Anatomy of a Rental Scam — One of our longtime readers is a very savvy 63-year old retired real estate Title Examiner and researcher named Claire Wunderlin. Over the Thanksgiving holiday, Claire had a nasty fraud target her stepson, Demitri, in the form of a real estate opportunity. This scam was exactly the type of fraud that Claire could easily apply her formidable talent and research skills to uncover. Not only did she expose the scam, but she saved the day, and helped get the scammer’s web page taken down! And then she pitched it to us in an article she wrote! We were so impressed by her handling and reporting this scam that we invited her to be our first ever, guest author of the Top Story! We hope you’ll continue reading and see how this impressive researcher took down a con artist! (Claire and those targeted by this scam have given us permission to use their names.)

My name is Claire and I am a retired real estate title examiner and researcher for a land surveying company in the central Texas area. I suppose my background makes me well qualified to know where and how to chase down the red flags that were present in this story’s set up. More significantly is the fact that I have become attuned to spotting scams in a wide variety of areas. My greatest defense against fraud is research first, and react later to something I am considering becoming involved in. I believe that the two most important things a person can lose to a scammer is their money and/or their identity. I strive to lose neither.

Over the Thanksgiving holiday, I had a nasty fraud presented to me through my stepson, Demetri and his girlfriend, Sam. This phishing expedition relies on the emotional triggers that go with anyone’s need or desire to rent at a new location. Demetri and Sam came over for Thanksgiving festivities and got to talking about the rentals they were looking at. The lease on their apartment comes up for renewal mid-January, 2023 and they want to move into a house.  They took an interest in a particular location in a hill country neighborhood west of Austin, Texas. I just happened to be in earshot of that discussion away from the crowd and asked them to send me the address so I could do a little investigation.

I started with the simplest Google search which is the property address. The house is located at 108 S Meadowlark, Lakeway, TX 78734. That address came up multiple times in MLS (Multiple Listing Services) listing sites as “for sale” for $550,000, not for rent. Here is an example from Realtor.com: https://www.realtor.com/realestateandhomes-detail/108-S-Meadowlark-St_Lakeway_TX_78734_M75548-18504.

I asked Demetri for the listing he found, where the property is allegedly for rent. He showed me this link (no longer posted): https://www.apartments.com/108-s-meadowlark-st-lakeway-tx/jynfpw4/. It was listed for $1,700, which is WELL below market value for that area. I captured a screenshot of the rental listing…

He then showed me the text messages that had gone on between him and the so-called listing agent. Right away, I noticed that the number used for the texting was different from the number featured on the Apartments.com listing. The “agent” used poor English in his texts. There was no name given on the website for the agent and none was provided in the texts. After asking how many occupants would be moving in, the next question asked of Demetri was if he ‘had any application’ yet.

I pulled up the property information on the Travis County Appraisal District site and found the owner to be Redfin: https://stage.travis.prodigycad.com/property-detail/139727/2022.

Looking back at the Realtor.com site, I made the connection to the Real Estate Agent who is the actual listing agent with Redfin for that property. I found her number online and left her a voice message. (She has asked to remain anonymous in this report.)

When she called me back, I had a very sobering conversation with her; one in which she became more and more animated and frustrated over the subject until she just couldn’t talk to me anymore about it. First, she told me that these fake rentals are a systemic problem in her industry and that she hoped we hadn’t sent any money to the scammer or provided any personal information. I assured her we hadn’t and that I was glad to be able to tell her about the listing.

I asked her if she could have the advertisement taken down. She said no, these sites such as Apartments.com and Rent.com are just like Craigslist. Anyone can list anything they want and there’s no “website police” monitoring what’s featured. I suggested that she could – as a licensed realtor – look to see who was scheduled to show the listing at the appointed time Demetri and Sam had made to see the property. She shocked me by explaining that (because of the pandemic) Redfin had created a one-time passcode system for its potential buyers to access a property using the keypad locks they install on their properties. She then identified the very problem I envisioned where a scammer can obtain a code, show a house as their own, collect a down payment using a shill as pressure to get the victim to act immediately, or collect an application for rent, and thereby stealing the victim’s identity(s) etc.

The Agent explained that Redfin recently halted use of this method but speculated that if the scammers only just found this out, they would make an excuse for why they couldn’t show up and leave the victim to spend time falling in love with the property. Easier to get someone to comply once they’ve had physical contact with the listing. I asked her about getting the police involved. She got mad and said, “No crime’s been committed!” (yet). She asked for the number Demetri had been using for the text and as I started to recite it, she finished the digits!

She told me she’d talked to the scammer without identifying herself and then abruptly declared to me that there was nothing she could do to stop him. The Agent (and any realtor in her shoes) is as much a victim of this practice as the potential renters who have called her after being sucked into the scam, blaming her for their losses. They do their due diligence AFTER being defrauded. Other things she said these scammers do is use burner phones and bounce around from one website to another using the information (including pictures) they get from the listing agent. It is insanely easy to copy the contents of one website and post them on another.

I was sad, but relieved to inform Demetri that their dream home was made of cards. Here is the conversation that Demetri (in amber shade on the right side of the screenshots) had by text with a guy that the Real Estate Agent described as sounding eastern European: (Notice the scammer’s first text message where he claims to represent “Apartments.con” This must have been a “Freudian slip!”)

Demetri sent the final text after we learned of the scam. I urged him and Sam to use a licensed realtor to show them honest listings from this point forward. When renting through an agent (in Texas at least) the commission comes out of the landlord’s pocket.

FOOTNOTE: There is ​​a bit of a happy ending to this story. The Real Estate Agent overcame her frustration with the frequent scams she deals with, took Claire’s advice, and finally did contact Apartments.com. They acted immediately to remove the listing and now it seems that this Realtor feels empowered to take action against these jerks when she stumbles across them.

One of a Kind Scams! – What is an NFT? What’s the status of NFTs in 2022? What are the top 3 NFT scams to watch out for? Check for the answers to all these questions and protect yourself with this FREE, all-in-one tool:

More Scammer Tricks Targeting Merch Sellers – Scamadviser.com recently published all of the presentations from our Global Anti Scam Summit on the ScamAdviser’s website. There is a lot of valuable information in these presentations! We hope you’ll check them out. 

Two weeks ago our Top Story concerned ways in which scammers target people who post merchandise for sale online. Since then, many Reddit users have posted additional insights or suspicious queries about the items for sale. Check out this query posted by Reddit user Sea-Climate6841 on December 1, asking if this query is likely a scam.  Our answer, along with many others, is 100% YES – a scam! As you read the scammer’s “interest” in buying the item posted, look for these suspicious red flags…

• The person refers to the merchandise in a generic way, not even mentioning the specific item. This scammer likely uses the query to copy/paste to many sellers.
• The person pushes the seller to get off the app, which may circumvent some protections used by the platform. They are already communicating just fine, so why change to Whatsapp? This request makes NO SENSE except to make it easier to advance a scam.
• Anytime a buyer tells you they will pay MORE THAN ASKING, it is 99.99% likely it is a scam! Period.

Here is another text exchange posted on November 28, between a scammer and a Reddit user named USSZim. This Reddit user had posted a used Roomba vacuum cleaner for sale. So what’s the scam? Notice that the scammer uses the excuse that he/she is unable to come pick it up but sending a sister.  BUT the scammer wants to pay in advance, saying that his sister “doesn’t have the cast to pay.” That’s UNACCEPTABLE! Sellers should INSIST on CASH ONLY and IN PERSON!  USSZim said “…they send you a fake confirmation email from Zelle that has something about the payment not going through and that you need to pay to unlock it.”  Also, notice that the buyer says “I need to get it real quick” as the reason to pay via Zelle immediately.  Who the hell needs to buy a used vacuum cleaner “real quick?”

Here is yet another example why it is critically important to READ carefully, mouse-over links BEFORE clicking them, and notice details. Our friend Rob received an email informing him of someone who passed away without heirs and having his same first and last name. But the actual link in the email shows the name of the funeral home as Phillips Funeral Service, but mousing-over the link shows it as Derfelt Funeral Homes! That’s a sure sign of fraud!

We have amazingly good news to share with our readers! We wanted to share this a few weeks ago but we couldn’t believe our good fortune. In just a 4 day period, one of our honeypot email accounts was a “winner” EIGHT TIMES!  We’re still waiting for our prizes to arrive. They must be delayed because of all the holiday shipping at this time of year.

Wells Fargo Bank, Amazon, Congrats and Invoice – There have been so many phish in the sea lately! Let’s begin with this email looking as though it represents Wells Fargo Bank, using the subject line “what you need to do.”  Readers can easily see that it didn’t come from WellsFargo.com and links point to the misused service at Sendgrid.  The phone number in the email has been reported as fraudulent many times on 800notes.com!

Lunge for the delete key!

Netflix Gift Card – Congratulations on your Netflix $50 gift card!  Or so you are led to believe. However, this email came from a server in Palau called “on us lovers get ju” and the links point back to it. According to both the Zulu URL Risk Analyzer AND VirtusTotal.com, the link is 100% malicious and CERTAINLY isn’t from Netflix! Not only will you be hit with malware from Palau, but you’ll be redirected to another server called svylst[.]com, which is also malicious!

Delete!

You’ve Got a Voicemail and Package Delivery Notification – First of all, Comcast Internet Service does not notify people that they have a “new voicemail” like this. And if they did, they wouldn’t do it from someone’s personal Comcast account called “pcwinn.” The email claims that the voicemail is attached but the attached document is a Word Document (.docx)! Did you know that Word docs can contain malicious coded instructions? Yeah, we thought it best not to download and open that “voicemail.”  If the call was truly important, they can try calling again!

In last week’s newsletter, we showed readers several examples of malicious emails disguised as package tracking notifications from recognizable services.  Here’s one more supposedly from “ExpressService.” However, this email came from a domain WELL KNOWN for delivering lots of spam and malicious emails, called Kodehexa[.]net.  The link in this clickbait points to the service GoogleAPIS, which cannot be trusted. Two security services have identified that GoogleAPIS link as malicious!

Cyber Monday Winner –Our reader named Bobbie is one of the most heavily targeted people we know by cybercriminals!  She recently was told that she is a “CYBER MONDAY WINNER” according to this text from 720-205-6881. Of course it makes no sense to “use” the phone number 520-405-5337 to claim her TV AND click the link to a malicious website.  The domain used in that link, silkyyincline[.]com, was registered in Iceland, using Namecheap, just hours before she got this text!

Deeeeeeleeeeeete!

Bobbie was also told that she won a “Sam sung T V.” But if she doesn’t claim it, they threaten to give it to another person! That sounds like a legitimate contest, doesn’t it? The domain used in the link was registered in the Netherlands about 2 weeks ago.

Until next week, surf safely!

Copyright © 2022 The Daily Scam and Scamadviser. All rights reserved. You are receiving this email because you
have subscribed to it via Scamadviser.com or thedailyscam.com

Keurenplein 41, UNIT A6311  |  1069CD Amsterdam, The Netherlands

Contact Webmaster