Part I

Scamming internationals

Hunting the housing mafia

All over the world, international students are being conned by fake advertisements for living space on social media. Groningen students have fallen prey to this practice as well. The UK went undercover in the shady world of house fraud.
By Leonie Sinnema, Koen Marée, and Nina Yakimova / Illustration by Kalle Wolters / Translation by Sarah van Steenderen


Using an anonymous profile, UK journalists Leonie and Nina get in touch with people offering suspicious apartment listings in Groningen. It quickly turns out that these people are hiding behind false identities, albeit those of real people – passports and all. The UK decided to try to track down the swindlers and figure out how they work. This is part one of our investigation. 

We are making our way through town to Nieuweweg 26. Someone named Nathalie Halleux is offering several rooms at this address on Facebook. She wants 800 euros as a down payment. UK reporter Nina Yakimova, from Bulgaria, is pretending to be a student from Sofia looking for a place to live.

We count the house numbers on the left side of the street: 22, 24, and then… nothing. Just a high fence and a dark alleyway. The gate is locked. There is no doorbell to be found, no letterbox. Nieuweweg 26 does not exist. When we tell the story to the police in Groningen, they are already familiar with the story. ‘Nieuweweg 26? We know that address’, we are told at the police headquarters at the Rademarkt.

International students trying to find a place to live in Groningen do not have the ability to check out a place beforehand the way we do. Hungarian conservatory students Ibolya Vörösváry and Alexandra Ruisz lost quite a bit of money last year as a result.

Vörösváry and Ruisz come to Groningen in September 2016 to study at the Prince Claus Conservatory. Vörösváry’s brother Martón joins them. They look for a nice, available room over the summer in Groningen – a city they know nothing about – on Facebook.

In the Facebook group Groningen rooms, they find an advertisement placed by Nathalie Halleux.


At the Nieuweweg 26 address, a blonde Belgian woman is offering two rooms for rent: a large room for two people for 450 euros and a smaller room for 350 euros a month. Vörösváry wants to share the large room with her brother. She forwards the message to Ruisz, who is interested in the smaller room.

Nathalie Halleux gives both conservatory students the email address for a person named Sandy He who is the supposed owner of the apartment. She responds quickly. In the email, she writes that she works as a tour guide in London and cannot come to Groningen. Her deceased father left her the building at the Nieuweweg, she writes. As a token of faith, she sends several photos of the apartment, as well as a copy of her passport.


The Hungarian students do not hesitate; these rooms are a golden opportunity. They sign the contract that Sandy sends them and immediately transfer a security deposit worth a month’s rent: Vörösváry pays 450 and Ruisz pays 350 euros.

And then it gets quiet. ‘Sandy said she’d contact us as soon as she’d received the money. She told us it could take two to three weeks’, the Hungarian students say later.

At the end of August, they email Sandy to take care of the final details. But they get no response. They try the mobile phone number they have, but it has been disconnected.

Once in Groningen, Vörösváry and Ruisz go to the police station at the Rademarkt to report the con. But the police tell them there is not much they can do for them. They will not get back the 800 euros they transferred. For now, they couch surf with friends in Groningen. Rooms or no rooms, classes are starting.

The Hungarian students are not the only victims of Sandy He and Nathalie Halleux. The police in Groningen have heard dozens of similar stories. And the pair operates in places other than Groningen. Across Europe, they are pretending to offer nice student apartments. As we dig further, we find Halleux/He in Facebook groups in Germany, Italy, Belgium, and Sweden.

Belgian student Marie Damman was scammed by He and Halleux when she was looking for a room in Munich in the autumn of 2015. Damman refused to let the matter rest and publishes the story on her blog. She receives responses from people in Germany, Sweden, Italy, and Switzerland: all victims of the conwomen. Damman hires a lawyer. The lawyer suspects the swindle is the work of the Russian mafia. He cannot help her. After that, Damman gives up her search.

We, however, do not. We find another offer on Facebook: a luxury apartment at Het Hout 12 in Groningen, close to IKEA. Yakimova once again poses as an international student and responds to the message posted by someone named Ekaterina Efimova.

Just like Nathalie Halleux, Efimova refers us to someone else after initial contact is made through Facebook. Once again, she says she does not in fact own the apartment, but that it belongs to her ‘uncle’, someone named Martinez Herben. In an email in broken English, Herben asks her for 1,210 euros, which includes a 700 euro deposit and 510 euros in rent. If she does that, the apartment is hers.

To convince Nina how nice the apartment is, he shows her a series of photos of the apartment, like a proper real estate agent. And just like Sandy He, he attaches a copy of his passport (issued by the Dutch embassy in Beijing). But Herben’s photos are questionable. They show a luxurious living room, but also a small kitchen with a countertop straight out of the seventies. It is almost as though they were taken at different apartments.



[masterslider id=”1″]

Nina tells him that she is very interested in the apartment and asks if a friend who already lives in Groningen can come take a look at it. She is quickly told that this is out of the question. ‘I’ve been disappointed a lot in the past’, he says. ‘I’m not taking the risk of coming to Groningen from London, where I work, for nothing.’

We decide to investigate on site, just as with the Nieuweweg. On a cold evening, Leonie and Nina ring the doorbell at Het Hout 12.

There is no response. After several tries, a helpful resident of the building lets us in. We show him the photos and ask if it looks anything like the apartment. ‘No’, he says resolutely. ‘That is definitely not here.’

When we arrive at the front door of number 12 on the third floor, no one answers. But the neighbours are home, and they let us inside their apartment. It becomes clear that the photos that Martinez sent us are not real. The window in the photo he provided looks completely different from the glass facade the apartment has.

By now we have figured out that Sandy He and Martinez Herben’s methods are virtually identical. They offer apartments by using Facebook accounts with false names (Halleux and Efimova). Are the same people behind both these scams?

However, there are differences as well: Sandy He offers rooms and specifically targets Erasmus students, while Herben offers luxury apartments for rent. Sandy He’s emails are written in proper English, whereas Martinez’s proficiency varies from email to email. We submit the email exchanges to several linguistic experts at the RUG, who use some nifty tools to analyse and interpret the texts.

The results are conclusive. The emails from Herben all come from the same person, and He’s messages all follow the same script that the sender does not deviate from. The lack of personal linguistic characteristics means there is not enough evidence to determine whether Sandy He is one or more people. Another thing is clear as day, however: the match between Sandy He and Martinez Herben is 0.05, or practically zero. So that means we are dealing with two different swindlers.

But who are Sandy He and Martinez Herben? You can read more about that in part 2: Our swindlers exist, but also do not exist.

The following people contributed to this project: Nicole Aldershof, Lena van Dijk, Simone Harmsen, Nina Jansen, Peter Keizer, René Lapoutre, Koen Marée, Rob Siebelink, Leonie Sinnema, Sjef Weller, Traci White and Nina Yakimova

How to recognise & unmask the swindler

Clue 1:

The advertisement for the room or apartment on Facebook has disabled commenting. Upon responding, you are referred to a ‘family member’ that owns the apartment.

Tip: Check the Facebook profile of the person who placed the advertisement. Having only a few or ‘strange’ friends who write spam-like responses to messages on the profile are clear warning signs. You can use reverse image search (Google or TinEye) to check if the profile photo matches the actual profile.

Clue 2:

After contact by email, the owner turns out to live abroad. There is no option to see the house, but you are asked to transfer a month’s rent or a security deposit.

Tip: To see whether the email sender is physically located where they say they are, you can check their IP address. You do this by looking at the email’s source code. To get to the source code, click on the downward arrow next to the reply button (in Gmail) of the email. Select ‘show original’ in the menu. Next, copy the information to a website that retrieves IP address, such as this one. This method is more successful for Outlook email addresses than for Gmail addresses.

Clue 3:

The photos of the apartment look like they do not belong together, or as though they come straight from a realtor’s brochure or magazine.

Tip: Use reverse image search here to find out where the photos come from.

Clue 4:

The ‘owner’ sends you an ID card or passport to prove his or her trustworthiness. Swindlers often ask you to provide a copy of your ID as well: never do this!

Tip: Verifying whether identification is real is tricky. Do you have questions about Dutch identification? Call the municipality. It is also a good idea to google the name on the passport, potentially together with the place of birth. To find out whether this person was connected to fraud before, google “name AND fraud” or “scam”. No hits? Try variations of the name! The app DutchID2 can help you check Dutch IDs for security features.

Clue 5:

You are emailed a rental contract that at first glance looks legitimate.

Tip: Find out whether the contract appears on other websites by googling a sentence from the contract. Use the search operator “ ” to only get exact search results. Did you find the contract on other websites? Use this website to check for differences and similarities between your version of the contract and the one you found.



De spelregels voor reageren: blijf on topic, geen herhalingen, geen URLs, geen haatspraak en beledigingen. / The rules for commenting: stay on topic, don't repeat yourself, no URLs, no hate speech or insults.

Please enter your comment!
Please enter your name here