Multifamily vendor fraud: how to balance service with security at scale

In March 2024, CityHousing Hamilton, a social housing provider in Ontario, paid about $552,000 to the wrong bank account. The account belonged to a fraudster impersonating one of its vendors.

Here is the detail that stands out: two weeks earlier, the real vendor had emailed CityHousing to say it had suffered a security breach, and asked staff to call before acting on any request to change its banking details. The money went to the fraudulent account anyway, according to The Public Record (April 2025).

You don’t need to assume anyone was careless to see the problem. It’s arithmetic: CityHousing undoubtedly has many vendors, and every vendor has banking information someone has to get right, every time, under time pressure.

If you want to stop vendor fraud in multifamily real estate, start by identifying your attack surface: your vendor pool.

This post covers why it grows, why you can’t simply cut it, and what to do instead.

Vendor sprawl is what happens when a multifamily operator scales

Real estate is local, and naturally, so is the maintenance. You can’t send the same plumber to a building in New York and a building in California. Roofers, electricians, painters and landscapers are hired, licensed and trusted market by market. So when a new market comes online, its vendor list doesn’t just grow a little, it starts over from scratch.

That’s vendor sprawl, and it’s a side effect of owning more buildings in more places. A regional manager brings in a contractor they trust, the property accountant sets them up for payment, and the vendor directory grows one trade at a time.

Tenant satisfaction rises with vendor curation

The obvious answer to vendor sprawl is to shrink the list of vendors. The data says that shrinking your vendor pool has a negative impact on your business.

Property Meld’s 2025 benchmarking, drawn from thousands of property management companies and published in January 2026, compared two approaches.

Property managers who used the same three vendors per category all year took an average of 8.2 days to complete a repair, and scored 4.3 out of 5 on resident satisfaction. Operators who rotated vendors quarterly based on performance took 5.1 days and scored 4.6, according to Property Meld.

The math says having more vendors is better for your multifamily real estate empire.

That’s 3.1 days faster per repair, or about 38% shorter. Satisfaction rose 0.3 points, about 7%. Neither number is dramatic on its own, but across thousands of work orders a year, a tenant waiting three fewer days for a working sink adds up.

This is one software vendor’s own benchmarking data, but the direction is clear enough to matter: the operators with the best service are the ones with more options, and that means they have to try out — and pay — a lot of vendors.

Therein lies the conundrum. You need a broad, competitive vendor pool to keep tenants happy, and a broad pool means more people to pay. More people to pay means more bank details someone can impersonate.

Most property management vendors are small businesses and a blind attack surface

Think about who actually does the work. The plumber, the electrician, the roofer and the painter fall under what the Census calls specialty trade contractors, and by the SBA’s size standard about 96% of them qualify as small businesses.

More telling, about 79% have no employees at all: one person who does the work and the paperwork, according to NAHB’s analysis of 2022 Census data. They’re good at their trades, but security isn’t anyone’s job because there’s no one to make it theirs. So it becomes yours.

Now sit in your accounts payable seat. Before you pay a new vendor, or accept a change to their bank details, what do you actually know about their security? Do you know whether the vendor’s email is protected, whether the person contacting you is really the owner, or whether they’d notice if their inbox were compromised? It’s virtually impossible to know.

Of course, you could raise the bar: require security standards, reviews and documentation from every vendor. However, that runs straight into cost. Repairs and maintenance come out of operating margin, so every added requirement shows up in the cost of every work order. It adds onboarding time, it narrows the field to vendors willing to put up with the paperwork, and it slows the response times that keep tenants satisfied.

So in practice, many vendors get onboarded on trust alone because the alternative costs money and speed you can’t spare. Attackers understand that trade-off. They don’t need to breach you. They hit the soft targets that are your vendors, impersonate them, and kick off a routine fraud against whomever their clients are.

Unit growth compounds the vendor pool and fraud risk

As a growing multifamily real estate operator, you add specialist vendors, too: pool maintenance, elevator technicians, fire and life safety inspectors, parking lot maintenance, security patrol, waste hauling. Each is another account that compounds your risk.

Below is what that looks like at different portfolio sizes. This is an illustrative model, not survey data. We modeled it using public data from one of the world’s largest multifamily real estate management companies.

The list of trades widens with scale: 6 core trades (plumbing, electrical, HVAC, roofing, painting, landscaping); about 12 at mid-size, as pest control, flooring, appliance repair, locksmith and access control, pressure washing, and parking lot maintenance come in; and about 24 at large scale, as elevator, pool, fire and life safety, security, waste and compactor, EV charging, generator, facade cleaning, snow removal and others join.

The compounding of the vendor pool is the key takeaway here:

From 100 units to a million, the vendor list grows roughly a thousandfold. Each row is also a count of payment instructions someone has to get right.

Payment fraud risk scales with units under management, because your vendor roster has to scale with your units.

Multifamily vendor fraud prevention without cutting vendors

Shrinking the vendor list to shrink the risk negatively impacts the tenant satisfaction you just read about. A better move is to keep the pool diversified and secure the process of paying your vendors. Three principles hold up whatever tools you use:

Verify every first payment and every change. Don’t trust a bank detail because of the channel it arrived in. An email, an invoice and a phone number on either one are all things an attacker can easily control.

Apply the same rule to every vendor. The contractor you’ve used for fifteen years gets the same re-confirmation as the one you added last week. Attackers prey on your trust.

Keep a record you can show. Who confirmed what, and when, should be easy to pull up for an owner, an auditor or a lender, without anyone reconstructing it from an inbox.

The goal is to remove the step attackers exploit, which is the blind acceptance of a message or a phone number delivered from a channel or “person” you’ve always trusted.

Where DoubleCheck® fits

Payment fraud is a large problem: the FBI’s Internet Crime Complaint Center logged $16.6 billion in reported cybercrime losses in 2024, including $2.77 billion from business email compromise. Vendor payments are one of the places it enters a multifamily real estate business.

DoubleCheck secures vendor payments by authenticating the counterparty and verifying their payment instructions. Every verification leaves a documented record you can show auditors, and every DoubleCheck contract includes a reimbursement guarantee.

Manage the risk and the vendor pool

Vendor sprawl grows in parallel with units under management, and payment fraud risk grows with it. Because you need more vendors to keep tenants happy, the answer isn’t a smaller pool, it’s a highly-curated pool based on performance with a safer way to pay it. Managing the pool is your job. Keeping your payments safe is ours.

If you’d like to see how it works for a multifamily portfolio, book a demo of DoubleCheck.