Landlords Are Demanding Tenants' Workplace Login Details To Verify Their Income (404media.co)
- Reference: 0179587576
- News link: https://news.slashdot.org/story/25/09/29/1634200/landlords-are-demanding-tenants-workplace-login-details-to-verify-their-income
- Source link: https://www.404media.co/landlords-demand-tenants-workplace-logins-to-scrape-their-paystubs/
> Landlords are using a service that logs into a potential renter's employer systems and [1]scrapes their paystubs and other information en masse , potentially in violation of U.S. hacking laws, according to screenshots of the tool shared with 404 Media.
>
> The screenshots highlight the intrusive methods some landlords use when screening potential tenants, taking information they may not need, or legally be entitled to, to assess a renter.
>
> "This is a statewide consumer-finance abuse that forces renters to surrender payroll and bank logins or face homelessness," one renter who was forced to use the tool and who saw it taking more data than was necessary for their apartment application told 404 Media. 404 Media granted the person anonymity to protect them from retaliation from their landlord or the services used.
>
> [...] "Argyle hijacked my live Workday session, stayed hidden from view, and downloaded every pay stub plus all W-4s back to 2024, each PDF seconds apart," they said. "Workday audit logs show dozens of 'Print' events from two IPs from a MAC which I do not use," they added, referring to a MAC address, a unique identifier assigned to each device on a network.
[1] https://www.404media.co/landlords-demand-tenants-workplace-logins-to-scrape-their-paystubs/
how is a remote site seeing MAC addresses? (Score:3)
MAC addresses don't leave the local network when using TCP/IP. I don't understand this part of the article.
Re: (Score:3)
Maybe there is browser information in the log, and it reflects a Mac, which he doesn't use.
Re: (Score:2, Insightful)
It's a 404 Media "story". Odds are it's all coming from something one person said, and whatever blogger wrote the piece doesn't have the wherewithal to vet anything that person said.
Re: (Score:2)
> It's a 404 Media "story". Odds are it's all coming from something one person said, and whatever blogger wrote the piece doesn't have the wherewithal to vet anything that person said.
Are you saying he didn’t have the IP of the story at his address?
Re: (Score:2)
Agreed. And when an alleged recitation of facts makes one obviously erroneous claim, the rest become suspect.
Re: (Score:2)
yes it makes me question the entire article
Re: (Score:2)
> MAC addresses don't leave the local network when using TCP/IP. I don't understand this part of the article.
Maybe they're using IPv6, where the MAC address can become part of the IP address.
Sharing credentials is grounds for termination (Score:4, Insightful)
Many employers, sharing credentials is grounds for termination....
Upon a reasonable request, I'll provide copies of paystubs, W2s, bank statements, with account numbers and SSNs redacted...
Re:Sharing credentials is grounds for termination (Score:5, Interesting)
They're going to have your SSN anyway, because they're going to demand a credit check. Virtually all landlords require this now.
On the other hand, as you say, I cannot give those credentials to anyone else without being terminated, and other possible penalties. It would also be illegal for them to access those systems even if I gave them the credentials for multiple reasons, not least simple unauthorized access of a whole bunch of computing devices.
What I would tell the would-be landlord when denying their request: "I am required by law to report your criminal attempt to access my employer's systems" because I am in fact under such a legal obligation. They might well even get a visit from the tax cops for it, because our systems contain PII, PHI, and FTI.
Further proof that capitalism is not meritocratic, as if any more was required.
Re: (Score:2)
How is this upvoted ? Bad information.
Don't give your SSN/SIN to landlords. They don't need it to check credit at all, equifax can do it from your other PII like name, current address, dob, etc. It's only required if you earn revenue and an entity needs to report said revenue for tax purposes, which is not renting from a landlord.
Protect your SSN/SIN guys.
Re: (Score:2)
> How is this upvoted ? Bad information.
hahahahahahhahahahaha
> Don't give your SSN/SIN to landlords. They don't need it to check credit at all
They do the way they do it.
> equifax can do it from your other PII like name, current address, dob, etc.
I don't know how many rental applications you've filled out, but they absolutely will request your SSN for the credit check, and absolutely will deny you if you don't provide it. There is a chance of mistaken identity if you do not provide SSN or a CC #, which you also do not want to provide and which they mostly won't accept instead of a SSN anyway.
Re: (Score:2)
> They do the way they do it.
That's their problem. If my car dealer doesn't need it for a car loan, they sure as fuck don't need it for a rental.
> I don't know how many rental applications you've filled out, but they absolutely will request your SSN for the credit check
I always leave it blank except in cases where I have to report revenue, meaning : my job, my bank, or any Government office that already has access to it.
Your advice is bad, like always.
Re: (Score:2)
Hah! Please completely change your life so that you have the opportunity to do that! Also, please film it. I'd really like to see the reaction.
Confusion, then disbelief, then they realize you're serious and are making a call...
Or I guess you could just pretend you're looking to rent, instead of completely changing your life. Up to you.
Re: (Score:3)
This is so unnecessary, I wonder whether this is some kind of social engineering operation being sold as a "service" to landlords.
Re: (Score:2)
And my employer will confirm the relevant data, like my income. Cheerfully. They will not, of course, cough up anything not relevant.
Uhhh (Score:4, Insightful)
My employer clearly states I'm not allowed to share my login details. It's not just against company policy, but because of my access to export controlled information, it's potentially a violation of federal export controls with serious civil penalties for my employer and myself.
Re: (Score:3)
First, I think even asking for such credentials should be illegal.
Having said that, good ol' Merican capitalism will tell you to look elsewhere if you don't like the terms; there are plenty of other places in the world to live.
Re: (Score:2)
What ECI do you or your employer put in your payroll system?
This is atrocious behavior by the landlords, but they want access to pay records, not the employer's IT system. Most employers have outsourced all the payroll handling for decades now, so the payroll systems cannot touch information that is proprietary or export-controlled or whatever else.
Re:Uhhh (Score:5, Insightful)
Maybe his organization uses SSO and his login is his login to everything.
Re: (Score:3)
We use an SSO. So the credentials aren't strictly separate. My workday access is controlled by a Yubikey and my corporate account password. Which explains the very reasonable policy that I should not be sharing any credentials with third parties.
I can login and download W-2s and payroll stubs and share them. That's fine, I do it all the time for taxes, financing mortgages, etc. But landlords don't like that anymore because there are sites that help people generate fake PDFs specifically for working around a
Re: (Score:2)
> Most employers have outsourced all the payroll handling for decades now
Most outsourced companies including majors like ADP work with SSO or federated credentials.
Re: (Score:2)
Oh, but what about your coworkers who never paid attention to that message, or just assume it will be okay since it's a landlord?
My God this is legal??? (Score:2)
Doesn't say where this takes place, but thank god that I don't live there.
Re: (Score:1)
no its clearly not legal and once again there is a 404media article that is absolute junk reporting with zero credible information.
throw 404 in the trash where they belong.
Re: (Score:2)
That seems like a relevant piece of information.
TFA mentions U.S. hacking laws, but the rest is paywalled. Presumably this is in the US.
I'd live in van down by the river before I'd consent to this.
Re: (Score:3)
First guess: Florida.
Second guess: Texas.
Re: (Score:2, Troll)
First guess: San Francisco.
Second guess: NYC
I would not like to play this game. (Score:5, Informative)
Logging in to a computer under someone else's credentials is widely held to be a violation of the US Computer Fraud and Abuse act.
It's complicated (Score:5, Insightful)
Some tenants are good, honest people, some are not
Some landlords are good, honest people, some are not
Good tenants get treated poorly by bad landlords, so they ask government for help. Governments pass strict tenant protection laws.
Bad tenants take advantage of these laws to do all kinds of awful stuff. Landlords use whatever tools they can get to protect themselves
Good tenants often get unfairly hurt
Good landlords often get unfairly hurt
Re: (Score:2)
Yeah, I'm a really bad landlord. I keep letting people stay for free.
Re:It's complicated (Score:5, Interesting)
My dad is a landlord. He (through inheritances) owns 3 houses that he rents out. For one couple he did not increase the rent for decades. They were friends, they also took a bit of care for my grandmother who lived next door.
When my grandmother died, he rented out her house. A group of 4 Polish people moved in. He did not know them. They work in Belgium because the pay is better. He helped them out with getting official work permits. Noticed that the employer in Belgium was employing them illegally which meant that they were not covered by our social security system. He made a point of getting them a legal contract. Phoned the company, phoned their legal department. Their employer fired them because of my dad's actions, he got them a new job that payed better and was completely legal. (He was retired by then, he made this his hobby). He has some political connections. Employer's company was paid a visit by the government to check out the work permits.
The other house? Renter had trouble paying because she lost her job. He suspended her rent for a few months until she got employed again.
Whenever inflation kicks in, he gets moody. Do I increase rent yes or no? It is in the contract that he can. Sometimes he does, sometimes he doesn't.
He just likes people and people like him back. This is pretty normal for his generation in my experience. (Early babyboomers)
Re: It's complicated (Score:4, Insightful)
No. He is offering affordable housing to people who can't buy a house. Haters will hate of course.
Re: (Score:2)
Your Dad sounds like a good person.
Re: (Score:2)
No. He actually is not. The lack of houses being up for sale, plus the number being rented out just goes to inflate home prices.
Re: (Score:2)
putting people on the street just because they can't afford a house is NOT good. Pathetic scum like you would see the most disadvantaged people in the world punished all because of your moronic jealousy of those with more than you.
Re: (Score:2)
I did not say kick them out in order to sell it. Disadvantaged people should be allowed to own their residence. It's not like rent-able apartments would go away either.
Re: (Score:2)
If he's renting out the houses, they're not vacant.
Moron.
Re: (Score:2)
I didn't say they were. I was merely comparing them to the vacant houses. If all the vacant homes, plus the ones being rented (not regular apartments) were forced to go up on the market, housing prices would crash (as they should) and, thus, more people could afford them. Homes are not meant to, nor should they, infinitely increase in value over time. And the only reason they do is artificial scarcity. Owning multiple properties solely for renting them out adds to the artificial scarcity, however, not as ba
Re: (Score:2)
Only if you're a bad tenant.
Just cause they have the potential (Score:1)
Just cause they have the potential to have the money, doesn't mean they will pay the rent or even pay on time.
Lots of "404 Media" Links, Don't Want Account (Score:3)
So, there have been a lot of 404 Media articles showing up on Slashdot as of late and they seem to do very interesting journalism, but I'm not going to create yet another account to read an article. Is there a way for Slashdot to share a bit more of the article so we're not all just trying to form opinions and partake in discussions having only read a summary?
Re: (Score:3)
I'll just throw this out - 404 is one of the good ones. They're reporter-owned, refugees from other news sites. If real reporting is going to survive, it is going to be because of outfits like this.
The sign-up is to deter LLM scrapers.
Absolutely get not wanting more spam, and am not trying to tell you how to internet. Just sharing info on why I have signed up with them, when I sign up for almost nothing these days.
Re: (Score:2)
If they're putting out garbage like this, the only thing they're good at is putting out garbage.
Thank you, drive through (Score:2)
Leaving aside the basic logic failure, I hope getting that off your chest was emotionally satisfying for you.
Re: (Score:3)
Just paste the url into archive.is and you’ll have an ad free copy in less time it took to write this post.
How Many Landords? What Proportion? (Score:2)
I don't have access to a 404 Media account, so I can't see just how severe of an issue this is. "Landlords are..." is such a vague, clickbait assertion.
I blame Plaid (Score:2, Insightful)
That fucking idiotic system where to hook up one bank to another you need to give your login details to some dipshit third party company. That broke the dam for giving away your financial login details "for a good reason. FUCK. THAT. SHIT.
Re: (Score:2)
I've spent years educating users to only use their credentials only on the specific system they are accessing, and never any 3rd party asking for their unrelated credentials. There are even systems like Shibboleth that allow for this sort of thing safely, but Plaid took the most stupid route possible. I'm right there with you...screw Plaid with a chainsaw sideways without any bar lube, and screw the banking industry as a whole for standing by and allowing it.
Compromise for the Funny (Score:2)
No Funny yet, but I think I thought of a funny angle.
So the wannabe tenant can offer to compromise by letting the potential landlord see the pay information while looking over his shoulder after he logs into his company laptop, etc.
New scam of creating fake corporate websites to show your landlord! Everybody's happy!
Well, except for the credit reporting agencies. Trespassing on their scams.
say I'm an 1099'er and I need to bill you an admin (Score:2)
say I'm an 1099'er and I need to bill you an admin fee to look up that info!
what about people who have paystubs not in an syst (Score:2)
what about people who have paystubs not in an system covered by that system?
Hey landlord! (Score:2)
Since you're into crime, how about I blackmail you? I'll take a more reasonable rental rate and in return I won't report you for trying to criminally access a corporate computer system!
Title a bit misleading. (Score:4, Informative)
It's not landlords asking for Credentials, rather they send you an invitation to use Argyle's VOIE services :
[1]https://krebsonsecurity.com/20... [krebsonsecurity.com]
This is the same startup that would pay people 500$ so they could develop payroll integrations. They have multiple integrations running already, and it assumes your company is dumb enough to run payroll right off the public Internet.
[1] https://krebsonsecurity.com/2021/05/fintech-startup-offers-500-for-payroll-passwords/
Can not legally comply (Score:2)
It is against State Law here in Texas for me to give access to a State-governed resource, in this case, my Workday account. I could be fired, or even criminally prosecuted for giving out my credentials.
Standard API (Score:2)
I went through a similar thing when applying for a loan - the mortgage broker wanted me to give my bank login details to a third party info gathering company. Naturally I refused on the grounds that that would be insane. Luckily they were able to complete the application using bank statements I manually exported instead, but it did make me wonder - if this is an industry-wide problem, why don't the banks just get together and define a common API to allow me as the account holder to authorise limited access
I don't understand the necessity of this. (Score:2)
Some 20 years ago, my employer had an employment/salary income verification service. There is a similar service running today by my current employer.
I would have to request and employment verification code. Then the landlord, bank, etc. uses this code to request employment information about me. I control the code (I can disable it) and it only provides the minimum information necessary.
Under no circumstances (Score:5, Insightful)
Would I give a landlord, or anyone for that matter, credentials for bank or payroll logins. That's insane.
Re: (Score:1)
welcome to end-stage capitalism
Re: (Score:2)
> Would I give a landlord, or anyone for that matter, credentials for bank or payroll logins. That's insane.
One description suggests that the user isn't handing over login and password isn't necessary. How would this work with 2FA?
Instead, the user somehow runs an agent that hijack's the user's logged-in session to download the files.
Re: (Score:1)
no. you are retarded. this is illegal and will not stand. live in a tent before you give out your LOGIN INFORMATION. are you that retarded? or you just wanted to go on a rant?
Re: (Score:2)
says someone is ranting then starts yelling and calling people retarded. are you ok buddy?
laws mean nothing if they are not enforced and yet here they are doing it so fat lot that does folks here
"live in a tent" holy shit no wonder you are ac posting. if i was 56 yo like you i wouldnt put my name opinions a 13 year old would make either
Re: Under no circumstances (Score:5, Insightful)
My employer, and many others, could justifiably fire my for giving out my credentials to some third party.
Re: Under no circumstances (Score:2)
This was my first thought.
Re: (Score:1)
Illegal , this country elected a new York slum lord, that is just hilarious.
Re: (Score:2)
The wheels of justice turn slowly. But at the end, he'll or she'll get $28.19 as their share of the settlement of the class action, sometime in 2033.
Re:Under no circumstances (Score:5, Insightful)
Someone earlier claimed that this violated the federal Computer Fraud and Abuse laws. This seems probable to me. But enforcement is the kicker. If the law isn't enforced, it effectively doesn't exist. (Random enforcement is legitimate (but expensive) grounds for having a case dismissed.
Re: (Score:2)
I don't think it would violate the Act if the person voluntarily handed over the password. That would be considered authorization to access the account under the law.
Re: (Score:2)
That would be considered authorization to access the account under the law.
An employee does not have authority to grant access to the computer system; not even by providing details for their own account. In fact the Terms of Use on such systems specifically forbid the employee from sharing their password. This is exactly the same as a phishing website socially engineering creds out of employees, and the landlords face the same possible criminal consequences.
Re: (Score:3)
> (Random enforcement is legitimate (but expensive) grounds for having a case dismissed.
Hi, um excuse me but you seem to have dropped this “)”. I had trouble compiling your argument without it.
Re: (Score:2)
COBOL programmer?
Re: (Score:2)
COBOL PTSD. It’s for life.
Get fired for compromising your employer's network (Score:2, Interesting)
Legitimate reply, but you're still propagating the vacuous Subject.
My suggested Subject covers my main thought on the topic. Flip side of that coin is that cyber-crooks should invest their profits in rental properties. Breach those corporate networks from the bottom!
Too bad the police are so sadly behind the power curve. If I needed money, then these days it would be really hard to argue against becoming a cyber-criminal.
But no one else has seen the latest celebrity GAIvatar scam? At least I haven't seen an
Re: (Score:2)
Many landlords are out of state LLCs so good luck with any enforcements.
Re: (Score:3)
They still have assets in the state in question, which means they are very much reachable.
Re: (Score:2)
Illegal activity can unmask even a Delaware LLC. They'll probably rather walk a straight line than risk being exposed.
Re: (Score:2)
Since the action in question is a federal crime, enforcements should not be too difficult.
The feds can get involved in the CFAA violation. The Gaining of access to employer computer systems Unauthorized by the owner/operator of that system is a crime under the CFAA. The employee who works for the company is not able to grant authorization; on the contrary Employees have agreed to a Handbook and Terms of Service which exlicitly specifies that the Passwords chosen for access to employer systems Are the
Re: Under no circumstances (Score:2)
I bet your employer has lawyers, and won't enjoy this intrusion into their systems.
Re: (Score:2, Informative)
The reason they're doing this is that too many cities have made it effectively impossible to remove a tenant for non-payment of rent or require a lengthy court process. The inevitable outcome is that landlords will look for a way of ensuring that any tenants they do accept can pay. Anyone who can't isn't merry lost revenue, but an actual costly expense.
Let landlords easily kick out the bums who won't pay and they'll have no reason to try to ensure anyone that they do rent to actually can pay. Outlaw this
Re:Under no circumstances (Score:5, Insightful)
> The reason they're doing this is that too many cities have made it effectively impossible to remove a tenant for non-payment of rent or require a lengthy court process.
Your too many is my not enough. Of course it should require a lengthy court process to remove a person from their housing.
Re: (Score:2, Informative)
Why? Consider it from the other side for a moment. How would you feel if someone signed a contract with you to pay for the use of your stuff, then didn't pay but kept using your stuff?
You say it's "their housing", but it was only theirs contingent on regular payment. It belongs to the owner.
Re: (Score:2)
That's why I choose not to become a landlord. To me, the obligations and responsibilities that come with owning someone else's home are too great.
If it's too much for you, sell up and get into some other business.
Re: (Score:2)
You say it's "their housing", but it was only theirs contingent on regular payment. It belongs to the owner.
The thing is their rental is not "contingent" on regular payment. They are bound by contract to make a regular payment and compensate their landlord, but it is a civil obligation, and if the tenant fails in their obligation - they do not automatically and instantly lose basic human rights, such as the right to their home. The right to their home and to occupy is separate from and superior to the p
Re: (Score:3, Insightful)
> Of course it should require a lengthy court process to remove a person from their housing.
If you are 2+ months late on rent, it's not your housing anymore. I never understood this idea that someone can be provably late on rent but still be entitled to string things along with a lengthy eviction process just for the court to state the obvious: if you aren't paying rent, you have no right to use someone else's property as your housing. Fortunately, some jurisdictions have fast-track processes for this kind o
Re: (Score:3)
It's literally illegal to use a security deposit as a replacement for lost rent.
Maybe you should stop posting.
Re: (Score:2)
It's not a security deposit, it's months paid in advance.
Re: (Score:3)
Because housing is a special case. Without housing, you are homeless, and that's a huge problem for both you and for society. Having lots of homeless people creates problems and cost for everyone else.
That's why civilized places have protections for renters and mortgage payers to make sure that temporary problems like losing your job don't destroy your life and make you a burden on the state. Of course it wouldn't be so bad if people could put away money for a rainy day, but we decided that many jobs should
Re: (Score:2)
Yes, the fast-track process (where it exists) takes these specific circumstances into account and gives the landlord a "yes" or "no" answer to the question of whether the tenant should be evicted without requiring a lengthy court process.
But outside those special circumstances, you can't generally demand to use someone else's property as your housing without conditions attached (such as the obligation to pay rent) because "otherwise you'd be homeless". In general, it's not the obligation of private indiv
Re: (Score:2)
>> Of course it should require a lengthy court process to remove a person from their housing.
> If you are 2+ months late on rent, it's not your housing anymore. I never understood this idea that someone can be provably late on rent but still be entitled to string things along with a lengthy eviction process just for the court to state the obvious: if you aren't paying rent, you have no right to use someone else's property as your housing. Fortunately, some jurisdictions have fast-track processes for this kind of scenario. For the other jurisdictions, don't be surprised when the months required as up-front deposit by most landlords become as many as the average duration of the lengthy court process (plus the one month most landlords allow tenants as a courtesy).
The best part? The vast majority of tenants that can’t pay rent can’t pay the court judgement for rent. They won’t get a job with thousands or tens of thousands in judgements against them because of wage garnishments on paychecks and tax returns. So they take under the table money and never pay their debts and since this isn’t criminal it’s 100% effective in preventing recovery of the money. You can’t get blood from a stone unless you use nanotechnologies and spend fa
Re: (Score:2)
> If you have nowhere else to live, and you're living there, yes it is.
Oh please, try to verify this experimentally: rent a house, don't pay rent, and see if it's still your housing after the aforementioned lengthy court process (or the fast-track process in jurisdictions that have it).
> If you're making your living by taking advantage of someone else's need for housing, you're adding nothing to society. You are, in fact, a parasite.
Literally nobody cares about your opinion. Most importantly, the law doesn't
Re: (Score:3)
> Literally nobody cares about your opinion
I see nobody's modding your comments. Guess what? Literally nobody cares about your opinions.
Re: (Score:2)
Spanish okupas would have a word with you.
Re: (Score:2)
From Wikipedia: "As of 2017, it took on average eight months for owners to regain properties from squatters." So yes, there is a court process to evict squatters in Spain. Of course, when squatting on public space or government-owned space, it's up to the government to initiate legal proceedings against the squatters. But if you think private individuals let squatters stay in their properties, oh dear, that's not how it works.
Re: (Score:2)
Right.
What if you make your living by taking advantage of someone's need for ANYTHING ELSE they need in life?
Food
Clothing
Transportation
Education
ANYTHING?!?!
You're a moron.
Re: (Score:2)
When the result is rental housing is significantly harder to find, and harder to get into, is that worth it?
Re: (Score:2)
the reason they're doing this is that too many cities have made it effectively impossible to remove a tenant
This is not a solution to that problem. The solution for verifying income is to have tenants furnish proof -- nothing more than that necessary. If the tenant is a wage worker, then showing Pay stub issued within the past 2 weeks and the pay stub before that one should be enough.
Non-paying tenants are typically tenants who either A. do HAVE the income to afford their rent, and simply have other pro
Damned if you do, Damned if you don't (Score:5, Insightful)
> if you wont the next tenant probably will.
The problem with this is that, regardless of whether or not it is legal, handing out the account login details for where you work is almost certainly a severe violation of your employment terms and potentially gives a landlord access to much, much more than just your paycheque. If lots of landlords are really doing this (which I do find hard to believe) then it seems your choice is either to risk losing your job or your chances of finding a place to live.
Re: (Score:2)
This, again. Your employer won't be very happy if they learned that you gave your login details to someone who simply had a house to rent (or sub-rent). Imagine if scammers start renting apartments and then sub-renting them so they can siphon off those sweet login details. I would try to get the landlord's demand for login details in writing and publicly call them out, maybe lawyer up if needed.
Re: (Score:2)
This is like cash payment apps demanding your most sensitive banking passwords to “verify” you to even create an account even though there is no need to whatsoever. The number of other systems demanding access to vital credentials should always be zero.
Re: (Score:2)
If you believe this practice is - or ever will be - that common, you're as retarded as others have said.
Re: (Score:2)
> What does nimbyism have to do with anything here?
The claim would be it's primarily NIMBY folks who prevent more construction and in more places, leading to landlords having more power and ability to make renters jump through such hoops.
If only it was that simple.