Cybercriminals Deceive Tenants into Redirecting Rent Payments to Fraudulent Accounts

In a sophisticated business email compromise (BEC) scheme, cybercriminals are targeting tenants with fraudulent requests to redirect rent payments to attacker-controlled bank accounts. The campaign primarily focuses on French-speaking victims in France and occasionally Canada, exploiting the anxiety associated with potential missed rent payments to manipulate targets into immediate action without proper verification. The attacks […] The post Cybercriminals Deceive Tenants into Redirecting Rent Payments to Fraudulent Accounts appeared first on Cyber Security News.

May 1, 2025 - 13:49

Cybercriminals Deceive Tenants into Redirecting Rent Payments to Fraudulent Accounts

In a sophisticated business email compromise (BEC) scheme, cybercriminals are targeting tenants with fraudulent requests to redirect rent payments to attacker-controlled bank accounts.

The campaign primarily focuses on French-speaking victims in France and occasionally Canada, exploiting the anxiety associated with potential missed rent payments to manipulate targets into immediate action without proper verification.

The attacks follow a consistent pattern where victims receive official-looking communications claiming their rental payment has not been processed.

These messages inform recipients that the property management company’s banking details have changed and provide new account information for future payments.

The fraudulent communications often employ authentic-looking letterheads and official terminology such as “Relevé d’Identité Bancaire” (bank account identity statement) to enhance credibility.

Proofpoint researchers identified this threat actor, designated as TA2900, through analysis of over 50 campaigns utilizing nearly two dozen different IBAN numbers.

The threat actor typically sends two to three campaigns using the same bank account before switching to a new one, demonstrating operational security awareness and methodical approach to avoiding detection.

The attackers leverage compromised mailboxes belonging to educational institutions to distribute their campaigns, providing an additional layer of perceived legitimacy.

Subject lines are typically generic such as “Loyer” (Rent) or “Nouveau RIB” (New bank details), while attached PDFs feature logos and terminology common to property management companies.

Social Engineering Tactics Analysis

The effectiveness of TA2900’s campaign lies in its sophisticated social engineering approach. The attackers trigger emotional responses by suggesting tenants’ housing could be at risk, creating urgency that bypasses rational verification processes.

The communications demonstrate knowledge of French rental payment processes, incorporating legitimate terminology like “Garantie des loyers” (Rent guarantee) and “Gestion immobilier comptabilité” (Real estate management accounting).

TA2900 Message examples including IBAN and BIC numbers (Source – Proofpoint)

Messages often contain specific instructions for victims to reply with proof of payment or authorization for future automatic payments, creating multiple opportunities for financial theft.

The bank accounts used by TA2900 are registered at legitimate French financial institutions, specifically “low cost” branches of larger banks, making transactions appear genuine to victims.

While the exact location of TA2900 remains unknown, Proofpoint assesses with high confidence that the actor’s primary motivation is financial theft.

The predominantly French-language campaigns may use translation software rather than indicating French-speaking operators, suggesting the attackers could be based outside the targeted regions.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

The post Cybercriminals Deceive Tenants into Redirecting Rent Payments to Fraudulent Accounts appeared first on Cyber Security News.