I got an email from Roam. Is it real?

Being suspicious is the right instinct, and you do not have to decide right now.

If your association has recently started using Roam, you will get messages from a company you do not recognize about money you really do owe. That is the exact shape of a convincing scam, and it is also what a genuine notice looks like in the first month. Nothing in this situation requires you to act within the next hour.

The rest of this page is how to find out, without using the message to check the message.

Do not use anything in the message to verify the message. Not the link, not the phone number, not the "verify your account" button, not the address it says to reply to. All of those are written by whoever sent it, and if it is fake, all of them lead back to them.

Instead, do one of these:

1. Ask your association or your manager, using a phone number or email address you already had — from a paper statement, your closing documents, or a letter that predates the message you are unsure about. Ask them: "Did you send this?" They can see what was sent to you and when. This is the most reliable check there is, and it is the one people skip because it feels like a bother. It is not a bother.
2. Go to your account yourself, by typing the portal address into your browser rather than following a link. If the message says you owe something your portal balance does not show, ask your manager before you pay.

If you cannot do either right now, doing nothing is safe. A real charge does not become unrecoverable because you waited a day to confirm it.

This is the part most advice leaves out, and it matters more than any single tip below.

No single feature of a message can prove it is genuine. A convincing fake can copy the logo, copy the wording of a real notice, use your correct name, your correct property address, and your correct balance. It can show a padlock in the browser. It can arrive from an address that looks almost exactly right. Someone who has seen a real notice — a former employee, a neighbor, anyone on a mailing list — can reproduce one closely.

So treat the signs below as ways to catch a fake, not as ways to confirm a real one. A message that fails any of them is bad. A message that passes all of them still has not been confirmed. Only the check in the section above confirms anything.

These are the opposite kind of test. They cannot be faked into passing, because they are things we never do at all.

Roam will never ask you for a password. Not by email, not by text, not on a phone call, not to "verify" or "reactivate" anything. Nobody at Roam and nobody at your management company needs your password, and no genuine message will ever ask for one.

Roam will never tell you by email that payment details have changed. If a message says your association's bank account, routing number, or payee has changed and gives you new details to pay to, treat it as fake until you have confirmed it with your manager on a number you already had. This one costs people the most money by far, and it is covered again below.

Roam will never ask for your full card number, your online banking login, or a one-time code from your bank. Payments happen on a payment page you navigated to yourself. Nobody legitimate collects those in a conversation, an email reply, or a text.

Roam will never demand that you pay within hours through a link. Your association's collections process is written down, it has dates in it, and it moves over weeks and months. A real notice can be serious. It can mention late fees, collections, even a lien. Those are real parts of a real process. But a real notice gives you a date. It does not push you to act through a link before you have had time to check.

This is always true, whatever the message is about. It is worth learning once.

The sender is the part after the last @. A display name is only text; anyone can set it to "Roam Support" or to your management company's name. On a phone, tap or long-press the sender name to reveal the actual address underneath it, because most mail apps hide it by default.

Ask your association, once, which email addresses their notices come from, and write it down somewhere that is not your inbox. Then you have a reference that did not arrive in an email. Note that this tells you when something is wrong; a matching address still does not prove a message is right.

Watch for any message that says the payment details have changed.

It usually arrives looking ordinary: a statement, an invoice, or a "our banking has been updated" notice, with new account details and a request to send this month's payment there. Sometimes it arrives as a reply inside a genuine email thread, which is why the thread looking familiar proves nothing.

Payment details do not change by email. If they genuinely change, you will be able to confirm it by calling your management company on a number you already had. Confirm before you send money, not after. Money sent to a fraudulent account is often gone within hours.

• Urgency. "Immediate action required", "final notice", "within 24 hours", "your account will be suspended today". Urgency exists to stop you checking. Checking is the thing that costs an attacker their money.
• An unusual way to pay. Gift cards, cryptocurrency, a payment app, a wire to a person's name, or an account at a different company. No association collects assessments this way.
• An attachment you did not expect, especially one that asks you to enable something or to sign in before it will open.
• A statement that does not match what you know. A property address that is not yours, an amount that bears no relation to your assessment, a community name that is not your community.
• Anything asking you to "confirm" or "reactivate" your account by entering details you have already given.

None of these on its own proves a message is fake, and their absence proves nothing at all.

Do not click anything in it. Do not reply to it. Do not call a number it gives you. Do not open the attachment.

Forward it to your management company so they can warn other owners, then delete it. Reporting it is worth the two minutes even if you were never going to fall for it — you are usually not the only person who received it.

Work down this list in order. The order matters.

1. If you entered a password, change it immediately — first on your email account, then anywhere else you use the same password. Email comes first because whoever controls your email can reset everything else. If it was your Roam portal password, call your association or management company and ask them to secure your access.
2. If you entered card or bank details, call your bank or card issuer now, using the number on the back of your card or on your statement. Say the details may have been given to a fraudulent site. Speed matters more than anything else at this point.
3. If you sent money, contact your bank first, not your manager. A transfer can sometimes be recalled if you act within hours. Then tell your manager.
4. Then tell your management company whatever happened, including that you clicked. They are not going to judge you and they need to know, because you are probably not the only one.

Nobody should feel foolish about this. These messages are designed by people who do it full time, and the ones that work are the ones that arrive on the day you were expecting a bill.

Then the notice is real and it came from your association, using Roam to send it.

What it is about, and what you do next, is between you and them. See Who is my association, and who is my manager? and, if it is a bill, How do I pay my assessment?

If you are not sure who to report this to, see Something is wrong with my account. Who do I contact?