The Wire Fraud Scam Targeting HOA Dues and Vendor Payments
How business email compromise scams trick HOA boards and management companies into wiring dues or vendor payments to fraudsters, and the specific controls that stop it.
Homeowners associations move real money — dues, special assessments, insurance premiums, contractor payments — through small offices or third-party management companies that often lack the fraud controls a bank or large company would have. That combination is exactly what business email compromise (BEC) scammers look for, and HOAs have become a documented target.
How the scam actually works
The FBI's Internet Crime Complaint Center (IC3) has called business email compromise a multi-billion-dollar problem, and it accounted for roughly 73% of reported cyber-incident losses in 2024 by some industry tallies. The mechanism is almost always the same: a fraudster either compromises a real email account (the association's manager, treasurer, or a vendor) or spoofs one convincingly, then sends what looks like a routine, internal instruction to change how a payment is sent — a new bank account for the roofing contractor, a request to wire this year's insurance premium instead of mailing a check.
Two different attack patterns, not one
Board-impersonation fraud spoofs or hijacks a director's or officer's email and instructs staff or the management company to redirect an association payment. Vendor-impersonation fraud instead compromises or spoofs the vendor's own email — the roofing contractor, the insurance broker, the reserve-study firm — and sends a routine-looking notice that their bank account has changed ahead of an invoice the association is already expecting. The second pattern is more dangerous in practice because the association is already anticipating a legitimate payment request, so the fraudulent version doesn't need to invent an urgent pretext; it only needs to intercept a payment that was coming anyway.
Why HOAs are a soft target
Three structural features make associations attractive: the same handful of large payments (insurance, reserve-funded contracts, reconstruction after a claim) happen on a predictable annual calendar; day-to-day payment authority often sits with a management company employee who has never met the board treasurer in person; and many associations still authorize wire changes over email alone, with no callback verification step.
The management company's role deserves its own scrutiny
Most associations route payments through a management company rather than handling them directly, which adds a layer the board often assumes is already secure. Ask the management company directly, in writing, what its own internal controls are: does a single employee have authority to change a vendor's bank details and release a wire without a second approver, and does the company carry its own cyber and social-engineering fraud coverage that would respond if its systems (not the association's) were the entry point for the fraud. A board that never asks this is trusting a third party's internal controls sight unseen.
The controls that actually stop it
- Never change a vendor's or the association's own bank details based on an email alone — confirm by phone, using a number pulled from a prior invoice or the vendor's official website, never a number provided in the email making the request.
- Require a second person to verbally verify any wire transfer or vendor payment-detail change above a set dollar threshold before it is released.
- Turn on two-factor authentication for every email account with financial authority (board treasurer, management company AP staff), since a compromised password is the most common entry point.
- Block automatic email-forwarding rules to external addresses on financial staff accounts — a common tactic is a hidden forwarding rule that lets the fraudster watch the conversation silently before striking.
- Treat any request marked urgent, confidential, or asking to bypass normal approval steps as a red flag regardless of who it appears to be from.
What insurance actually covers — and what it usually doesn't
Many boards assume the association's crime or fidelity bond policy covers this kind of loss. In practice, standard HOA fidelity bonds are often written to cover theft by an association's own employees or board members, not a third-party fraudster tricking someone into voluntarily sending a wire. Coverage for social-engineering or funds-transfer fraud is frequently a separate endorsement or a distinct cyber policy — and if the association never bought it, a six-figure wire fraud loss may simply not be covered. Ask your insurance agent specifically whether your policy includes social engineering fraud or funds transfer fraud coverage; do not assume the crime bond covers it.
When you ask an agent whether the association is covered, ask specifically for the endorsement name and a copy of its language — common terms to look for include "social engineering fraud," "funds transfer fraud," or "computer fraud" coverage, each of which can have different triggers and sub-limits. It is common for a social-engineering endorsement to carry a much lower sub-limit than the base crime policy limit — for example, a $1,000,000 fidelity bond with only a $50,000 social-engineering sub-limit — which would leave most of a large fraudulent wire uninsured even though the board believed the association was covered.
If it happens anyway
Speed matters more than almost anything else. Contact the sending bank immediately and ask for a wire recall; the first hours after a fraudulent wire are the best window for a bank-to-bank recall before funds are moved again. File a complaint with the FBI's IC3 (ic3.gov) and notify local law enforcement. Notify the association's insurance carrier and legal counsel even before coverage is confirmed, since prompt notice is often a condition of any coverage that does apply.
What owners should ask their board
As an owner, you are not responsible for the association's internal payment controls, but a wire fraud loss ultimately gets absorbed by the membership through a special assessment or a reserve shortfall. It is reasonable to ask the board or management company, in writing, whether they have a documented callback-verification policy for wire and bank-detail changes, and whether the association's insurance includes social engineering or funds transfer fraud coverage.
Questions homeowners ask
Is HOA wire fraud actually common, or is this overstated?
It is common enough that specialty insurers who write HOA policies now flag it explicitly, and the FBI tracks business email compromise as one of the largest categories of reported cybercrime loss by dollar value. Associations that handle large annual payments (insurance premiums, reconstruction contracts) are a recognized target.
Does the management company or the association bear the loss if a wire is stolen?
This depends on the management contract's allocation of liability and on whose email or process failed. It is worth reviewing the management agreement's language on payment authorization and liability before a loss happens, not after.
Would requiring paper checks instead of wires eliminate the risk?
It reduces one attack vector but does not eliminate the underlying scam, since fraudsters also redirect check mailing addresses or intercept mailed checks. The reliable fix is a verification process — confirming any change to payment instructions through a separate, known channel — rather than a specific payment method.