How HOA Payment Fraud Actually Happens
HOA payment fraud is one of the most common and most preventable financial problems community associations face. It rarely looks like fraud when it is happening. It does not announce itself. It does not show up as a dramatic missing balance or an obvious red flag in the monthly report. It tends to look, at first glance, like normal business activity. A vendor invoice. A routine payment. A line item that matches something the community actually does.
That is exactly what makes HOA payment fraud so hard to catch and so easy to miss for months, sometimes longer.
How It Actually Starts
The pattern behind most HOA embezzlement cases is almost always the same. One person has too much control over too many parts of the payment process. They can create a vendor, approve an invoice, issue a check, and reconcile the bank account, sometimes all without anyone else reviewing what they have done.
In that environment, fraud does not require elaborate planning. It requires patience and access. A vendor that does not exist. An invoice that looks legitimate. A check made out to an account the board has never seen. Repeated over time, in amounts small enough not to trigger immediate concern, the losses accumulate before anyone connects the pattern.
Francisco Gomez, board president of Doral Gardens HOA in Florida, knows this firsthand. His community’s property manager stole $168,000 before the board discovered what had happened. The association had to issue a special assessment just to recapitalize. “We had a fraud and our property manager stole $168,000,” Francisco says. “We had to re-issue a special assessment to recapitalize the HOA.”
Why the Standard Setup Creates Risk
The reason HOA payment fraud is so common in community associations is structural. In the typical bundled management model, one company or one person handles the accounting, the vendor relationships, the payment approvals, and the bank reconciliation. That concentration of control is the vulnerability.
When the person who can authorize payments is also the one keeping the books, there is no independent check on what they are doing. Errors go uncorrected. Irregularities go unnoticed. And deliberate fraud can continue for as long as the person wants it to, as long as no one outside that circle is reviewing the work.
Early in my career, I encountered boards that had been working with a management company that did not provide bank statements with their financial reports and did not include bank reconciliation reports in the monthly packet. Some of those communities lost money that was stolen from them because of it. The fraud was invisible precisely because no one was checking whether what the financial reports showed matched what was actually in the bank.
According to the Association of Certified Fraud Examiners, organizations that lack basic internal controls suffer significantly larger fraud losses and take longer to detect them than those with controls in place.
The Threat From Outside: Vendor Email Fraud and Business Email Compromise
Internal fraud is not the only risk. October is Cybersecurity Awareness Month, and it is worth naming a threat that is hitting community associations with increasing frequency: Business Email Compromise, a type of cyber fraud where a criminal intercepts or spoofs email communications to redirect payments to a fraudulent account.
Here is how it works in an HOA context. A fraudster monitors or spoofs email communications between your association and a vendor. At the right moment, they send an email that appears to come from the vendor, often with a convincing domain name and familiar formatting, notifying you that their bank account details have changed and asking you to update your records before the next payment. The board or management company updates the payment information. The next invoice gets paid directly to the fraudster’s account. By the time anyone realizes what happened, the money is gone.
According to the FBI’s Internet Crime Complaint Center, Business Email Compromise is one of the costliest forms of cybercrime, with losses exceeding $2.9 billion reported in 2023 alone. Community associations are not immune, and the typical HOA accounting setup, where one person handles payments with limited oversight, makes them particularly vulnerable to this type of vendor email fraud.
The defense is straightforward: callback verification. Before updating any vendor banking information, call the vendor directly using a phone number from your existing records, not the number provided in the email requesting the change. Verify the change verbally with someone you know at that company. This one step stops the vast majority of Business Email Compromise fraud before any money moves.
The Controls That Actually Work
Whether the threat is internal HOA embezzlement or external vendor email fraud, the same principles apply. A few basic controls, consistently applied, stop most HOA payment fraud before it starts:
- Dual approval on every payment. No check or payment should go out without two board members reviewing and approving it. The person approving payments should not be the same person who processes them.
- Callback verification for any banking change. Before updating vendor payment details, call the vendor directly on a known number to confirm. Never rely solely on an email request to change banking information.
- Monthly bank reconciliation reviewed by the board. The bank reconciliation report confirms that what the financial statements show matches what is actually in the bank. When a board member who is not involved in processing payments reviews this report every month, discrepancies surface quickly. If your monthly financial packet does not include a bank reconciliation report, that is worth addressing immediately.
- Separation of duties. The person handling accounting should never also have signing authority on the association’s accounts. These two functions need to be held by different people.
- Direct board access to bank statements. Board members should be able to see the actual bank statements and check images, not just summary reports produced by the management company. Summary reports can be manipulated. Bank statements cannot.
After losing $168,000, Francisco restructured his community’s entire financial setup. The property manager now handles only physical management. Community Financials handles all the accounting. And the property manager is not permitted to access the accounting at all. “He’s not allowed to get into accounting at all. Nothing. I don’t allow him to do that,” Francisco says.
What Budget Season Has to Do With It
Budget season is when boards are most focused on the numbers in front of them. It is also a good time to look at the structure behind those numbers. Before finalizing the 2027 budget, ask whether the controls above are in place. If one person in your community has unchecked access to both the payment process and the financial records, that is a gap worth closing before the next year begins.
HOA payment fraud is almost never the result of a sophisticated scheme. It is the result of an opportunity that nobody closed off.
Schedule a consultation or call 833-CONDO-HOA.
Frequently Asked Questions
What is HOA payment fraud?
HOA payment fraud occurs when money is stolen from a community association through the payment process. The most common forms include internal fraud, where someone with access to the association’s accounts diverts money through fake vendors or unauthorized payments, and external fraud, where criminals use Business Email Compromise to intercept payment instructions and redirect funds to fraudulent accounts. Most HOA payment fraud goes undetected for months because the same person controlling payments is also responsible for the financial records.
How does Business Email Compromise affect HOA communities?
Business Email Compromise is a type of cyber fraud where a criminal spoofs or intercepts emails between an HOA and one of its vendors. The fraudster sends a convincing email appearing to come from the vendor, asking the board or management company to update banking details before the next payment. When the payment is made to the new account, the money goes directly to the fraudster. Community associations are frequent targets because payment processes are often handled by one person with limited oversight.
What is dual approval and why does an HOA need it?
Dual approval means that no payment can be processed without two authorized board members reviewing and approving it. It is one of the most effective controls against HOA payment fraud because it ensures no single person can authorize and process a payment without a second set of eyes. Many HOA governing documents require dual signatures on checks. If your community is not doing this, it is worth checking both your documents and your current payment process.
What is callback verification for HOA payments?
Callback verification is the practice of calling a vendor directly, using a phone number from your existing records rather than any number provided in the request itself, to verbally confirm any change to their banking or payment details before updating your records. It is the primary defense against vendor email fraud and Business Email Compromise. One phone call before updating payment information stops most of this type of fraud entirely.
How can an HOA board detect fraud early?
The most reliable early detection tool is the monthly bank reconciliation report, reviewed by a board member who is not involved in processing payments. This report confirms that what the financial statements show matches what is actually in the bank. Discrepancies between the two are often the first visible sign of fraud. Boards should also have direct access to actual bank statements and check images rather than relying solely on summary reports, which can be manipulated.
Important Disclaimer: This post is for educational purposes only and does not constitute legal, tax, or financial advice. Always consult a qualified attorney and CPA for guidance specific to your community.
