9,359 in 2024 to 12,368 in 2025, and losses rose from $173.6 million to $275.1 million — a 58% increase in a single year, after being roughly flat the year before. Property fraud spans two very different crimes: rental listings for homes that are not available, and wire fraud aimed at the deposit or completion payment in a real purchase.
Purchase scams are the highest-volume fraud in every national dataset that separates them, and they attract the least attention. UK Finance recorded purchase scams as 71% of all authorised push payment cases in 2025, with losses of £118.1 million. The FBI logged 56,478 non-payment and non-delivery complaints and $503.4 million. In Australia, more people reported losing money to shopping scams than to any other type.
In September 2024 the FBI's Internet Crime Complaint Center published a decade of business email compromise figures: $55.5 billion in global exposed losses across complaints filed between October 2013 and December 2023, including 158,436 US victims and $20.1 billion in US exposed losses. The same advisory records a 9% increase in identified global exposed losses in a single year, and a shift in where the stolen money is sent.
If a completion payment has just gone to the wrong account, the next hour decides the outcome.
If you have paid a rental deposit and there is no property. Call your bank today and ask about a recall and about reimbursement. Report it to the listing platform, which can remove the advert, and to your national agency. Screenshot the listing, the messages and the account details first.
Preventing it.
For a purchase: agree at the outset that bank details will be given once and never changed, get that in writing, and confirm them by voice on a number from the firm’s own website. Send a small test payment first and confirm receipt by phone before the main transfer. Never accept a change of details by email, ever, for any reason.
For a rental: view it, or have someone view it for you. Search the address independently. Never pay a deposit for a property nobody will show you, and prefer a payment method with some protection over a bank transfer.
A redirected completion payment lands in a receiving account prepared for it — a mule account, or occasionally a real business account whose owner has been recruited. It rarely stays more than a few hours. IC3 records BEC funds increasingly going straight to institutions holding custodial accounts for payment processors and to cryptocurrency exchanges, which is exactly where the recall process stops reaching.
Rental deposits follow the same route on a smaller scale: a domestic mule account, emptied fast, usually into cash or crypto.
The speed is why every recommendation on this page collapses into one instruction. Call the bank first, before the conveyancer, before the police, before working out what happened. The window is measured in hours and it closes.
The other half of this story
Our sibling site Clean on Paper explains where completion funds go — and why converting a redirected payment into goods for export is so much harder to unwind than moving it between accounts.
No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.
Confirm bank details by voice, on a number you already held for that firm, before any money moves — never a number from an email, and never by replying to the thread, because the attacker may be reading it. Many conveyancers now give account details once at the start and state in writing that they will never change them.
Sometimes, and only within hours. Call your bank immediately and ask for a recall, then call the conveyancer on a known number. Speed determines everything: once funds move on from the receiving account there is usually nothing to recall.
Reverse image search the photographs — copied listings are the norm. Look up the address independently and see whether it is advertised elsewhere at a different price or by a different agent. Insist on viewing, in person or on a live video call where you direct what is shown. Never pay a deposit for a property nobody will show you.
That is the standard script for rental fraud, and it exists to explain why you cannot view the property or meet anyone. Missionary work, an oil rig, a military posting and a job transfer are the recurring versions.
It depends on the jurisdiction and the facts, and it is genuinely contested. Get independent legal advice quickly, notify the firm and its insurers in writing, and report to the police and your national agency the same day. Do not accept an early assertion that the loss is yours as settled.
Because completions cluster on Friday afternoons, when everyone is under time pressure and the banks are about to close. Attackers reading a mailbox know the completion date, and they choose the moment when checking is least likely.
Report it
Reporting is what produces the enforcement data on this page. Find the right agency and phone number for your country on the report page. If money moved in the last few hours, call your bank first.