In this age of increased privacy, its important to know what companies you can (and cannot) trust with your user information.  What many people don’t know as a consumer is this behavior is even worse and still common as a small business owner.

Today, I wanted to expose a shady practice by a Canadian company called SpaceList.ca.

Update

We were contacted by the CEO of SpaceList after posting this article.  He insisted they have the right to give away your personal information per their terms and refused to revisit the policy.

After reviewing the terms carefully, it does not include any provisions for giving away user data.

TL;DR

SpaceList tries to get people to fill out forms to contact what they think is a real estate agent overseeing a property.  What actually appears to happen is they do not send the information. Instead, it is a fishing tactic followed by deep scraping of your information on websites, LinkedIn and social media to build an account profile pretending to be you.  Your information is then given (including your original message) to real estate companies, and within 12 hours the phone calls and messages begin.

This appears to be a combination fishing tactic and bait and switch scheme used to collect and sell or trade your information.

What is SpaceList.ca?

This is a good example of a company offering a redundant service, with little value add.

In Canada, you are usually best off using MLS.COM or REALTOR.COM when seeking rental space as we use the MLS system.  However, with commercial rental being less accessible, it has created a continual opportunity for companies to create services offering actual monthly-cost of office space rentals and better information.

SpaceList is the service of the month that is trying to do this but failing while leaving room for a better alternative.  Rentals are primarily empty white space without pricing details, however the one advantage they offer is the ability to directly message a realtor when looking for space.

In my recent experience, even this advantage may be a sham, as we never received a response from the realtor we attempted to contact.

TIP:  The best location to get actual price information is still kijiji.  Skip the bureaucracy, skip the middle person, contact land holders them directly.

The Fishing Tactic

They appear to mainly focus this tactic on startups and small businesses.  Larger businesses will already have realtors, legal teams, finance teams and restrictions on office space.

So, how does this work?  Lets pretend you are a small company and manage to find an interesting space on their website:

Hmm, so how do we get more information?  A photo, the pricing?

A reasonable person would expect that that the form on the right would let you directly contact the real estate agent and nothing more.

What Actually Happens

I recently filled out the form with only an email address, to inquire on a small space as a secondary office and expected in a few days to get an email with the missing price information.

Here is what actually happened (without my knowledge):

• The message appears to have never been sent (this makes sense when you realize they instead gave my info to another agent)
• Their team visited my companies website, looked me up on social media, and looked me up on LinkedIn
• They used this to create a fake profile, pretending to be me, and populated it with information from around the internet
• They created fake account credentials, and guessed on information they didn’t know

Unsurprisingly, they got the information wrong

Now, they have an account that kind of looks like me, they have something of value.  Their next steps:

• Gave/(sold?) my account information to a “partner” (real estate company)
  • In my case, they sold my information to CORE Commercial Real Estate Ltd.
  • The agent at CORE confirmed they get many accounts through SpaceList
• They told the “partner” I am seeking space in 1 year, the size of my company, and what area I want space in (which was all incorrect)
• Within 12 hours I began getting phone calls and emails from their team and the “partner” they gave my information to
• SpaceList also started sending messages requesting I update the profile I didn’t even create… so they could give (sell?) it to more real estate agents
• I never heard from the actual person I tried to contact OR pricing information on the place I was seeking

As you can imagine, this ALL came as a very nasty surprise.  What happened to my information request?  Who are these people?  What profile?  I didn’t ask to be contacted by any of them.

This kind of behavior is a bad surprise.  It is never good to see a company peddling your information and creating profiles for you without your knowledge.

I spent the rest of the week contacting their support and team members, asking them to remove me from their lists, and to remove my “profile”.  I requested the real estate agent I never asked to speak with to stop contacting me.  He replied by sending me more office spaces.

After continuing to push, I finally got them to remove my account an hour ago.

And now you know, never enter touch the submission form on SpaceList.  Or, better yet, fill it with invalid data and only use throw away accounts.  If they no longer have data to sell or give away, it will kill the practice of these unwanted exchanges and force them to update their terms find a more ethical and sustainable business and revenue model.  After all, no third party would want to keep buying user data if the bulk of it is invalid.