Beware of Fraudulent “Account Verification” or “Listing Removed” Emails

Fraudulent inquiries were recently submitted through the public contact form on some homecoin listings. The messages may have referenced “Account Verification” or “Listing Removed” and included a link that appeared to be associated with homecoin. These messages were not sent by homecoin, and the linked website was not operated or authorized by us.

Do not click links in those messages or provide login, payment, or personal information. A legitimate homecoin notice will not ask you to verify your account or prevent removal of a listing through a link contained in a property inquiry.

Why the messages looked legitimate

The fraudulent messages were submitted by a third party through our public inquiry form. Because inquiry notifications were sent from noreply@homecoin.com, the resulting emails may have appeared to come directly from homecoin even though the message content was supplied by the person submitting the inquiry. Do not rely on the sender address alone when deciding whether a property inquiry is trustworthy.

What to do if you clicked a link or entered information

Open homecoin.com directly instead of returning through the message, then use the recovery steps that match how you sign in:

• If you use a homecoin password: change it and any other account password you reused. See Resetting Your Password.
• If you sign in only with Apple, Google, or Microsoft: secure that provider account and continue signing in to homecoin with the same provider. A standard homecoin password-reset request intentionally will not send a reset email for a social-only account and cannot create its first homecoin password.
• If you have not completed a homecoin account-setup invitation: use the current private invitation or ask the person who added you to the transaction to resend it. Standard password recovery cannot complete initial account setup.

If you received an unexpected security notice or believe your account was accessed, contact homecoin support.

Legitimate homecoin account notices

Depending on your account and recent actions, legitimate homecoin messages may include:

• An account-setup invitation after you are added to a transaction or another authorized user sends the invitation. The private setup link expires after seven days.
• An email-verification message when an account that already has a usable sign-in method still needs to verify its email address.
• An electronic-consent notice with the subject “Your electronic consent was withdrawn” or “Your electronic consent was restored.” Withdrawing consent does not automatically cancel or change a property, listing, draft, order, or status.
• A password-added security notice with the subject “A homecoin password was added to your account.” If you did not make that change, reset the password and contact support.
• A Sign-In Help notice with the subject “Sign in to homecoin to sign a document” or “Sign in to homecoin to remove a signature.” An authorized transaction participant may request this message for a named signer. It returns the recipient to the applicable signing page and provides account-appropriate sign-in or recovery guidance.

homecoin never emails or texts passwords. homecoin also does not send temporary passwords for new accounts. Enter a password only on homecoin, and never reply to a message with one.

For more information about invitations and account readiness, see New Account Invitations, People & Roles, and Signing.

Steps homecoin has taken

• Removed links from inquiry messages and added controls to discard suspicious submissions.
• Added additional screening designed to identify potentially fraudulent inquiries.
• Begun changing the contact form so future inquiry emails will identify the inquiring party rather than appearing to come from homecoin.

We apologize for the concern and confusion this may have caused. Protecting our customers and improving the security of our platform are important to us.