Do not send the PayPal deposit yet; pay only after the leaseholder’s authority, the apartment, the legal route, and a signed agreement all check out independently.
“I'm moving to the US and found a sublet in Williamsburg. I have no credit score or job yet, but showed proof of funds. I'm being asked to pay the deposit via PayPal to the outgoing roommate without seeing the master lease or speaking to the landlord. How can I verify if a sublet is legitimate and protect myself from scams?”
Summary
You are right to pause: the missing lease, absent independent owner confirmation, and request to pay a departing person are serious red flags, but they can be tested with documents and official records. Having no U.S. credit score or job does not take away the one-month deposit cap or require you to accept an unsafe payment process.
The correct paperwork depends on whether a named tenant is leaving the home or will keep living there.
This is a . In a building with four or more units, the named tenant must seek advance owner consent through the certified-mail process in RPL § 226-b. Require the , proposed signed sublease, certified-mail receipt, every item sent to the owner, any owner response, and either written consent or documents proving the 30-day period expired.
This can be a roommate replacement rather than a . RPL § 235-f permits an additional occupant when the headcount and primary-residence conditions are met; the named tenant must give the landlord the occupant’s name within 30 days. See the , confirm which named tenant remains, and have that person sign your written roommate agreement. The departing roommate should not be your sole counterparty or payee.
NYC’s short-term-rental rules prohibit renting an entire apartment or home for fewer than 30 days and require the host to remain present. Do not use a ‘sublet’ label to bypass that rule.
RPL § 226-b’s statutory sublet right covers buildings with four or more residential units and excludes public housing and proprietary co-op leases; outside that rule, do not rely on deemed consent—require the authority demanded by the master lease and owner or board rules.
Read the full explanationHide the full explanation
Watch out for
Next steps
Follow this order so each check unlocks the next one and no money moves before authority and identity are proven.
Before sending anything
Pause payment and preserve the listing
Do not send the deposit, application fee, or ‘hold’ payment. Save the advertisement, profile, phone numbers, email addresses, payment request, promised address/room, rent, deposit, dates, and every message. If your proof of funds exposed a full account number, password, Social Security number, or passport data, contact the issuing bank or agency immediately and use https://www.identitytheft.gov/ for the recovery plan.
Requirements
Before relying on their documents
Match the address to independent city records
Search the address at HPD Online, https://hpdonline.nyc.gov/hpdonline/, and open Property Registration, complaints, violations, vacate orders, block, and lot. Search Brooklyn deeds and recorded documents through ACRIS, https://a836-acris.nyc.gov/CP/, and compare the owner name. In DOB NOW, https://a810-dobnow.nyc.gov/publish/Index.html, use Address, open the Property Profile, and select Certificate of Occupancy to confirm residential use and floor records; a pre-1938 building may lawfully lack a CO unless later alterations required one. If anyone claims to be a broker or licensed agent, search the exact name or license number at https://appext20.dos.ny.gov/nydos/selSearchType.do. Contact the owner or registered managing agent through independently found registration information—not a number supplied only by the advertiser—and request written confirmation of the person, room, dates, and authority.
Requirements
Before signing or paying
Tour the exact room and verify the people
The FTC says to view before signing or paying; it expressly allows an in-person visit by you, a trusted person, or a video/virtual tour. Make the video live rather than prerecorded, ask the person to move from the street number through the building into the exact room, and compare their government-ID name with the lease and agreement. A tour proves access, not authority, so continue the document checks.
Requirements
After the tour passes
Identify the legal route and collect its complete packet
If every named tenant will leave temporarily, treat it as a . For a four-or-more-unit building, require the proposed sublease, tenant’s lease, certified-mail receipt, delivery proof, all information sent under RPL § 226-b, any later owner request, cotenant/guarantor consents, and written approval—or proof that the later applicable 30-day period expired without an answer. If at least one named tenant remains as a primary resident, use the RPL § 235-f roommate route: confirm the lease headcount, have the remaining named tenant sign, and include the obligation to send your name to the landlord within 30 days. For fewer than four units, public housing, or a proprietary co-op lease, do not use § 226-b deemed consent; require the approval or permission demanded by the master lease and owner/board rules.
Requirements
Before agreeing to the price
Verify the legal rent and deposit
Limit the to one month’s rent and reject a separate reservation deposit. If the unit is , compare your subrent with the lawful rent in the master lease/rider; only a fully furnished sublet may add up to 10%, and the sublet may not exceed two years in the relevant four-year period. In a six-or-more-unit building, obtain written notice of the New York bank’s name and address and the deposited amount. Label rent and security separately so nobody can later relabel the payment.
Requirements
Only after every check passes
Sign first, inspect, then pay the correct person
The agreement should state the parties’ legal names, exact room/apartment, term, rent, utilities, furniture, deposit, deposit holder, refund duty, house rules, keys, and what happens if owner approval fails. Request a joint move-in inspection and signed condition report. Do not use PayPal as escrow: rental property is excluded from Purchase Protection, as are Friends and Family payments. Request a non-electronic option under RPL § 235-g, pay through a method that creates a durable record, and obtain a receipt stating date, amount, premises, rental period or ‘security deposit,’ and recipient’s signature/title. If the departing roommate wants repayment of an old deposit share, use a three-party signed transfer or do not pay that person.
Requirements
At the first contradiction
Act immediately if a check fails or money is already gone
Stop if the lease is withheld, names do not match, the unit cannot be toured, city records show a vacate order or incompatible use, the consent packet is incomplete, or the payee will not sign. If you already paid through PayPal, report the transaction to PayPal and ask for reversal; if funded by debit or credit card, report fraud to the bank/card issuer and ask it to reverse the charge. Report the ad to its platform, local law enforcement, and the FTC at https://ReportFraud.ftc.gov/. For a genuine landlord or deposit-holder who refuses to return security, use the New York Attorney General’s Rent Security complaint at https://formsnym.ag.ny.gov/OAGOnlineSubmissionForm/faces/OAGRSHome.
Requirements
Legal sources
This answer is grounded in New York statutes, New York HCR, NYC HPD/DOB/OSE and Department of Finance records, the FTC, and PayPal’s own policy.
RPL § 226-b
This statute supplies the true-sublet paperwork, deadlines, deemed-consent rule, four-unit threshold, and public-housing/co-op exceptions.
2(a)-(c), 3-4
2. (a) A tenant renting a residence pursuant to an existing lease in a dwelling having four or more residential units shall have the right to sublease his premises subject to the written consent of the landlord in advance of the subletting. Such consent shall not be unreasonably withheld. 2. (b) The tenant shall inform the landlord of his intent to sublease by mailing a notice of such intent by certified mail, return receipt requested. Such request shall be accompanied by the following information: (i) the term of the sublease, (ii) the name of the proposed sublessee, (iii) the business and permanent home address of the proposed sublessee, (iv) the tenant's reason for subletting, (v) the tenant's address for the term of the sublease, (vi) the written consent of any cotenant or guarantor of the lease, and (vii) a copy of the proposed sublease, to which a copy of the tenant's lease shall be attached if available, acknowledged by the tenant and proposed subtenant as being a true copy of such sublease. 2. (c) Within ten days after the mailing of such request, the landlord may ask the tenant for additional information as will enable the landlord to determine if rejection of such request shall be unreasonable. Any such request for additional information shall not be unduly burdensome. Within thirty days after the mailing of the request for consent, or of the additional information reasonably asked for by the landlord, whichever is later, the landlord shall send a notice to the tenant of his consent or, if he does not consent, his reasons therefor. Landlord's failure to send such a notice shall be deemed to be a consent to the proposed subletting.
RPL § 235-f
This statute establishes the roommate route, occupancy limits, notice deadline, and lack of a right to stay after the named tenant leaves.
3-6
3. Any lease or rental agreement for residential premises entered into by one tenant shall be construed to permit occupancy by the tenant, immediate family of the tenant, one additional occupant, and dependent children of the occupant provided that the tenant or the tenant's spouse occupies the premises as his primary residence. 4. Any lease or rental agreement for residential premises entered into by two or more tenants shall be construed to permit occupancy by tenants, immediate family of tenants, occupants and dependent children of occupants; provided that the total number of tenants and occupants, excluding occupants' dependent children, does not exceed the number of tenants specified in the current lease or rental agreement, and that at least one tenant or a tenants' spouse occupies the premises as his primary residence. 5. The tenant shall inform the landlord of the name of any occupant within thirty days following the commencement of occupancy by such person or within thirty days following a request by the landlord. 6. No occupant nor occupant's dependent child shall, without express written permission of the landlord, acquire any right to continued occupancy in the event that the tenant vacates the premises or acquire any other rights of tenancy; provided that nothing in this section shall be construed to reduce or impair any right or remedy otherwise available to any person residing in any housing accommodation on the effective date of this section which accrued prior to such date.
GOL § 7-103
Security remains your money, must be held in trust, and receives extra bank protections in a six-or-more-unit building.
1, 2, 2-a
1. Whenever money shall be deposited or advanced on a contract or license agreement for the use or rental of real property as security for performance of the contract or agreement or to be applied to payments upon such contract or agreement when due, such money, with interest accruing thereon, if any, until repaid or so applied, shall continue to be the money of the person making such deposit or advance and shall be held in trust by the person with whom such deposit or advance shall be made and shall not be mingled with the personal moneys or become an asset of the person receiving the same. 2. Whenever the person receiving money so deposited or advanced shall deposit such money in a banking organization, such person shall thereupon notify in writing each of the persons making such security deposit or advance, giving the name and address of the banking organization in which the deposit of security money is made, and the amount of such deposit. 2-a. Whenever the money so deposited or advanced is for the rental of property containing six or more family dwelling units, the person receiving such money shall, subject to the provisions of this section, deposit it in an interest bearing account in a banking organization within the state which account shall earn interest at a rate which shall be the prevailing rate earned by other such deposits made with banking organizations in such area.
GOL § 7-108
For covered unregulated units, this statute caps security, gives inspection rights, sets the 14-day accounting deadline, and provides damages for willful violations.
1-a(a), (c), (e)-(g)
(a) No deposit or advance shall exceed the amount of one month's rent, unless the deposit or advance is for a seasonal use dwelling unit as provided for in subdivisions four and five of this section, or unless the deposit or advance is for an owner-occupied cooperative apartment as provided for in subdivision six of this section. (c) After initial lease signing but before the tenant begins occupancy, the landlord shall offer the tenant the opportunity to inspect the premises with the landlord or the landlord's agent to determine the condition of the property. If the tenant requests such inspection, the parties shall execute a written agreement before the tenant begins occupancy of the unit attesting to the condition of the property and specifically noting any existing defects or damages. (e) Within fourteen days after the tenant has vacated the premises, the landlord shall provide the tenant with an itemized statement indicating the basis for the amount of the deposit retained, if any, and shall return any remaining portion of the deposit to the tenant. If a landlord fails to provide the tenant with the statement and deposit within fourteen days, the landlord shall forfeit any right to retain any portion of the deposit. (f) In any action or proceeding disputing the amount of any amount of the deposit retained, the landlord shall bear the burden of proof as to the reasonableness of the amount retained. (g) Any person who violates the provisions of this subdivision shall be liable for actual damages, provided a person found to have willfully violated this subdivision shall be liable for punitive damages of up to twice the amount of the deposit or advance.
HCR Fact Sheet 9
This current HCR publication extends the 14-day and inspection protections to rent-stabilized tenants and confirms the universal one-month cap.
Fact Sheet 9, Security Deposit Protections
The Housing Stability and Tenant Protection Act (HSTPA) of 2019 limits the amount of a security deposit for any apartment to one month’s rent. It is unlawful for the owner to ask for an additional amount of money from the tenant, guarantor or third party. A building owner or property manager is prohibited by law from requesting or otherwise requiring payment of a deposit or additional charge to reserve an apartment unit. Such room reservation charges or deposits, whether paid for or demanded from the tenant, a guarantor, or other third party, are unlawful. Effective November 15, 2025, changes to Section 7-107 of the General Obligations Law governing security deposits extend certain protections to rent stabilized tenants. In summary, owners must return the tenant’s full security deposit within 14 days after they move out. Owners who withhold any part of the security deposit must provide the tenant with an itemized list of damages and the cost of repairs.
HCR Fact Sheet 7
This HCR fact sheet establishes the special time and price rules for a rent-stabilized sublet.
FS-07 (07/2022)
A tenant who sublets an apartment to another person is the prime tenant. The person to whom the apartment is sublet is the subtenant. In a sublet situation, the prime tenant must abide by the rent stabilization rules that govern the building owner. A tenant may not sublet the apartment for more than two years out of the four-year period before the termination date of the sublease. If the prime tenant sublets the apartment fully furnished, the prime tenant may charge an additional rent increase for the use of the furniture. This increase may not exceed ten percent of the lawful rent. If the New York State Division of Housing and Community Renewal (DHCR) finds that the prime tenant has overcharged the subtenant, the prime tenant will be required to refund to the subtenant three times the overcharge.
RPL § 235-g
A landlord cannot force rent to be paid only through PayPal or another electronic system.
1-2
1. A landlord shall not require a lessee or tenant to use an electronic billing and/or payment system as the only method for the payment of rent. A landlord shall not assess any fee or other charge for a lessee or tenant that chooses not to use an electronic billing and/or payment system. 2. Any agreement by a lessee or tenant of a dwelling waiving or modifying his or her rights as set forth in this section shall be void as contrary to public policy.
PayPal Friends and Family scam policy
PayPal itself says neither Friends and Family nor rental-property transactions carry Purchase Protection.
If a seller is encouraging you to send a 'Friends and Family' payment when you're buying a good or service, you should refuse. You could be dealing with a scammer who knows that your payment won't be covered by our Purchase Protection if it's a 'Friends and Family' payment. Please be aware that real estate, including residential and rental property, is not eligible for our Purchase Protection.
FTC Rental Listing Scams
The FTC supplies the core verification sequence and reporting route for rental-listing fraud.
How To Avoid Rental Listing Scams; How To Report
Search online for the rental location’s address along with the name of the property owner or rental company. If other ads come up for the same address, but with a different owner or rental company name, that’s a sign of a scam. Go to the rental company’s own website to see if the property is listed there, too. If you can, look at the property before you sign or pay. Visit the property in person, have a friend or someone you know visit it, or watch a video or virtual tour. If anyone insists you can only pay with wire transfers through Western Union or MoneyGram, gift cards, or cryptocurrency, it’s a scam. If you notice a rental listing scam, report it to your local law enforcement agency and the website where the ad was posted. And report it to the FTC at ReportFraud.ftc.gov.
NYC HPD Online
HPD Online provides the building-registration and enforcement records needed to contact the registered parties independently.
Use HPD Online to find information about your building, which may include: Complaints and Violations Property Registration Charges and Litigation Block and Lot Information Vacate Orders
NYC DOF ACRIS
ACRIS lets you compare the claimed owner with recorded deeds and other property documents for the Brooklyn address.
The Automated City Register Information System (ACRIS) allows you to search property records and view document images for Manhattan, Queens, Bronx, and Brooklyn from 1966 to the present.
NYC DOB Certificate of Occupancy
DOB records help confirm that the building and floor are approved for the residential use being offered.
A Certificate of Occupancy (CO) states a legal use and/or type of permitted occupancy of a building. Buildings built before 1938 aren’t required to have a Certificate of Occupancy – unless later alterations changed its use, egress or occupancy. Use the Address search in DOB NOW to search by property address. From the top of the Property Profile Page select Certificate of Occupancy . If a Certificate of Occupancy has been issued, a new window will open with the Certificate of Occupancy Details and Floor Use Records.
NYC OSE Short-Term Rental Rules
NYC’s issuing office establishes why a host-absent stay shorter than 30 days is not a valid sublet route.
Information for Hosts
You cannot rent out an entire apartment or home to visitors for less than 30 days, even if you own or live in the building. You must be present during your guests' stay if it is for less than 30 days. You may have up to two paying guests staying in your household for fewer than 30 days, only if every guest has free and unobstructed access to every room and each exit within the apartment, and you have applied for and received a short-term rental registration. Internal doors cannot have key locks that allow guests to leave and lock their room behind them. All occupants need to maintain a common household, which means, among other things, that every member of the family and all guests have access to all parts of the dwelling unit.
RPL § 235-e
A non-check rent payment requires a receipt identifying the date, amount, premises, rental period, and recipient.
(a), (c)
(a) Upon the receipt of the payment of rent for residential premises in the form of cash, or any instrument other than the personal check of the lessee, it shall be the duty of the lessor, or any agent of the lessor authorized to receive rent, to provide the lessee with a written receipt containing the following: 1. The date; 2. The amount; 3. The identity of the premises and period for which paid; and 4. The signature and title of the person receiving the rent. (c) If a payment of rent is personally transmitted to a lessor, or an agent of a lessor authorized to receive rent, the receipt for such payment shall be issued immediately to a lessee. If a payment of rent is transmitted indirectly to a lessor, or an agent of a lessor authorized to receive rent, a lessee shall be provided with a receipt within fifteen days of such lessor or agent's receipt of a rent payment.
FTC What To Do if You Were Scammed
The FTC gives the immediate recovery sequence if money has already been sent.
If you paid a scammer with a mobile payment app
Report the fraudulent transaction to the company behind the money transfer app and ask them to reverse the payment. If you linked the app to a credit card or debit card, report the fraud to your credit card company or bank. Ask them to reverse the charge.
These are the official rules and policies as published on the cited dates; laws, agency guidance, and payment-provider terms can change.
This is general information about official processes, not legal advice, and SettleKit is not a law firm.
Related answers
Join the SettleKit newsletter
We research the hard parts of settling in the US and write articles you will not find anywhere else. Subscribe to get each new article by email.