How to Run Safe Self-Showings Without Inviting Scammers or Squatters

Run safe self-guided tours by verifying the renter's identity before the lockbox code is released — not after. Bank-level ID plus a selfie match clears the prospect first; only a passed check unlocks a one-time, time-boxed code. Code-first tools release access then verify, which is exactly how scammers grab codes.

Why are property managers shutting off self-showings entirely?

For a growing number of residential property managers, the self-showing turned from a time-saver into a liability. Across 112 of our recorded discovery calls, scammer and squatter exposure is the number two reason operators abandon self-showings — raised by more than 25% of the managers we spoke with. That is not a fringe concern. It is a mainstream failure mode.

One operator managing roughly 1,100 single-family units put it plainly. After turning on lockbox-based tours, they found themselves with "nothing but squatters, nothing but scam artists basically grabbing codes" — and shut self-showings off entirely. Another described a worse outcome: "somebody impersonating a prospect took our keys and started doing his own leasing service."

The trap is obvious once you are in it. Turning tours off stops the scammers, but it also stops qualified renters who will not wait two days for a scheduled agent showing. You lose the lead. The off-switch feels like a solution; it is actually a different problem.

The real question is not whether to allow self-showings. It is what order you grant access in.

What actually goes wrong with code-based lockboxes — and why scammers love them?

The failure is structural, not accidental. A static lockbox code — or one released before identity is checked — grants access to anyone who has the digits. Forward the text, screenshot the email, shoulder-surf the app: the code works regardless of who types it in. That is the "grabbing codes" failure mode the operators above described. Verification happens later, or never, because the person is already inside.

The squatter pathway follows directly. An unverified person enters, changes the locks, and claims residency. From that point, removal depends on local eviction law — and in some US states and Canadian provinces, that process can take months. California, Florida, and Texas came up repeatedly in our calls as markets where operators were especially cautious. Canada's rules vary by province. The common thread: the longer a squatter holds the unit, the more expensive the exit.

It is also worth noting an overcorrection that appeared in the industry: some self-showing tools began collecting Social Security numbers without explaining why to prospective renters. That approach piles heavy-handed data collection onto people who have not yet applied for anything, which drives off qualified prospects without solving the root problem. Scammers will provide a fake SSN; a good renter may simply walk away.

The mechanism failure is not lockboxes. It is the sequence — access before identity.

How big is the rental fraud problem right now?

Large enough that the numbers across two independent sources tell the same story.

The National Multifamily Housing Council's Pulse Survey on the Operational Impact of Rental Application Fraud and Bad Debt (fielded November 2023–January 2024, n=75 operators) found that 70.0% of apartment operators reported identity theft and fraudulent ID documents as a fraud type they faced, and 70.7% reported an overall increase in fraudulent applications and payments over the prior 12 months. The load-bearing logic here is simple: identity is the fraud vector, which means identity verification is the control. Those two numbers make the case.

The same NMHC survey found that 24.5% of operators' bad debt was attributed on average to nonpayment from fraudulent applications. That is roughly one in four dollars of bad debt tied directly to the failure to verify who is on the other end of an application.

At the consumer scale, the FTC Consumer Sentinel Network logged approximately 65,000 rental scams and roughly $65 million in reported losses from January 2020 through June 2025, with a median loss of $1,000 per victim. These are reported losses — the actual scale is likely higher.

Rental fraud is not a niche threat. It is a normalized operating cost for managers who have not put a control in front of the door.

What does a safe self-showing actually require?

Safe self-showings come down to four controls, applied in the right order. The table below shows the pipeline — each step builds on the one before it.

Each control is available with existing technology. The question is whether your current tool enforces them in this order — and most do not.

What is bank-level ID verification, and why does the order matter?

Generic guidance says "verify renters." That is not wrong, but it misses the insight that came through in our calls: the SEQUENCE is what determines whether your controls actually work.

Bank-level ID verification means a government-issued ID authenticity check combined with a live selfie matched to the photo on that ID — the same standard a bank uses to open an account remotely. It does not require an SSN. It does not require a credit pull. It confirms the person requesting the code is who they say they are before anyone enters the building.

Here is why the order is everything. A code-first system releases access and then (sometimes) verifies. The gap between those two events is where the "grabbing codes" failure lives. An unverified person receives the code, enters the unit, and your verification step is now forensic, not preventive. You are investigating after the fact, not screening before it.

Verify-first means an unverified person never receives a code at all. The code is the reward for passing the check, not the starting point. LetHub releases the showing code only after ID clears — the controls run in the order that makes them effective, not in the order that is convenient for the software to build.

How do you keep self-showings safe without killing your lead flow?

The managers who shut off self-showings were not wrong to be worried. They were right about the threat and wrong about the fix. The off-switch is a blunt instrument — it stops bad actors by stopping everyone, including the qualified renters who represent your actual revenue.

ID-verified self-showings resolve the conflict. Prospects tour 24/7 at their own convenience. The friction — the ID check, the selfie, the one-time code — lands on anyone who cannot or will not verify. For a legitimate renter, it is a 60-second step that most will recognize from opening a bank account or boarding a flight. For a scammer or squatter relying on anonymity, it is a hard stop.

You do not have to choose between lead flow and safety. You have to choose the right sequence. Verify first, grant access second — and the thing the operators were afraid of cannot happen.

The ICP segment most affected by this conflict is small and mid-size residential operators — SFR portfolios, small multifamily in the 2–50-unit range — who do not have the staff to escort every prospect but also cannot absorb the cost of an eviction or a unit taken out of inventory by a squatter. That is exactly the context where verify-first self-showings move from a nice-to-have to an operational requirement.

Self-showing safety checklist: what to put in place before you turn tours back on

If you are restarting self-showings after a scam or squatter incident — or building the controls before your first one — run through this list before you go on-market.

• Require bank-level ID plus a selfie match before any code is issued — no exceptions for "easy" units
• Release only one-time, time-boxed codes that tie to a verified individual, not a property
• Set codes to auto-expire after the tour window closes — never a static or shared code
• Keep an audit trail of who accessed each unit and when, tied to the verified identity
• Add optional pre-qualification (income, move-date) ahead of the tour to filter time-wasters before you invest the ID check
• Confirm the sequence: verify first, grant access second — never the reverse
• Avoid heavy-handed data collection (unexplained SSN asks, unnecessary credit pulls) that deters good renters without stopping determined bad actors
• Know your state or province's squatter-removal law before you go on-market — CA, FL, and TX run hot in the US; timelines vary significantly by Canadian province
• Confirm your tool ties the code to a verified individual, not just to the listing — a property-level code is a shared code
• Test the full flow as a prospect before you activate — go through the ID step yourself to confirm it is quick and clear for legitimate renters

Can you turn self-showings back on after a squatter or scam incident?

Yes. And the path back is shorter than most managers expect.

The operators who shut off tours did so because they had no control over who received a code. The code was accessible to anyone — a prospect, a scammer, someone the prospect forwarded it to. Remove that anonymity, and the conditions that made a squatter or scam incident possible no longer exist.

Put ID verification in front of the access code, set codes to expire, and keep an audit trail. The "grabbing codes" failure mode cannot recur when no code is released without a verified identity attached to it.

The off-switch was a temporary patch on a sequencing problem. Fix the sequence — verify first, access second — and you can have self-showings running again with tighter controls than you had before the incident.

See how LetHub's ID-verified self-showings release the code only after the renter's identity clears — so you can turn tours back on without the squatters. Book a demo.

Frequently asked questions

What is the safest way to run self-guided tours?

Verify the renter's identity before releasing the lockbox code, and use one-time, time-boxed codes that auto-expire after the tour window. That sequence — verify first, access second — is what prevents the scammer and squatter failures that push managers to shut tours off entirely.

Why do scammers target code-based lockboxes?

Code-first systems release access before verifying identity, so a shared or forwarded code lets anyone walk in. Scammers rely on that gap between when the code is issued and when (or whether) verification happens.

What is bank-level ID verification?

A government-ID authenticity check combined with a live selfie matched to the ID photo — the same identity standard a bank uses to open a remote account. It confirms the person requesting access is who they say they are, without requiring an SSN or a credit pull.

Is rental identity fraud actually rising?

Yes — 70.0% of apartment operators reported identity theft and fraudulent ID documents, and 70.7% reported an overall increase in fraudulent applications over the prior 12 months, according to the NMHC Pulse Survey on Rental Application Fraud and Bad Debt (n=75 operators, fielded Nov 2023–Jan 2024).

How common are rental scams?

The FTC Consumer Sentinel Network logged approximately 65,000 rental scams and roughly $65 million in reported losses from January 2020 through June 2025, with a median loss of $1,000 per victim.

Do I have to collect renters' SSNs to verify them?

No — government-ID document authentication plus a selfie match verifies identity without asking for sensitive financial data. Heavy-handed data collection that prospects do not understand tends to scare off qualified renters without meaningfully deterring fraud.

Can a verified renter still squat?

Tying the code to a verified individual plus an auto-expiring access trail removes the anonymity squatters rely on and gives you a timestamped record of who entered. It does not make squatting impossible, but it eliminates the anonymous-entry failure mode and creates documentation for any removal proceeding.

Will ID verification slow down my leasing?

No — verified prospects tour 24/7 at their convenience; the friction lands on bad actors who cannot or will not verify, not on qualified renters who complete a 60-second check and receive their code immediately.

Does squatter law vary by location?

Yes — removal difficulty and timelines vary significantly by state and province. California, Florida, and Texas came up repeatedly in our calls as markets where operators were most cautious; Canada's rules vary by province. Know your jurisdiction before you go on-market.

Can I turn self-showings back on after a scam incident?

Yes — put ID verification ahead of the code release and the "grabbing codes" failure mode cannot recur. The operators who shut tours off did so because they had no control over who received a code; verify-first restores that control and lets you reopen tours with tighter safeguards than you had before.