Why ID Verification Alone Won't Stop the Latest Rental Scam

Rental scams are not new. But the latest version is different and it's targeting property managers who have already invested in fraud prevention.

We've corroborated multiple reports of a scam that bypasses ID verification, blocklists, and most fraud tools entirely. The scammer never registers as a lead. Your fraud detection never flags them. And when it's over, you're left with an angry prospect who thinks your company has their money, a potential squatter situation, and no trace of who did it.

Here's how it works, why your current setup may not catch it, and what to do about it.

How the old rental scam worked

The original self-guided showing scam followed a predictable pattern. A scammer would scrape your listing, repost it on Facebook Marketplace or Craigslist at a below-market price, complete the prescreening themselves to get the lockbox code, then pose as the property manager and collect deposits from victims.

It worked because most property managers weren't running any verification at all. But as tools like Fraud Guard introduced ID verification, VoIP detection, selfie matching, and geolocation checks, it became much harder for scammers to pass prescreening consistently.

So they stopped trying.

The new self-guided showing scam

Instead of attempting to pass your fraud checks themselves, scammers now send the victims your own scheduling link. The victim, a real person with a real ID, a real phone number, and legitimate information, completes your prescreening, passes every verification check, receives the access code, and enters the property. The scammer never enters your system at all.

The property manager ends up with a prospect who genuinely believes they've been defrauded by your company, a showing record that looks completely normal, and no lead data connected to the actual scammer.

In some cases, scammers aren't collecting deposits at all. They advertise "appliances for sale," send victims through your showing flow, and have them remove refrigerators or washing machines themselves.

Why ID verification alone can't stop this

This is the key shift: the victim is not the scammer. Your ID checks, selfie matching, and phone verification are working exactly as intended.

The scammer's approach typically involves telling prospects to communicate only with them and claiming to be the actual property owner who recently terminated the property management company.

This is why application fraud and showing fraud require different layers of defense. One verifies who is applying. The other needs to catch the conditions that create the scam in the first place.

What a scammer’s Facebook profile looks like

Fraudulent profiles tend to share a consistent set of red flags:

• Profile created in the current year or the year prior

• Profile photo with signs of AI generation (blurred backgrounds, inconsistent lighting, unnatural symmetry)

• Properties priced significantly below market rate

• Listings in states the profile has no apparent connection to

These profiles disappear quickly, so they're designed to move fast and collect money before anyone checks.

How to protect yourself against the new rental showing scam

Source verification at the point of access. Add a question to your prescreening asking where the prospect found the listing, and deny showing access to anyone who indicates Facebook Marketplace or Craigslist until you've had a chance to speak with them directly.

RentEngine takes this a step further: prospects must confirm their lead source before receiving an access code. Anyone who indicates Facebook Marketplace or Craigslist is prompted to call your team directly, and you're alerted before they ever enter the property.

Two-part ID verification. Basic document checks aren't sufficient on their own. Selfie matching confirms the ID belongs to the person scheduling, and carrier-verified phone number checks confirm they're not using a VoIP line — both of which are included in Fraud Guard.

Blocklisting based on photo ID. Blocking by name or phone number alone is easy to circumvent. Blocklists that include photo ID match make it significantly harder for known bad actors to return under different contact details.

Photo watermarking. Watermarking listing photos with your company name and contact details in the center of the image — not the corners, where they can be cropped — reduces the value of your photos for fake reposts. RentEngine includes custom watermarking directly in the platform.

Duplicate listing monitoring. Even with watermarking in place, it's worth monitoring the internet for unauthorized reposts of your listings. RentEngine users can integrate with Property Shield, which removed over 318,000 fraudulent listings in 2024 alone.

The bigger picture

The FTC reported more than $65 million in rental scam losses between January 2020 and June 2025, with roughly half of all reports originating on Facebook.

These numbers reflect the old scam model. The new version (where the victim unknowingly becomes part of the process) has far fewer reporting mechanisms because the property manager's system looks clean throughout.

Fraud evolves to circumvent whatever defenses are most common. ID verification got stronger, so scammers stopped trying to pass it. The defense that matches this new approach is earlier intervention: warning prospects before they become victims, monitoring for duplicate listings before they gain traction, and requiring source confirmation before granting property access.

If you're reviewing your showing types and security setup, this is a good time to assess each step of your flow against the scenarios described above.