200 Units, 50 Vendors, 400 Tenants: How Many of Those Emails Are Real?

A property management firm’s inbox is one of the most trafficked operational surfaces in any small business. You are corresponding with tenants about maintenance requests, with owners about monthly statements, with vendors about invoices, with contractors about turnovers, with insurance companies about claims, with lenders about escrow, and with attorneys about any of a dozen edge cases. Every one of those conversations involves money, schedules, or sensitive information.

You are also a prime target for attackers, because the same volume and velocity that makes property management efficient is the volume and velocity that makes fraudulent email easy to slip in.

The Vendor Impersonation Problem

The most common attack on property management firms is vendor impersonation. The HVAC company you use for half your portfolio sends their monthly invoice batch. Somewhere in that batch, or shortly after, an attacker sends an invoice from a lookalike domain with slightly different wire instructions. The bookkeeper, paying 40 vendor invoices on a Tuesday afternoon, does not notice the one-character difference in the domain.

The payment goes to the wrong account. By the time the real vendor calls about non-payment, the money is gone.

This is not rare. It is the default operational risk profile of any firm managing multiple properties with multiple vendors.

Why This Is Structurally Hard

Property management firms cannot just lock down their inbox. The business requires inbound email from unknown senders every day.

Prospective new tenants. Prospective new owners asking about management. New vendors responding to a request for bids. New contractors reaching out after being referred. New residents in HOA-managed communities sending maintenance requests before they have ever emailed the office. Every day has real, legitimate, previously-unseen email in it.

Aggressive filtering blocks the business. Lax filtering invites the fraud. The traditional solution, train everyone to verify everything, does not survive one busy Friday afternoon at the end of the month when invoices are piling up.

What actually works is a structural change to how unknown senders reach the inbox in the first place.

The Sincerity Test for a Property Operation

Rythm puts a bouncer on your Gmail or Outlook inbox. All of your existing contacts, every vendor you have ever paid, every owner you report to, every tenant you have emailed with, every HOA board member, every attorney, every insurer, is on your guest list automatically. Their email reaches you with zero change.

Unknown senders have two options. Pay a small cover charge you set (about four cents by default), and the message lands in your inbox marked PAID. Skip the payment, and the email waits in a separate folder for your review. One drag from the folder to your inbox both rescues the message and adds the sender to your guest list permanently. Nothing is ever deleted.

For a real new vendor bidding for work, four cents is invisible. For a real prospective owner asking about management services, four cents is invisible. For a real new tenant reaching out by email instead of the portal, four cents is invisible.

For an attacker impersonating a vendor from a lookalike domain? That domain is not on your guest list. It cannot reach the inbox for free. To pay, the attacker burns money on every attempt and leaves a trail. To skip paying, the attacker’s spoofed “updated wire instructions” email arrives flagged as unknown-sender and lands in the review folder, where the context alone makes the fraud obvious.

The filter is binary. Known or unknown. Deterministic, rule-based, not an AI guessing.

Why the Math Works for Property Management

Sending 100,000 emails at Rythm’s default cover charge costs $4,000. Mass vendor-impersonation blasts to property management firms stop working because the attacker’s cost per attempt is nonzero.

The real new vendors, owners, and prospects who do pay four cents to reach you have their payment settle straight to your own Lightning wallet, not to Rythm. We are never in the money path.

What Rythm Is Not

Rythm is email processing software. It is not a cryptocurrency service. It is not a payment processor. It does not replace your accounting software, your property management platform, or your email provider. It connects to Gmail, Google Workspace, Outlook, or Microsoft 365 via OAuth and adds a filter layer at the inbox.

Rythm does not store email content. Scans happen in memory for one thing, a payment proof, and the contents are discarded within milliseconds. Nothing at rest, nothing shared.

Rythm is non-custodial. Cover charge payments move peer-to-peer: sender, to a public mint, to a bearer token in the email, to your own Lightning wallet. Rythm is never in the money path. The $1.65 per month subscription pays for the automation.

Setup That Does Not Disrupt Operations

Twelve minutes, per mailbox. Sign in with Gmail or Outlook. Link a Lightning wallet (Cash App, Strike, Blink, or Primal work; guided wizard included). Set your cover charge. The bouncer is active.

Your existing tools do not change. Your AppFolio, your Buildium, your Yardi, your spreadsheet, your bookkeeper’s workflow, all keep working. Your owners and tenants do not need to do anything. Your vendors do not see anything different, because they are already on your guest list.

If anything ever breaks on Rythm’s end, email delivers normally. Fail-open architecture. You do not miss a maintenance emergency because of a Rythm issue.

The Realistic Case for a Property Firm

Property management will keep attracting invoice-fraud attackers. The economics are too good for them. A single successful fake-vendor invoice at a mid-size firm is tens of thousands of dollars. Running the same play across 500 small property management firms per month is a real business for the attackers.

What changes when you put a bouncer on the inbox is that the cheap, scale-dependent version of the attack stops working. The expensive, targeted version still exists, but it arrives in a context where your own scrutiny is high, not low, because the sender is already flagged as unknown.

One fake-invoice payment can absorb a year of property management fees from a small building. One subscription at $1.65 per mailbox per month changes the math on how many of those invoices ever reach the desk where someone might pay them by mistake.

Your operation is busy by design. Your filter does not have to be.