You got an email asking you to sign a lease, and you are not sure you trust it. That is a good instinct. Here is how to check, before you click anything.
Start here: were you expecting it? #
This is the check that catches almost everything, and it needs no technical knowledge.
A real lease to sign comes from a landlord or property manager you already deal with. It names them, it names the property you are renting, and it turns up around when the two of you agreed it would. If any part of that feels off, skip to the section on asking your landlord.
Pendo is Canadian property management software that your landlord uses to run the property. The email is sent on their behalf, which is why it carries their name and email address. If it never names a landlord you recognise, do not trust it.
What a real link looks like #
The lease itself opens on app.pen.do. Other documents your landlord may send you, such as a pet agreement, a Form K, or an amendment to your lease, open on tenants.pen.do. Both of those are us.
If you can see the address, check the front of it. On a computer, hover over the button and read the address that appears at the edge of the screen. On a phone, press and hold to see it.
It should begin https://app.pen.do/ or https://tenants.pen.do/, with a slash straight after.
That slash is the whole trick. An address like app.pen.do.something-else.com contains the words "pen.do" and is not us. Only what sits between https:// and the first single slash counts.
If the address looks like neither, that alone proves nothing #
Work email systems and some webmail rewrite every link into a long address of their own before you ever see it. If you are reading on a work address, what you see on hover may be your employer's security scanner rather than the real destination.
So an address you do not recognise is a reason to check another way, not a reason to panic. Use the next section.
The check that always works: ask your landlord #
Contact them through a channel you already trust: a phone number or email address you have used before, not the contact details inside the email you are questioning. One short message settles it. "Did you just send me something to sign?" is enough.
Do this before you click, not after. A real request will still be there in ten minutes.
Nobody will ever ask for your SIN, banking details, or a password #
Signing a lease needs your signature, and nothing more. There is no account to create, no login, no ID to upload, no bank account to confirm.
If a page asks you for any of that, close it, whatever address it is on. This one holds even when every other check passed.
If it still feels wrong #
- Do not click anything in the email, including any unsubscribe or "this wasn't me" link.
- Tell your landlord. If someone is using their name, they need to know.
- Forward it to us at contact@pen.do and we will look into it. You do not need a Pendo account to write to us.
If you already clicked through and typed in banking details or a password, contact your bank and change that password now. Then let your landlord know what happened.
