Landlords Are Demanding Tenants' Workplace Login Details To Verify Their Income (404media.co) 225
An anonymous reader writes: Landlords are using a service that logs into a potential renter's employer systems and scrapes their paystubs and other information en masse, potentially in violation of U.S. hacking laws, according to screenshots of the tool shared with 404 Media.
The screenshots highlight the intrusive methods some landlords use when screening potential tenants, taking information they may not need, or legally be entitled to, to assess a renter.
"This is a statewide consumer-finance abuse that forces renters to surrender payroll and bank logins or face homelessness," one renter who was forced to use the tool and who saw it taking more data than was necessary for their apartment application told 404 Media. 404 Media granted the person anonymity to protect them from retaliation from their landlord or the services used.
[...] "Argyle hijacked my live Workday session, stayed hidden from view, and downloaded every pay stub plus all W-4s back to 2024, each PDF seconds apart," they said. "Workday audit logs show dozens of 'Print' events from two IPs from a MAC which I do not use," they added, referring to a MAC address, a unique identifier assigned to each device on a network.
The screenshots highlight the intrusive methods some landlords use when screening potential tenants, taking information they may not need, or legally be entitled to, to assess a renter.
"This is a statewide consumer-finance abuse that forces renters to surrender payroll and bank logins or face homelessness," one renter who was forced to use the tool and who saw it taking more data than was necessary for their apartment application told 404 Media. 404 Media granted the person anonymity to protect them from retaliation from their landlord or the services used.
[...] "Argyle hijacked my live Workday session, stayed hidden from view, and downloaded every pay stub plus all W-4s back to 2024, each PDF seconds apart," they said. "Workday audit logs show dozens of 'Print' events from two IPs from a MAC which I do not use," they added, referring to a MAC address, a unique identifier assigned to each device on a network.
Under no circumstances (Score:5, Insightful)
Re: (Score:2)
Would I give a landlord, or anyone for that matter, credentials for bank or payroll logins. That's insane.
One description suggests that the user isn't handing over login and password isn't necessary. How would this work with 2FA?
Instead, the user somehow runs an agent that hijack's the user's logged-in session to download the files.
Re: (Score:2, Informative)
Let landlords easily kick out the bums who won't pay and they'll have no reason to try to ensure anyone that they do rent to actually can pay. Outlaw this
Re:Under no circumstances (Score:5, Insightful)
The reason they're doing this is that too many cities have made it effectively impossible to remove a tenant for non-payment of rent or require a lengthy court process.
Your too many is my not enough. Of course it should require a lengthy court process to remove a person from their housing.
Re:Under no circumstances (Score:4, Informative)
You say it's "their housing", but it was only theirs contingent on regular payment. It belongs to the owner.
Re: (Score:2)
That's why I choose not to become a landlord. To me, the obligations and responsibilities that come with owning someone else's home are too great.
If it's too much for you, sell up and get into some other business.
Re: (Score:3)
Re: (Score:3)
Charities cannot provide enough housing. Habitat 4 Humanity (good work) can't build enough houses for the people they're already building houses for, and necessarily produce cheaper/smaller homes. Private enterprise builds housing for every demographic at a scale that charities cannot and government will not match.
I realized something while writing this rep
Re: (Score:3)
Re: (Score:3)
Of course, there have to be laws to make sure tenants aren't being abused, fairness is both important and complicated. But the laws have to protect the people who own the property as well. If a tenant isn't paying their rent, they have broken a contract and are no longer entitled to the benefits they enjoyed.
Re: (Score:3)
Vienna isn't actually better off. Rents appear cheaper, but there are added costs on top of that which cancel out the difference. Like being responsible for maintenance, which in the US is on the landlord. It is not at all what it is cracked up to be - https://www.aei.org/research [aei.org]
Re: (Score:3)
Aren't you just dismissing the citation for being from an expert, just because they work for the AEI? Isn't that an incredibly weak ad-hominem attack?
Re: (Score:3)
What you are describing is not how the system or law works, it is how you wish they were. When you sign a lease, that's a contract to provide housing in exchange for payment. If you break a contract, you don't get to make the other side keep up their end.
The policies you are promoting make worse what you wish to improve
Re: (Score:3)
Re:Under no circumstances (Score:5, Insightful)
If you are 2+ months late on rent, it's not your housing anymore. I never understood this idea that someone can be provably late on rent but still be entitled to string things along with a lengthy eviction process just for the court to state the obvious: if you aren't paying rent, you have no right to use someone else's property as your housing. Fortunately, some jurisdictions have fast-track processes for this kind of scenario. For the other jurisdictions, don't be surprised when the months required as up-front deposit by most landlords become as many as the average duration of the lengthy court process (plus the one month most landlords allow tenants as a courtesy).
Re: (Score:3)
It's literally illegal to use a security deposit as a replacement for lost rent.
Maybe you should stop posting.
Re: (Score:2)
Re:Under no circumstances (Score:5, Insightful)
Because housing is a special case. Without housing, you are homeless, and that's a huge problem for both you and for society. Having lots of homeless people creates problems and cost for everyone else.
That's why civilized places have protections for renters and mortgage payers to make sure that temporary problems like losing your job don't destroy your life and make you a burden on the state. Of course it wouldn't be so bad if people could put away money for a rainy day, but we decided that many jobs should pay barely enough to survive on, and this is the consequence.
Re: (Score:2)
But outside those special circumstances, you can't generally demand to use someone else's property as your housing without conditions attached (such as the obligation to pay rent) because "otherwise you'd be homeless". In general, it's not the obligation of private indiv
Re: (Score:2)
If you are 2+ months late on rent, it's not your housing anymore. I never understood this idea that someone can be provably late on rent but still be entitled to string things along with a lengthy eviction process just for the court to state the obvious: if you aren't paying rent, you have no right to use someone else's property as your housing. Fortunately, some jurisdictions have fast-track processes for this kind of scenario. For the other jurisdictions, don't be surprised when the months required as up-front deposit by most landlords become as many as the average duration of the lengthy court process (plus the one month most landlords allow tenants as a courtesy).
The best part? The vast majority of tenants that can’t pay rent can’t pay the court judgement for rent. They won’t get a job with thousands or tens of thousands in judgements against them because of wage garnishments on paychecks and tax returns. So they take under the table money and never pay their debts and since this isn’t criminal it’s 100% effective in preventing recovery of the money. You can’t get blood from a stone unless you use nanotechnologies and spend fa
Re:Under no circumstances (Score:4)
Oh please, try to verify this experimentally: rent a house, don't pay rent, and see if it's still your housing after the aforementioned lengthy court process (or the fast-track process in jurisdictions that have it).
Literally nobody cares about your opinion. Most importantly, the law doesn't care. What the law cares about is that you agreed to pay someone an X amount of dollars every month so you can use their property as your housing, and you didn't. Just the facts, not my opinion.
Re: (Score:2)
Literally nobody cares about your opinion
I see nobody's modding your comments. Guess what? Literally nobody cares about your opinions.
Re: (Score:2)
Spanish okupas would have a word with you.
Re: (Score:2)
Software developer: If you're making your living by taking advantage of someone else's need for software, you're adding nothing to society. You are, in fact, a parasite.
Tax Preparer: If you're making your living by taking advantage of someone else's need for accounting, you're adding nothing to society. You are, in fact, a parasite.
Day Trad
Re: (Score:3)
Right.
What if you make your living by taking advantage of someone's need for ANYTHING ELSE they need in life?
Food
Clothing
Transportation
Education
ANYTHING?!?!
You're a moron.
Re: (Score:2)
Damned if you do, Damned if you don't (Score:5, Insightful)
if you wont the next tenant probably will.
The problem with this is that, regardless of whether or not it is legal, handing out the account login details for where you work is almost certainly a severe violation of your employment terms and potentially gives a landlord access to much, much more than just your paycheque. If lots of landlords are really doing this (which I do find hard to believe) then it seems your choice is either to risk losing your job or your chances of finding a place to live.
Re:Damned if you do, Damned if you don't (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
If you believe this practice is - or ever will be - that common, you're as retarded as others have said.
Re: (Score:3, Interesting)
says someone is ranting then starts yelling and calling people retarded. are you ok buddy?
laws mean nothing if they are not enforced and yet here they are doing it so fat lot that does folks here
"live in a tent" holy shit no wonder you are ac posting. if i was 56 yo like you i wouldnt put my name opinions a 13 year old would make either
Re: Under no circumstances (Score:5, Insightful)
Re: Under no circumstances (Score:2)
Re: Under no circumstances (Score:3)
Re: (Score:2)
Illegal , this country elected a new York slum lord, that is just hilarious.
Re: (Score:2)
The wheels of justice turn slowly. But at the end, he'll or she'll get $28.19 as their share of the settlement of the class action, sometime in 2033.
Re:Under no circumstances (Score:5, Insightful)
Someone earlier claimed that this violated the federal Computer Fraud and Abuse laws. This seems probable to me. But enforcement is the kicker. If the law isn't enforced, it effectively doesn't exist. (Random enforcement is legitimate (but expensive) grounds for having a case dismissed.
Re: (Score:2)
Re: (Score:2)
That would be considered authorization to access the account under the law.
An employee does not have authority to grant access to the computer system; not even by providing details for their own account. In fact the Terms of Use on such systems specifically forbid the employee from sharing their password. This is exactly the same as a phishing website socially engineering creds out of employees, and the landlords face the same possible criminal consequences.
Re: (Score:3)
(Random enforcement is legitimate (but expensive) grounds for having a case dismissed.
Hi, um excuse me but you seem to have dropped this “)”. I had trouble compiling your argument without it.
Re: (Score:2)
COBOL programmer?
Re: (Score:2)
Get fired for compromising your employer's network (Score:2, Interesting)
Legitimate reply, but you're still propagating the vacuous Subject.
My suggested Subject covers my main thought on the topic. Flip side of that coin is that cyber-crooks should invest their profits in rental properties. Breach those corporate networks from the bottom!
Too bad the police are so sadly behind the power curve. If I needed money, then these days it would be really hard to argue against becoming a cyber-criminal.
But no one else has seen the latest celebrity GAIvatar scam? At least I haven't seen an
Re: (Score:3)
Many landlords are out of state LLCs so good luck with any enforcements.
Re:Under no circumstances (Score:4, Insightful)
They still have assets in the state in question, which means they are very much reachable.
Re: (Score:3)
Re:Under no circumstances (Score:5, Insightful)
Since the action in question is a federal crime, enforcements should not be too difficult.
The feds can get involved in the CFAA violation. The Gaining of access to employer computer systems Unauthorized by the owner/operator of that system is a crime under the CFAA. The employee who works for the company is not able to grant authorization; on the contrary Employees have agreed to a Handbook and Terms of Service which exlicitly specifies that the Passwords chosen for access to employer systems Are the employer's property; only available to the employee for convenience, and the Employee agrees they are responsible for keeping their password details confidential, and forbidden from sharing or disclosing it to others.
Re: Under no circumstances (Score:4, Interesting)
Re: Under no circumstances (Score:3)
Re: (Score:2)
The claim would be it's primarily NIMBY folks who prevent more construction and in more places, leading to landlords having more power and ability to make renters jump through such hoops.
If only it was that simple.
how is a remote site seeing MAC addresses? (Score:3)
MAC addresses don't leave the local network when using TCP/IP. I don't understand this part of the article.
Re: (Score:3)
Re: (Score:3)
What?!
I can only assume you're kidding... otherwise, there's tons of books you should read about the protocols.
Re: (Score:2, Insightful)
It's a 404 Media "story". Odds are it's all coming from something one person said, and whatever blogger wrote the piece doesn't have the wherewithal to vet anything that person said.
Re: (Score:2)
It's a 404 Media "story". Odds are it's all coming from something one person said, and whatever blogger wrote the piece doesn't have the wherewithal to vet anything that person said.
Are you saying he didn’t have the IP of the story at his address?
Re: (Score:2)
Agreed. And when an alleged recitation of facts makes one obviously erroneous claim, the rest become suspect.
Re: (Score:2)
yes it makes me question the entire article
Re: (Score:2)
MAC addresses don't leave the local network when using TCP/IP. I don't understand this part of the article.
Maybe they're using IPv6, where the MAC address can become part of the IP address.
Sharing credentials is grounds for termination (Score:5, Insightful)
Upon a reasonable request, I'll provide copies of paystubs, W2s, bank statements, with account numbers and SSNs redacted...
Re:Sharing credentials is grounds for termination (Score:5, Interesting)
They're going to have your SSN anyway, because they're going to demand a credit check. Virtually all landlords require this now.
On the other hand, as you say, I cannot give those credentials to anyone else without being terminated, and other possible penalties. It would also be illegal for them to access those systems even if I gave them the credentials for multiple reasons, not least simple unauthorized access of a whole bunch of computing devices.
What I would tell the would-be landlord when denying their request: "I am required by law to report your criminal attempt to access my employer's systems" because I am in fact under such a legal obligation. They might well even get a visit from the tax cops for it, because our systems contain PII, PHI, and FTI.
Further proof that capitalism is not meritocratic, as if any more was required.
Re: (Score:2)
How is this upvoted ? Bad information.
Don't give your SSN/SIN to landlords. They don't need it to check credit at all, equifax can do it from your other PII like name, current address, dob, etc. It's only required if you earn revenue and an entity needs to report said revenue for tax purposes, which is not renting from a landlord.
Protect your SSN/SIN guys.
Re: (Score:2)
How is this upvoted ? Bad information.
hahahahahahhahahahaha
Don't give your SSN/SIN to landlords. They don't need it to check credit at all
They do the way they do it.
equifax can do it from your other PII like name, current address, dob, etc.
I don't know how many rental applications you've filled out, but they absolutely will request your SSN for the credit check, and absolutely will deny you if you don't provide it. There is a chance of mistaken identity if you do not provide SSN or a CC #, which you also do not want to provide and which they mostly won't accept instead of a SSN anyway.
Re: (Score:2)
> They do the way they do it.
That's their problem. If my car dealer doesn't need it for a car loan, they sure as fuck don't need it for a rental.
> I don't know how many rental applications you've filled out, but they absolutely will request your SSN for the credit check
I always leave it blank except in cases where I have to report revenue, meaning : my job, my bank, or any Government office that already has access to it.
Your advice is bad, like always.
Re: (Score:2)
Confusion, then disbelief, then they realize you're serious and are making a call...
Or I guess you could just pretend you're looking to rent, instead of completely changing your life. Up to you.
Re:Sharing credentials is grounds for termination (Score:4, Interesting)
This is so unnecessary, I wonder whether this is some kind of social engineering operation being sold as a "service" to landlords.
Re: (Score:2)
And my employer will confirm the relevant data, like my income. Cheerfully. They will not, of course, cough up anything not relevant.
Uhhh (Score:4, Insightful)
My employer clearly states I'm not allowed to share my login details. It's not just against company policy, but because of my access to export controlled information, it's potentially a violation of federal export controls with serious civil penalties for my employer and myself.
Re: (Score:3)
First, I think even asking for such credentials should be illegal.
Having said that, good ol' Merican capitalism will tell you to look elsewhere if you don't like the terms; there are plenty of other places in the world to live.
Re: (Score:2)
What ECI do you or your employer put in your payroll system?
This is atrocious behavior by the landlords, but they want access to pay records, not the employer's IT system. Most employers have outsourced all the payroll handling for decades now, so the payroll systems cannot touch information that is proprietary or export-controlled or whatever else.
Re:Uhhh (Score:5, Insightful)
Maybe his organization uses SSO and his login is his login to everything.
Re: (Score:3)
We use an SSO. So the credentials aren't strictly separate. My workday access is controlled by a Yubikey and my corporate account password. Which explains the very reasonable policy that I should not be sharing any credentials with third parties.
I can login and download W-2s and payroll stubs and share them. That's fine, I do it all the time for taxes, financing mortgages, etc. But landlords don't like that anymore because there are sites that help people generate fake PDFs specifically for working around a
Re: (Score:2)
My God this is legal??? (Score:2)
Doesn't say where this takes place, but thank god that I don't live there.
Re: (Score:2)
That seems like a relevant piece of information.
TFA mentions U.S. hacking laws, but the rest is paywalled. Presumably this is in the US.
I'd live in van down by the river before I'd consent to this.
Re:My God this is legal??? (Score:4, Interesting)
First guess: Florida.
Second guess: Texas.
I would not like to play this game. (Score:5, Informative)
It's complicated (Score:5, Insightful)
Some tenants are good, honest people, some are not
Some landlords are good, honest people, some are not
Good tenants get treated poorly by bad landlords, so they ask government for help. Governments pass strict tenant protection laws.
Bad tenants take advantage of these laws to do all kinds of awful stuff. Landlords use whatever tools they can get to protect themselves
Good tenants often get unfairly hurt
Good landlords often get unfairly hurt
Re: (Score:2)
Re:It's complicated (Score:5, Interesting)
When my grandmother died, he rented out her house. A group of 4 Polish people moved in. He did not know them. They work in Belgium because the pay is better. He helped them out with getting official work permits. Noticed that the employer in Belgium was employing them illegally which meant that they were not covered by our social security system. He made a point of getting them a legal contract. Phoned the company, phoned their legal department. Their employer fired them because of my dad's actions, he got them a new job that payed better and was completely legal. (He was retired by then, he made this his hobby). He has some political connections. Employer's company was paid a visit by the government to check out the work permits.
The other house? Renter had trouble paying because she lost her job. He suspended her rent for a few months until she got employed again.
Whenever inflation kicks in, he gets moody. Do I increase rent yes or no? It is in the contract that he can. Sometimes he does, sometimes he doesn't.
He just likes people and people like him back. This is pretty normal for his generation in my experience. (Early babyboomers)
Re: It's complicated (Score:4, Insightful)
Re: (Score:2)
Your Dad sounds like a good person.
Re: (Score:2)
No. He actually is not. The lack of houses being up for sale, plus the number being rented out just goes to inflate home prices.
Re: (Score:2)
Re: (Score:2)
I did not say kick them out in order to sell it. Disadvantaged people should be allowed to own their residence. It's not like rent-able apartments would go away either.
Re: (Score:2)
If he's renting out the houses, they're not vacant.
Moron.
Re: (Score:2)
Only if you're a bad tenant.
Lots of "404 Media" Links, Don't Want Account (Score:3)
So, there have been a lot of 404 Media articles showing up on Slashdot as of late and they seem to do very interesting journalism, but I'm not going to create yet another account to read an article. Is there a way for Slashdot to share a bit more of the article so we're not all just trying to form opinions and partake in discussions having only read a summary?
Re: (Score:3)
The sign-up is to deter LLM scrapers.
Absolutely get not wanting more spam, and am not trying to tell you how to internet. Just sharing info on why I have signed up with them, when I sign up for almost nothing these days.
Re: (Score:2)
If they're putting out garbage like this, the only thing they're good at is putting out garbage.
Re: (Score:3)
Just paste the url into archive.is and you’ll have an ad free copy in less time it took to write this post.
How Many Landords? What Proportion? (Score:3)
I don't have access to a 404 Media account, so I can't see just how severe of an issue this is. "Landlords are..." is such a vague, clickbait assertion.
I blame Plaid (Score:2, Insightful)
Re: (Score:2)
Compromise for the Funny (Score:2)
No Funny yet, but I think I thought of a funny angle.
So the wannabe tenant can offer to compromise by letting the potential landlord see the pay information while looking over his shoulder after he logs into his company laptop, etc.
New scam of creating fake corporate websites to show your landlord! Everybody's happy!
Well, except for the credit reporting agencies. Trespassing on their scams.
say I'm an 1099'er and I need to bill you an admin (Score:2)
say I'm an 1099'er and I need to bill you an admin fee to look up that info!
what about people who have paystubs not in an syst (Score:2)
what about people who have paystubs not in an system covered by that system?
Hey landlord! (Score:2)
Since you're into crime, how about I blackmail you? I'll take a more reasonable rental rate and in return I won't report you for trying to criminally access a corporate computer system!
Title a bit misleading. (Score:4, Informative)
It's not landlords asking for Credentials, rather they send you an invitation to use Argyle's VOIE services :
https://krebsonsecurity.com/20... [krebsonsecurity.com]
This is the same startup that would pay people 500$ so they could develop payroll integrations. They have multiple integrations running already, and it assumes your company is dumb enough to run payroll right off the public Internet.
Can not legally comply (Score:3)
I don't understand the necessity of this. (Score:3)
Some 20 years ago, my employer had an employment/salary income verification service. There is a similar service running today by my current employer.
I would have to request and employment verification code. Then the landlord, bank, etc. uses this code to request employment information about me. I control the code (I can disable it) and it only provides the minimum information necessary.