Why our application folder is the secure choice for apartment seekers

Lukas Draheim · Real estate expert at rentcard

Published October 29, 2024 · Updated October 29, 2024

7 min read

You just found an apartment listing that sounds perfect. The landlord replies promptly and asks you to email your ID and last three payslips. That moment is exactly what professional fraudsters are waiting for. What happens to your data after that is entirely out of your hands.

Paul was apartment hunting in Frankfurt in early 2024 via ImmoScout24. He found a listing: 72 square metres in Sachsenhausen for 820 euros cold rent. Suspiciously cheap for the area, but the landlord explained it by a job move abroad and a desire to find a reliable tenant quickly. Paul sent his ID, last three payslips, and a credit report on request. Three days later the listing disappeared, the landlord was unreachable, and two weeks later Paul received a debt collection letter for a mobile contract he had never signed.

Paul's case is not unusual. Tens of thousands of fake listings are reported on Kleinanzeigen, ImmoScout24, and other portals every year. The scams follow a recognisable pattern you should know.

The four most common fraud tactics

Copy-paste listings: Fraudsters copy genuine listings from other platforms or from land registry records, set the rent 20 to 30 percent below market rate, and post them on a different portal. The address exists, the photos are real, but the landlord has no authority over the apartment. A cross-check on Google Maps will show you whether the building actually looks like the photos.

The "landlord abroad" story: The supposed owner is temporarily in England or the USA for work and cannot offer a viewing. They ask you to send documents in advance, promise to post a key, and often request a "reservation fee" or deposit by bank transfer or Western Union. Legitimate landlords do not take a deposit before you have viewed the apartment and signed a lease.

Phantom viewings: There is actually a viewing. The applicant is invited into an apartment, asked to fill in a form, or has their ID "quickly photographed for the records". The apartment exists; the "landlord" is part of an organised group systematically collecting IDs and personal data.

Advance payment fraud: Cheap apartment, supposed landlord insists on payment of the first month or a "protection fee" before issuing the lease. Once the payment arrives, contact stops.

A scan of your German ID card contains everything a fraudster needs: full name, date of birth, place of birth, home address, and document number. With this data, online accounts at Klarna, PayPal, or numerous banks can be opened within minutes in Germany, prepaid mobile contracts signed, or goods ordered on invoice in your name.

The email itself is the problem: once you send the attachment, your ID copy sits on the recipient's mail server, possibly in an unencrypted inbox, on servers outside the EU, in automated backups retained for years. You have no way to ever delete it.

Payslips are no less sensitive: they contain your tax ID number, your employer's name, your exact net income, and your IBAN. A fraudster who had Paul's payslip was able to impersonate him to his employer and request a change of bank details. The next salary payment landed in a stranger's account.

Your GDPR rights when dealing with landlords

Article 5 of the GDPR establishes the principle of purpose limitation: personal data may only be processed for the specific purpose for which it was collected. A landlord may use your documents solely to assess whether you are a suitable tenant. They may not sell them, use them for other purposes, or retain them longer than necessary for the decision.

In practice, this right helps you only so much once data is already in the wrong hands. The more effective protection is to never send original documents by email in the first place, so the right cannot be violated at all.

The decisive difference from an email is what the landlord actually sees. When you share an application via rentcard, the landlord receives a time-limited link to a verification report. They can see that your identity has been confirmed, that your income evidence has been checked, and what your CRIF score says. They see no scans, no PDFs, no original files.

Your data never leaves rentcard servers

Uploaded documents and verified data remain stored on rentcard servers within the European Union. What a landlord retrieves via the shared link is a structured summary of your verification status, not a copy of your original documents. Even if the link falls into the wrong hands, nobody can use it to download your ID card.

You can revoke any shared link at any time. If you no longer want a landlord to be able to view your folder after a rejection, you withdraw access with one click. That is not possible with an email.

The CRIF identity check replaces the ID copy

Via rentcard you can have your identity verified by CRIF. This checks that you are who you claim to be and that your CRIF score shows no concerning entries. The result is stored as a verification status in your folder. Landlords receive the information they need without you ever having to send an ID scan.

This solution is actually more valuable to landlords than an ID copy: a scan can be forged; a CRIF result retrieved directly via the official interface cannot. More on what goes into a CRIF score is covered in the Ratgeber article on income proof for rental applications.

Verified application folder

Your secure digital application folder

• Verified identity document
• Income verified via Open Banking
• Tenant self-disclosure included
• Create once, share anywhere

19,99 €

One-time · unlimited use

Buy now →Learn more

Deckblatt1 / 6

Deckblatt

Übersicht aller enthaltenen Dokumente auf einen Blick

A listing becomes suspicious when several of the following features apply at the same time. One alone does not necessarily indicate fraud, but three or more is a clear warning signal.

Price is the strongest signal

In Munich the average asking price for a two-room apartment in 2025 is around 20 to 23 euros per square metre cold. In Frankfurt it is around 17 to 19 euros, in Hamburg around 16 to 18 euros. If a listing is 25 percent or more below these figures while offering a central location, that is a strong warning signal. Fraudsters deliberately price listings attractively so you react quickly and have no time for checks.

You can research the land registry status of a property in some German states via the respective Grundbuchamt portal online. In Bavaria this works through the BALG portal. In NRW there is the Grundbucheinsichtsportal. It costs a few euros but can confirm who an apartment actually belongs to before you send any documents.

If you have realised a listing was fraudulent and you have already sent documents, every hour counts. You should take the following steps immediately and in this order.

File a police report, ideally online via your state's portal or directly at the nearest station. Include all documents you sent, the email addresses, and the link to the listing. A report protects you later when claims arrive in your name.

Inform your bank immediately that your ID details may have been compromised. Banks can set up account monitoring when there is reasonable suspicion of identity misuse. If your IBAN became known, have your account frozen and a new one opened.

Report the listing on the platform where you found it. ImmoScout24, Kleinanzeigen, Immowelt, WG-Gesucht, ohne-makler, and Wohnglück all have dedicated channels for reporting fraudulent listings that lead to a swift removal.

Ask CRIF to set up identity monitoring. CRIF offers a service that notifies you as soon as new entries are made against your identity. It costs a few euros per month and gives you early warning before claims permanently affect your CRIF score.

If you want to learn about building a complete application folder, the bewerbermappe-erstellen guide covers all the documents landlords actually request in detail.