“Rent accounting: late payment” email: why it is a scam

Have you received an email titled “COMPTABILITE LOYER” (“Rent accounting”) or “PAIEMENT EN RETARD” (“Late payment”) informing you of a change of bank details and asking you to pay your rent to a new IBAN? Do not transfer anything before calling your property manager. It is a fake transfer scam, and the loss is immediate and hard to recover.

Is this rent reminder email a scam?

In the case documented here, yes. The email presents itself as a rent reminder from a property manager, with an updated IBAN and a manager’s name (“CYRIL ATTOUMANI”). It is credible enough to fool an inattentive tenant, especially since it mentions a signed tenancy agreement and specific due dates (May and June 2026).

But the displayed sender (beauvais@valorizhabitat.fr) hides a very different reality: the real technical sender is an address on xaviermelonier.example.com, a test domain reserved by IANA that cannot legitimately send any business email. SPF fails. Above all, the reply address given in the body of the email is gestions-loc@outlook.com, a personal Outlook mailbox with no connection to the impersonated property management company.

What is the fake property transfer scam?

This technique is called BEC (Business Email Compromise) applied to the property sector. It consists of impersonating a letting agent, a condominium manager or a landlord to intercept a payment by replacing the legitimate IBAN with an account controlled by the scammers.

It is one of the most effective scams because it exploits a perfectly legitimate context: every tenant pays rent, every landlord may send a reminder. The urgency is real (unpaid rent has consequences), which pushes people to act quickly without checking.

The loss is particularly severe: unlike a card purchase, a SEPA transfer that you voluntarily make to a fraudulent IBAN is very hard to recover. The bank is not liable if you initiated the transfer yourself. Dispute windows are short, and success depends on how fast you act and on the cooperation of the receiving bank, which is often abroad.

What signs give this email away?

Several elements let you identify the fraud without analysing the technical headers.

The reply address. The body of the email asks you to reply to gestions-loc@outlook.com. A professional property manager always replies from their company domain, never from a personal Outlook, Gmail or Yahoo mailbox. This is the easiest sign for any recipient to spot.

A change of bank details announced by email. A legitimate IBAN change is never made solely through an unsolicited email. Your property manager contacts you by registered letter or through your online tenant area, or confirms it by phone. An email alone is not enough and should never trigger a transfer to a new IBAN without prior verification.

The generic message. The email is addressed to “Dear Sir or Madam” with no first name or specific unit or lease number. A real property manager knows your name and your file reference.

The technical sender. When you display the sender details in your email client, you will see that the real address does not match the displayed domain. The Return-Path points to xaviermelonier.example.com, a technical test domain that cannot legitimately send any commercial email.

How to check before transferring

The rule is simple and absolute: never change a payee’s IBAN without direct verbal confirmation. Before any transfer to a new IBAN received by email, call your property manager on the number you have in your previous contracts or statements, never a number found in the suspicious email. Confirm the change of bank details verbally.

If you use an online tenant area, log in directly to the platform to check whether an IBAN change has been recorded there. A legitimate change always appears in your customer area, not just in an email.

This check takes two minutes and can save you from a potentially irreversible loss. See also our digital hygiene recommendations to sharpen your vigilance against this type of email.

What to do if you have already made the transfer

Act within minutes of discovering the fraud.

Call your bank immediately to report a fraudulent transfer and request a recall of funds. In France, your bank can try to contact the receiving bank to freeze the funds if the account has not yet been emptied. The faster you act, the better your chances of recovering the money.

File a complaint with the police the same day, with a copy of the fraudulent email and the transfer statement. The complaint is needed to trigger the banking procedures and any possible compensation.

Report the scam on Cybermalveillance.gouv.fr and also contact your legitimate property manager to let them know their identity is being used in this campaign.

If your email account was compromised and the scammers were able to access your exchanges with your property manager to personalise the scam, see our guide on what to do if your email has been hacked. Also enable two-factor authentication on your mailbox to prevent any future unauthorised access. And remember to better protect your email address to limit your exposure to this type of targeted campaign.

Why is the property sector particularly targeted?

The amounts at stake are high (rent often represents several hundred or even several thousand euros), the context is familiar and predictable (rent is due monthly and regularly), and victims are often individuals who are less aware of transfer fraud than businesses.

Scammers cross-reference tenant data exposed in breaches, such as those documented at companies like Bouygues Telecom or Auchan, with public information about property management companies to build credible, targeted emails.

---

Frequently asked questions