Homeowners associations across the country are collecting names, addresses and other personal details on residents — and in many cases posting versions of that information where anyone online can find it. Privacy advocates and cybersecurity experts warn the practice hands scammers exactly the kind of detail they need to make a fraudulent call or message sound real.
HOA meeting minutes, membership lists and other association records often include a homeowner’s name tied to a property address. Depending on the association and the state, that information may sit behind a members-only login — or it may be published on a public-facing website where search engines can index it.
Most homeowners never uploaded any of this themselves. It was collected by the association as part of routine business, then made available more broadly than most residents would expect.
California’s rules show both the risk and the fix
California law treats HOA board meeting minutes as records available for member inspection, but it excludes minutes from executive sessions covering member discipline, certain payment disputes and other sensitive matters. The law also lets an association withhold or redact information if releasing it could reasonably lead to identity theft, fraud, or a violation of a member’s privacy.
Under California law, an HOA’s membership list includes a homeowner’s name, property address, mailing address and email address. Members have a right to request access to association records — but they also have a right to keep their own information out of that list. California residents can opt out of having their name, address and email shared through the membership list simply by notifying the association in writing. State law also bars associations from selling that information or using it for anything unrelated to a member’s interest in the community.
Rules differ elsewhere. Homeowners outside California should check their own state’s laws and ask their HOA directly what records exist, who can see them, and whether an opt-out is available.
Why this matters to scammers
Once a scammer has a name and a home address, they have the raw material for a convincing pitch — a fake call about an unpaid assessment, a phishing text referencing the neighborhood, an email that name-drops the community by name. The Justice Department has already prosecuted companies for feeding personal data to fraud rings. Epsilon Data Management, one of the country’s largest marketing firms, agreed to pay $150 million after prosecutors said it sold consumer data to operators running fake sweepstakes and astrology scams that targeted elderly victims. A related firm, Macromark, pleaded guilty after lists it supplied to fraudulent clients led to at least $9.5 million in victim losses.
Those cases involved marketing databases, not HOA records specifically. But the lesson carries over: personal information that seems harmless in one context becomes a weapon in another.
The stakes are highest for older Americans. The FBI says criminals often target seniors because they’ve accumulated savings and may be more likely to respond to unsolicited contact. In 2025, Americans over 60 reported more than $7.7 billion in internet-enabled fraud losses to the FBI — over 201,000 complaints, the highest total losses of any age group.
What homeowners can do right now
- Search your HOA’s name alongside terms like
