In short
- ✓Criminals target holding deposits, rent and completion payments with fake bank-detail emails.
- ✓AML identity checks and Right to Rent documents mean agents hold passports and other sensitive ID.
- ✓Multi-factor authentication, DMARC and a call-back rule for bank details stop most attacks.
Why estate and letting agents are targeted
Estate and letting agents sit in the middle of large payments between buyers, sellers, landlords and tenants, mostly arranged by email. That makes agencies a favourite target for payment diversion fraud, where a criminal sends convincing emails with new bank details at exactly the right moment.
Agents also hold sensitive personal data. Estate agency businesses must register with HMRC for anti-money laundering supervision and verify clients' identities, and letting agents carry out Right to Rent checks, so files often contain copies of passports and other ID that must be protected under UK GDPR.
The main risks
- Payment diversion on holding deposits, tenancy deposits, rent and completion funds.
- Emails to buyers, sellers and tenants that appear to come from your agency, sent from your hacked mailbox or a spoofed domain.
- Stolen logins for your CRM or property software exposing client and tenant records.
- Copies of passports and ID from AML and Right to Rent checks, which are valuable to criminals and must be stored securely.
- Personal data breaches that may need reporting to the ICO within 72 hours and to affected clients.
How I help estate and letting agents
- Email Security & Phishing ProtectionDMARC so criminals can't send email as your agency, and a payment call-back procedure for every office.
- Microsoft 365 & Google Workspace SecurityMulti-factor authentication and alerts across negotiators' and lettings staff mailboxes.
- GDPR & Data Protection SecuritySecure storage and sensible retention for ID documents, tenant files and client records.
- Staff Cyber Awareness TrainingPractical sessions for negotiators and lettings teams on spotting fake bank-detail requests.
- Cyber Essentials Certification SupportA recognised standard to show landlords, vendors and partners you take security seriously.
Cyber security checklist for estate and letting agents
- Turn on multi-factor authentication for email, your CRM, property software and online banking.
- Tell every client, landlord and tenant that you will never change your bank details by email.
- Confirm any bank detail change by phone using a number already on file.
- Set up SPF, DKIM and DMARC so emails can't be sent pretending to be from your agency.
- Store ID documents securely, restrict who can access them and delete them when you no longer need them.
- Give each staff member their own login and remove access when people leave.
- Train negotiators and lettings staff to spot payment fraud and phishing.
- Back up client and property records and test restoring them.
Questions
How do I stop tenants and buyers being scammed by fake emails from my agency?
Set up DMARC so criminals can't send email as your domain, tell clients in writing that you'll never change bank details by email, and protect your own mailboxes with multi-factor authentication.
Do estate agents have to report data breaches?
If a personal data breach is likely to put people's rights at risk, it must be reported to the ICO within 72 hours, and affected people must be told when the risk is high.