Real estate fraud: how to verify the identity of prospects and property owners.

When a Business Opportunity Becomes a Fraud Risk

Someone contacts a real estate agency because they want to buy, rent, or sell a property. They ask about the terms, provide their contact information, and request to move forward with the transaction. To the real estate agent, it may seem like just another business opportunity.

But what happens when that person is not who they claim to be?

On June 16, 2026, the FBI's Internet Crime Complaint Center (IC3) issued an alert about a fraud scheme in which criminals impersonate owners of vacant land to attempt to sell properties without their knowledge or authorization.

The Problem

For a real estate agency, this raises a concern that goes beyond receiving messages through WhatsApp, Instagram, email, or a real estate portal. These channels make it easy to start a conversation, but knowing someone's name, seeing their photograph, or receiving a copy of their identification document is not the same as verifying their identity.

This does not mean that every prospect should undergo identity verification before receiving information about a property. The key is determining at what stage of the business relationship it becomes necessary to confirm who you are dealing with, particularly when documents will be shared, certain property viewings will be scheduled, or a transaction is moving forward.

The first step is understanding what we can actually verify when someone presents an identification document and claims to be its rightful holder.

A Photo of an ID Card Is Not Enough to Confirm Someone's Identity

When a prospect wants to rent a property or an owner asks a real estate agency to market their property, it may be necessary to request information to establish their identity. In many cases, this exchange begins with a photograph of an ID card, passport, or another identification document sent via WhatsApp or email.

However, receiving that photograph does not prove that the document is authentic or that it belongs to the person sending it. Someone could present an altered ID, use another person's document, or provide information that does not match their actual identity.

Validating the Document's Authenticity and Verifying That It Belongs to the Person Presenting It

For a real estate agency, this distinction has practical implications. An agent may receive an ID displaying a seemingly valid name, identification number, and photograph, but that information alone does not confirm who is actually behind the request.

To reduce the risk of identity fraud, remote identity verification procedures can combine document validation with a facial capture of the person presenting it.

The captured image can be compared with the photograph on the document and supplemented with liveness detection mechanisms, designed to detect certain attempts to use photographs, recordings, or other representations instead of a physically present person.

This does not mean that every real estate inquiry should begin with a facial scan. The level of verification should reflect the risks associated with the transaction, the type of information being exchanged, and applicable data protection requirements.

For a real estate agency, the goal should not be to accumulate photographs of identification documents in agents' conversations, but to establish a procedure that allows identities to be verified when necessary and ensures that the information is handled securely.

From Scanning an ID Document to Facial Verification

Verifying the identity of a prospect or property owner does not necessarily require them to visit an office. Digital procedures can validate identification documents and compare their information with the person presenting them, using a phone or computer camera.

In practice, a remote identity verification process can include three complementary checks.

• Validate the identification document: The person captures an image of their ID card, passport, or another accepted document. A validation system can analyze its format, the information it contains, and certain security features to detect potential alterations or inconsistencies. Where authorized verification mechanisms are available, the information can also be cross-checked against official or trusted sources.

• Compare the face with the document: The prospect captures an image of their face, and the system compares their facial features with the photograph on the identification document. This comparison helps determine whether the person participating in the process matches the claimed identity.

• Perform a liveness check: This control aims to detect certain attempts to deceive the system using photographs, recordings, or other representations of a face. It may involve automated analysis of the captured image and, depending on the solution used, require the person to perform specific actions.

For a real estate agency, these technologies provide an additional layer of verification when the risks associated with a transaction justify it, without relying exclusively on documents sent through messaging apps.

For example, before proceeding with a rental application, an agency could request identity verification through a controlled digital process. The agent would receive the corresponding verification result rather than having to determine independently whether a photograph of an ID card appears authentic.

The goal is not to guarantee that a person will never commit fraud, but to reduce the possibility of someone proceeding with a transaction using another person's identity or manipulated documentation. Once identity has been verified, the relevant financial, documentary, or legal checks will still need to be carried out.

Not All Inquiries Require the Same Level of Verification

Someone asking about the price of an apartment does not necessarily present the same level of risk as someone requesting a viewing of a vacant property, submitting documents for a rental application, or claiming to own a property they want to sell.

Therefore, introducing identity verification measures should not mean requiring everyone who contacts a real estate agency to submit a photo of their ID and undergo facial verification.

In practice, a real estate agency can establish different verification measures depending on the stage of the business relationship.

• During an initial inquiry: When a prospect is simply requesting general information about a property, collecting the minimum information necessary to respond may be sufficient. Requiring biometric verification at this stage could create an unnecessary barrier for someone who is still exploring their options.

• Before a property viewing: Particularly when dealing with vacant properties or circumstances that increase the risk to the agent or the property, the agency may establish additional safeguards. These could include confirming contact details, recording the request, and, when justified, verifying the identity of the person attending.

• When proceeding with a rental application or negotiation: Identity verification becomes more relevant. The person may need to submit personal documents, financial information, or documentation related to the transaction. In this context, document validation and facial comparison can help reduce the risk of someone using another person's identity.

• When someone requests to list a property for sale or rent: Beyond verifying the person's identity, it is necessary to confirm their legal relationship with the property and whether they are authorized to sell or rent it. The FBI has documented fraud schemes in which criminals use false identification and documents to impersonate landowners and attempt to sell properties without authorization.

More verification does not always mean better protection. The goal is to identify the stages where a specific risk exists, apply appropriate safeguards, and avoid collecting personal information that is not necessary.

Verifying Someone's Identity Also Means Protecting the Information You Receive

When a real estate agency requests an ID card, passport, or facial capture to verify someone's identity, it is not simply introducing a fraud prevention measure. It is also collecting personal information that must be protected throughout its collection, storage, access, and deletion.

A photograph of an identification document may contain names, identification numbers, dates of birth, and other personal details. If facial recognition is also used, the process may generate biometric data that requires additional safeguards.

Therefore, moving identity verification from a WhatsApp conversation to a digital process does not automatically guarantee greater security. Protection depends on how that process is designed, what information it collects, who can access it, and how long it is retained.

For a real estate agency, this means that security does not end when the system confirms someone's identity. There must also be a procedure for managing the information collected.

For example, it is advisable to restrict access to documents to those who need them to carry out the transaction, prevent unnecessary sharing across conversations or personal devices, and define when the information should be deleted.

Agents do not always need to retain a copy of every file used during the verification process. Depending on the requirements of the transaction and applicable obligations, it may be sufficient to retain the verification result and only the information strictly necessary to support subsequent decisions.

A real estate agency should not reduce the risk of identity fraud while simultaneously creating unnecessary risks for its clients' personal data.

Generating Leads Without Losing Control of Information

Receiving inquiries through WhatsApp, Instagram, email, or specialized real estate portals is part of everyday business operations. These channels allow agents to start conversations and generate opportunities, but they should not become the only place where identities, documents, and transaction-related decisions are managed.

The solution is not necessarily to abandon direct messages, but to establish a process that allows an initial inquiry to progress toward more structured and secure management.

For example, someone might reach out through Instagram because they are interested in renting an apartment. The agent answers their questions and, when the prospect decides to proceed with their application, can direct them to a controlled environment to provide the necessary information, complete the appropriate verification checks, and continue the process.

This way, the conversation remains a point of commercial contact, while document collection and identity verification take place through procedures established by the agency.

Real estate security does not depend on a single tool or an isolated verification check.

It requires a combination of identity verification procedures, document checks, data protection measures, and controls appropriate to the risks associated with each transaction.

For a real estate agency or agent, the goal is to pursue new business opportunities without compromising clients' information or assuming that a claimed identity has been verified. Introducing these controls at the appropriate stage allows lead generation and fraud prevention to become part of the same process.