Fake Rental Listing / Advance Payment Fraud
Attack Trigger
Attractive below-market rental listing requesting a deposit before an in-person viewing
What Attackers Want
$500–$5,000 in deposit and first/last month rent
How This Attack Works
Scammers post fake rental or vacation property listings on Craigslist, Facebook Marketplace, or lookalike sites with prices well below market value. Victims are told the landlord is traveling and cannot show the property, but a deposit is required to "hold" it. After payment, the listing disappears and the landlord is unreachable.
Red Flags to Watch For
- ✗Price is significantly below comparable rentals in the area
- ✗Landlord is unavailable in person and insists on email or chat only
- ✗Request for a security deposit or first month's rent before viewing the property
- ✗Payment requested via wire transfer, Zelle, or money order
- ✗Photos match properties listed elsewhere under different names
- ✗Listing was recently posted and has no verifiable address history
Known Malicious Domains
These domains have been associated with this attack. Never click links going to these addresses.
- rental-listing-secure.comMALICIOUS
- apartment-apply-now.netMALICIOUS
- vacation-rental-deals.comMALICIOUS
- home-rental-deposit.netMALICIOUS
Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.
How Glance Stops This
- Domain similarity analysis catches lookalike sender addresses at millisecond speed
- SPF / DKIM / DMARC validation flags authentication failures before you ever see the email
- VirusTotal + Google Safe Browsing checks every link in real time
- Urgency language detection scores the email higher for manual review
- Known malicious domain blocklist updated continuously from live scan data
Don't wait to get hit.
Glance scans every incoming email against 12 detection layers — including the exact tactics described above — before it reaches your inbox.
Protect My Inbox — Free