How we helped expose a £12 million rental scam

TL;DR

• We helped Channel 4 with trying to track down rental scammers.
• We are not the police so we could only take it so far and any proving guilt or innocence would be a police matter.
• We saw organised approaches and elaborate setups. A lot of technical and money laundering techniques were needed.
• The person identified didn’t meet the criteria of someone who could pull this off alone or was indicative of a “Master criminal”. Identity fraud may be playing a part.
• Be aware of some common approaches that are prevalent in scams such as these.

Introduction

When Channel 4 approached us to assist in investigating one of the largest rental scams in the UK, we didn’t hesitate. Their show, The £12 Million Rental Scam: UNTOLD, aimed to expose criminals preying on desperate renters. What we uncovered was a world of scams, identity theft, and social engineering so clever, it often left no clear trail back to the culprits.

This is the story of how we helped, what we discovered, and the lessons renters can take away to protect themselves.

How the scam worked

The demand for housing far exceeds the available supply, leaving some at risk of homelessness. This creates pressure for renters to make quick decisions under stressful circumstances. Scammers exploit this urgency by using tactics like “ticking clocks” (pressuring victims with tight deadlines) and “too good to be true” offers. These manipulative techniques are seamlessly woven into the competitive nature of securing a rental.

Weak protections on online platforms like Meta and OpenRent, combined with “convincers” such as fake documents or upfront reassurances, make it easy for scammers to exploit victims on a large scale. Communication from scammers is initially constant and reassuring—until they suddenly disappear.

Organised and multi-faceted

Having seen the evidence (telephone chat histories, screenshots of money paid to the scammers, and the convincers used in this operation) it was difficult for many of them to tell real from fake. False websites, false companies, fake estate agents, stolen documentation (potentially), and almost every social engineering trick going – including ones that we tell our own teams never to use in client engagements because of the emotional trauma it can leave behind.

For the record, this was pure exploitation. The victims were acting in good faith, not seeking a quick bargain or willing to overlook suspicious details. Many even attempted to do relevant OSINT to verify what they were buying. The scams we saw were well planned, highly organised, multi-faceted and multi-platform. There was strong evidence that specific chat channels and apps used in these scams were chosen specifically for their lack of forensics capability.

On a technical level there were “clever” aspects to the way the scam was carried out. And then there were bits of the scam that were “dumb”, so dumb in fact they may actually be clever. The scammers would apparently often dox themselves early in the process with photos of passports. Passports which as far as could be ascertained were legitimate and had the required security aspects.

They appeared to be legitimate documents, but they were given freely and so early on in the scam that they either were failing the most basic of OPSEC or they were standing up a patsy or a fall guy in each instance and using identity theft techniques to stand behind someone who will “take the rap” but may or may not have anything to do with the scam or may even be a low paid person doing side hustle jobs to make a living and is unaware a scam is being done.

We could not prove within reasonable doubt that people identified were actively involved and while some pointers did indicate someone, they were often uncorroborated or unverifiable without access to data which is only obtainable by law enforcement.

As stated on the show there were only 67 cases brought before the courts out of 5000 reported. The problem is that technology is easily used to commit fraud. The level of proof needed is often more than your average person who respects the CMA and privacy laws, can provide. If we erode those laws for the sake of one case, we begin the slippery slope to a loss of privacy for all of us.

Reduce your risk of being scammed

We support the premise of the TV show and commend the investigative teams involved in trying to uncover the scammers who are taking advantage of people for significant sums, in some cases their entire savings. But as they highlight it is easy to capture images and use them for alternative purposes and more and more responsibility falls on the shoulders of the purchasers to do extreme due diligence on anyone involved in the process.

This can only be solved by some of the changes being described in the show with more legislative controls and centralised databases of registered landlords. It is a great idea to have moderators attempt to find and irradicate these sites and postings on their platforms when they find them, but often this takes sharp minds and even local knowledge to help find them.

While it is easy to say that you personally may have spotted that the shard shouldn’t be in Scotland, would you find it just as odd to find London Bridge in the Arizona desert (because they shipped it there in the 1970s)?

AI may find a use here once it’s trained, but I’m certain that scammers will find a way to overcome this too.

What to look out for

Your best defence is to watch for the social engineering tricks scammers use:

1. Ticking clocks and purchases with a restrictive time limit that prevent reasonable due diligence. The more pressure they apply the more time you should allow yourself to check the facts.

2. Too good to be true prices or offerings that would normally be at significantly higher prices or would trigger different moderation requirements for large value listings. Ask yourself “Why is this property half the rate of all others in the same road but looks like a high-end hotel bedroom”?

3. Attempts to get you to leave the platform and make alternative arrangements to communicate. Especially where they move you from web-based platform to phone or app based comms using apps known for their lack of forensics capabilities.

4. When your bank warns you that something may not be legitimate, pay heed. Those warnings may be boilerplate, but some are direct warnings of reported scams attached to that account and failing to heed the advice of the bank may result in you getting little or no money back.

5. Stick to reputable agencies and trusted companies. While it’s not always convenient it is advisable to always try and view a property more than once and any deposits given should be under escrow with a verified third party.

6. Avoid companies that appear to be using personal banking accounts. While scammers are using techniques to obfuscate aspects of their accounts it may be worth contacting the bank if uncertain.

7. Many cash transfer apps are not banks. Banks have a duty of care to “know your customer” and requires levels of due diligence to create an account not required in many of these cash transfer apps that were designed for “friend to friend” transfer rather than business transactions.

8. Attempting to verify someone’s identity is good. However, be aware that photos and other types of evidence could be stolen. If in doubt ask for a selfie of the ID and the persons face in the same image, at least you know you can match them together then. It’s much harder to blend those two requirements and even AI might struggle to get precision between the person and the photo of the ID.

9. Report all frauds to Action Fraud. You may not feel it will result in getting “justice” but the data you provide helps fight crimes and helps identify organised criminals who may not be spotted unless a wider and more comprehensive view is established.

10. Be aware that technology provides a level of obfuscation that means it is easier to perform certain types of scams. Evidence was apparent in these scams that individuals were either hired as patsies or are so blatantly unfearful of reprisal they would take it to the physical level that most scammers will not attempt. Meeting people and seeing reputable business establishments can help you determine if the company is legitimate or just a paper trail of no substance.

11. Be aware of government backed schemes in place for landlords and renters: https://www.gov.uk/deposit-protection-schemes-and-landlords. Note that there are separate schemes for Scotland: https://www.mygov.scot/tenancy-deposits-landlords and Northern Ireland: https://www.nidirect.gov.uk/articles/tenancy-deposit-scheme-information-landlords