How to spot fraudulent real estate inquiries via WhatsApp and messaging services

1. The property market and fraud networks
2. Messenger services as the preferred channel
3. Warning signs of fraudulent messages
4. First contact via messenger: how to respond
5. Plausibility checks with AI

1. Trust as a target: the property market and fraud networks

The property market has long been a key field of operation for organised fraud networks. Where high-value assets, personal data and emotional investment converge, strong incentives arise for a wide range of fraudulent schemes.

Fraudsters construct convincingly detailed identities, complete with matching websites, company profiles and a full technical infrastructure. Once one profile is compromised, the next is ready to use immediately.

Their interest is by no means limited to high-end properties. They actively target listings where owners have heightened emotional or financial expectations, as is often the case with longer marketing periods or properties requiring substantial restoration. They deliberately cultivate hope, relying on familiar narratives such as the supposedly wealthy foreign buyer who wants to arrange a viewing quickly and purchase without negotiation.

For criminal networks, this approach is economically attractive. From a large volume of standardised enquiries, only a small number need to result in a successful fraud for the effort to be worthwhile.

Although many of these schemes are well documented, fraudsters continue to build trust and draw sellers or agents into extended exchanges. The goal is to obtain money, confidential information or personal documents. Once damage has occurred, the scope for tracing the perpetrators or seeking legal redress is often limited.

A globally visible portal with a highly specific offer remains a potential target for unwanted contact, despite continuously updated security measures.

For enquiries received through our platform, automated security mechanisms can help identify and filter suspicious contacts before they reach you. The situation is different with messaging services: once a publicly accessible phone number is used for direct contact, communication takes place entirely outside the portal's sphere of influence. At that point, screening or filtering the content of messages is technically no longer possible.

2. Messaging services as the preferred channel

Messaging services are now part of everyday communication and are widely used in professional contexts worldwide. Their reach, the ease of creating accounts and the possibility of anonymous contact make them attractive tools for fraudulent activity. Disposable numbers and prepaid SIM cards are cheaply available in many countries.

Among messaging services, WhatsApp in particular is a primary focus. Fraudsters attempt to collect phone numbers from publicly accessible sources by analysing websites or using technical methods to extract contact information that was originally intended only for specific user interactions.

Security mechanisms can make this automated collection more difficult, but they cannot prevent it entirely once a phone number is part of a public listing.

The collected numbers are then used for mass, generic outreach. As soon as platform operators block such accounts, fraudsters can replace them with new numbers and continue their activities with little interruption.

Private sellers are more frequently targeted, as fraudsters assume they may be more receptive to promises of a quick sale and less familiar with professional fraud schemes. Larger agencies with trained staff are not immune either.

3. Concrete experience: warning signs of fraudulent enquiries

Many genuine buyers now use messaging services for initial contact. An enquiry via a messenger is therefore not unusual in itself. However, if one or more of the following indicators are present, heightened caution is warranted.

Message content: generic enquiries

This is one of the most common characteristics of suspicious enquiries received without any reference to a specific listing. It often indicates that a phone number was obtained independently of the actual listing.

When a WhatsApp contact is initiated directly through REALPORTICO, the message automatically contains a reference to the relevant property and listing page. If this connection is entirely absent, the enquiry should be examined critically. Generic messages typically read along the lines of:

A credible enquiry will normally contain a specific reference to the property and mention individual features or details from the listing. The more general and interchangeable a message is, the more critically it should be assessed.

Language patterns: impersonal communication

Automated translation is improving rapidly, which means spelling and grammar errors are becoming less reliable as standalone indicators. Linguistic and stylistic irregularities remain important signals, however.

Suspicious enquiries often feel interchangeable and lack any personal connection to the property in question. Typical features include overly polished but content-free phrasing, missing salutations, formulaic greetings and a distinctly template-like quality.

Sellers have also reported sudden language switches during messenger calls, shifting from the local language to English, apparently intended to suggest an internationally significant buyer.

That said, linguistic irregularities alone should not immediately imply fraudulent intent. Genuine foreign buyers also use translation tools to communicate in the seller's language.

Purchase intent: artificial urgency

A classic pattern and one of the most common formulations found in fraudulent enquiries. In a specialist segment, a genuine buyer rarely has reason to demand a quick purchase decision or to act under time pressure.

Property value: WhatsApp first contact for high-end listings

With high-value listings, the risk of an initial WhatsApp contact lacking a legitimate basis may be higher. If you respond, tie the further conversation to verifiable information and concrete steps as early as possible.

Messenger profile: account age

Some messaging services, including WhatsApp, may display information about when an account was registered. Where this information is available, it is worth checking. An account created only days or weeks earlier, particularly in combination with other irregularities, may indicate a disposable account set up for short-term use.

Messenger profile: generic company names

Check whether the enquiry comes from a business account. Fraudsters deliberately use certain buzzwords to create an impression of credibility and financial standing. Do not be impressed by names such as:

• Family Office
• Invest / Investments
• International Capital
• Private Wealth
• Holdings

Messenger profile: prestigious business addresses

Alongside impressive-sounding company names, well-known business addresses in financial centres are used to suggest a larger or more established business presence. A supposedly prestigious address is not evidence of an actual business presence or relationship.

Messenger profile: logos and profile images

Logos are designed to create an impression of credibility and can now be created or adapted with minimal effort. They are therefore not reliable proof of a company's identity.

AI-generated content: a polished appearance with no substance behind it

The same applies to profile or background images showing individuals in luxury settings or apparently professional situations. Such images may have been copied, manipulated or generated using artificial intelligence and are therefore equally unreliable as evidence of identity or financial standing.

Messenger profile: impersonation of real companies

Existing companies can also be faked or impersonated for fraudulent purposes. Logos, photographs, names of directors, addresses and company names may be copied or used in altered form.

Direct contact with the genuine company through official channels will typically reveal that nobody there is aware of the enquiry or the supposed employee.

Messenger profile: links to social media profiles

Linked profiles on platforms such as Instagram, TikTok or LinkedIn, featuring staged images of luxury vehicles, properties and other high-value goods, are widespread.

Feeds can be populated using generative AI or unlawfully obtained images to project a successful lifestyle. Follower counts and engagement can be purchased cheaply or artificially inflated.

Do not be misled by such profiles. They say nothing about a person's identity or financial capacity. It is often impossible for outsiders to determine whether a profile is genuine or an automated fake.

Messenger profile: websites

Linked websites from unknown contacts should not be opened without scrutiny. While a suspicious enquiry does not necessarily lead to a harmful website, fraudsters may use such sites to simulate the existence of a legitimate business.

Domains incorporating terms such as invest, capital or similar designations are deliberately chosen to project financial strength.

A technique known in information security as typosquatting involves creating websites whose company or domain names closely resemble those of legitimate organisations. Individual letters may be changed or transposed, or additional words appended. For example:

• legitimate company: examplecapital.com
• fraudulent variant: examp1ecapital.com or examplecapital-invest.com

At first glance, such an address can appear familiar while actually leading to a potentially fraudulent site.

Phone number: Swiss or international country codes

Swiss buyers are considered an attractive target group for many property listings. Country codes such as +41 may therefore be deliberately used by fraudsters to suggest financial strength or credibility.

Virtual phone numbers, prepaid cards and international SIM cards are readily available, however. A displayed country code alone provides no reliable indication of the actual location or identity of a contact.

Third-party contact: enquiries on behalf of others

Enquiries made on behalf of others are not in themselves a cause for concern. It is entirely common for wealth managers, advisors or buying agents to act for clients. Where the contact is traceable and transparent, this is generally unproblematic. With unknown contacts, however, the risk of fraudulent or irrelevant enquiries increases.

Requests: advance payments and fees

If fees, processing costs or other payments are requested in connection with a supposed purchase, for document reviews, transfers or alleged reservations, this is a clear warning sign.

Fraudsters frequently use forged documentation to make such demands appear credible. Requests of this kind from unknown individuals or companies are not customary in property transactions and should not be complied with under any circumstances.

Transactions: exchange offers

Genuine exchange offers are uncommon in property transactions but not unheard of. The situation becomes problematic when the offered consideration is difficult to verify or could be used to obscure unclear financial flows.

Without reliable proof of identity, substantive documentation and a traceable valuation of the proposed consideration, such offers should not be pursued. This applies in particular to assets such as yachts, cryptocurrencies, gold or company interests.

A property exchange, for example a castle offered in exchange for a comparable apartment in a specific location or another clearly assessable property, can be more plausible. Even then, careful due diligence and substantive documentation should be requested.

Requests: travel to sign contracts or receive money

Such requests arise regularly. Fraudsters typically develop a seemingly plausible narrative intended to persuade the seller to travel abroad or to a specific meeting point.

A property sale provides no legitimate reason to sign contracts at a location specified by the buyer or outside standard legal procedures. The proposed meeting point typically serves only as a pretext to build trust or place the seller in an unfamiliar environment.

If such requests additionally involve cash handovers, advance payments, unusual document reviews or short-notice travel arrangements, suspicion of fraud is significantly reinforced.

4. First contact via messenger: how to respond

If the sender's intentions remain unclear and you wish to reply, follow these guidelines:

Ask specific questions

Ask for concrete details about the property, or how the person became aware of the listing and through which platform. A genuine buyer should be able to answer these questions immediately. Responses such as "I can't remember" or evasive answers may indicate that the enquiry was not made individually.

Do not send confidential documents

Make clear early on that you will not share sensitive documents without verifiable proof of identity or financial capacity.

Scrutinize documentation

If in doubt, request proof of identity. Bear in mind that identity documents can be forged or stolen and that their authenticity cannot reliably be verified by private individuals.

Police or civil registration offices do not generally carry out preventive identity checks for private transactions. Leave legally binding verification of the parties to a purchase contract to the notary, or use established identity verification procedures, such as the eID function of a national identity card or comparable services, if doubts persist.

When in doubt, wait

With unclear enquiries, it can be appropriate not to block the contact immediately but to wait. A genuinely interested buyer will typically follow up or use an official channel if their interest is genuine.

Trust your instincts

Many sellers notice inconsistencies in the first exchange or in the overall tone of the communication. Trust these perceptions. If uncertainty remains, use the AI-based plausibility check described in the following section.

End the communication decisively

If inconsistencies emerge or the situation becomes unusual, end the communication immediately. Block and report the phone number or account directly within the messaging service, and contact the relevant authorities if you have concrete grounds to suspect fraud.

5. Plausibility checks with AI (e.g. Google Gemini)

Targeted research is one of the most practical applications of artificial intelligence. Rather than manually entering names, addresses or company names into search engines and painstakingly cross-referencing the results, AI services can be used for an initial plausibility assessment. With direct access to Google's web index, Gemini provides a solid foundation for evaluating websites quickly. Using targeted prompts, several aspects relevant to an assessment can be consolidated into a single query.

Example prompt for your research

Extract from a Gemini research session

Do not rely on the output uncritically. An AI-based initial assessment does not replace legal or commercial due diligence. Where doubts already exist, however, it can provide additional indicators or help identify patterns that warrant closer scrutiny.

One particularly useful factor in this type of research is the age of the domain registration. A new domain alone says little; what matters is the context of the enquiry and the site content. A domain registered only days or weeks ago, while the website simultaneously claims years of experience, international references or extensive business activities, can be a strong indicator of a disposable site created for a short-term fraud attempt.