Estate and letting agencies move other people's money every day, rent, deposits, sale proceeds and contractor payments, and hold identity documents and bank statements for every tenant, landlord, buyer and seller they deal with, usually from a busy branch office with shared logins. That combination makes agencies a favourite target for payment diversion fraud and a recurring source of data breaches. This guide covers the agency side of the risk: protecting client money flows, keeping tenant and anti-money laundering (AML) records safe, and running branch and portal accounts securely. It is written for agency directors and branch managers, property managers and block managers, compliance and money laundering reporting officers, and the IT providers who support agencies. For transaction fraud across the whole sale chain and the security of property platforms and smart buildings, see the Cybersecurity for Real Estate and PropTech Guide; for the conveyancer's controls at completion, see Conveyancing Completion Fraud.
Key takeaways
- Every client money flow is a diversion target. Tenants' rent, landlords' payouts, contractors' invoices and buyers' deposits can all be redirected by one convincing email asking to change bank details.
- Bank detail changes need a call-back, every time. Verify any new or changed payee by phone on a number already held on file, never one in the request, and require a second person to approve the change.
- Agencies hold identity data by law. AML customer due diligence and tenant referencing put passports, bank statements and payslips on file, and UK AML rules require them to be kept for five years and then deleted.
- Shared branch logins defeat everything else. A single office password for the agency software, the listing portals and the shared mailbox means no MFA, no audit trail and no clean way to remove a leaver.
- Misconfigured file transfer leaks whole tenant books. The ICO fined a London agency £80,000 after tenant and landlord documents for 18,610 people were left openly accessible for almost two years.
Why agency operations are a distinct risk
An agency sits between parties who rarely meet and who trust it to hold money and documents. Five features shape the threat.
| Feature | What it means for security |
|---|---|
| Client money held in trust | Agencies collect rent, deposits and holding fees and pay them out to landlords, deposit schemes and contractors; every payee list is a fraud target, and losses fall on client money the agency must protect |
| Many counterparties | Tenants, landlords, buyers, sellers, solicitors, contractors, block management clients and referencing providers all exchange emails with the same branch inbox, so a spoofed sender is hard to spot |
| Identity documents on file | AML checks on buyers and sellers, tenant referencing and right to rent checks produce copies of passports, visas, payslips and bank statements |
| Branch culture | Negotiators and lettings staff share desks, mailboxes and logins, work at viewings on phones and change jobs often |
| Physical keys and access codes | Key safes, lockbox codes and alarm codes for managed and vacant properties are often stored in the same software or spreadsheet as tenant data |
Client money and payment diversion
Payment diversion against agencies follows the same pattern as wider business email compromise: compromise or spoof a mailbox, watch the conversation, then send new bank details at the moment a payment is due. The FBI's IC3 2024 report recorded 9,359 complaints in its real estate category with losses of about US$173.6 million, and 21,442 business email compromise complaints with losses of about US$2.77 billion across all sectors. The scenarios below are specific to agency operations.
| Scenario | Who loses | ATT&CK | Control that breaks it |
|---|---|---|---|
| Fake email from the agency tells a tenant the rent account has changed | Tenant, then landlord through arrears | T1583.001 Domains; T1657 Financial Theft | Rent account given once in the tenancy agreement with a standing warning it will never change by email; DMARC at reject on the agency domain |
| Fraudster posing as a landlord asks for payouts to a new account | Landlord; agency client money | T1566.002 Spearphishing Link; T1657 Financial Theft | Call-back on the number in the landlord's file, second-person approval, a cooling off period on new payees |
| Contractor invoice with changed bank details | Landlord or block, through service charges | T1657 Financial Theft | Supplier bank details verified at onboarding and on any change, invoice matched to a works order |
| Agency mailbox phished, then rules hide replies | Every counterparty | T1078 Valid Accounts; T1114.003 Email Forwarding Rule; T1564.008 Email Hiding Rules | Phishing-resistant MFA, alerts on new forwarding and inbox rules |
| Spoofed agency email sends a buyer "new" deposit details | Buyer | T1583.001 Domains; T1657 Financial Theft | Payment details only in the client portal or engagement letter, confirmed by phone; see Conveyancing Completion Fraud |
| Fake listing copied from the agency's adverts takes holding deposits from would-be tenants | Prospective tenants; agency reputation | T1583.001 Domains | Monitor listing portals and social marketplaces for copied adverts, publish that holding deposits are only taken after a viewing and through the agency's own process |
Payment controls that work in a branch
- One source of truth for bank details: payee details live only in the agency software, entered at onboarding from a verified document or call, never copied from an email.
- Verified change process: any change triggers a call to the number already on file, a note of who called whom and when, and approval by a second person who did not take the request.
- New payee hold: pay a new or changed payee only after a set delay or a small test payment confirmed by the payee through a known channel.
- Payee name checks: use confirmation of payee or the bank's account name check where available, and treat a mismatch as a stop, not a warning. See the Confirmation of Payee and Verification of Payee Guide.
- Dual authorisation in online banking: separate the person who sets up a payment run from the person who releases it, with individual banking logins and hardware or app based approval.
- Standing warnings: every tenancy agreement, terms of business, invoice and email footer says the agency will never change its bank details by email.
In England, property agents doing letting or property management work who hold client money must belong to an approved client money protection scheme under the Client Money Protection Schemes for Property Agents (Requirement to Belong to a Scheme etc.) Regulations 2019, in force from 1 April 2019. Membership must provide compensation at least equal to the maximum client money the agent may hold, the certificate must be displayed in each office and published on the website, clients must be told in writing within 14 days if membership is revoked or the scheme changes, and local authorities can impose penalties of up to £30,000 for not belonging and £5,000 for the transparency breaches. Scheme membership compensates clients after a loss; it does not replace the payment controls above. See the Business Email Compromise Awareness for Finance Teams Guide.
Tenant, landlord and AML data
An agency's document store is one of the richest identity data sets in a small business. Map what you hold, why and for how long.
| Data set | Source of the requirement | Retention and handling |
|---|---|---|
| AML customer due diligence on sellers and buyers | Money Laundering Regulations 2017; regulation 4(3) treats an estate agent as entering a business relationship with the purchaser, as well as the seller, when the seller accepts the offer | Regulation 40: keep CDD copies and transaction records for five years after the relationship ends or the occasional transaction completes, then delete the personal data unless an exception applies |
| AML records for high value lets | Letting agency businesses handling individual rents of 10,000 euros or more a month for a term of a month or longer must register with HMRC for AML supervision | As for estate agency CDD |
| Tenant referencing (payslips, bank statements, previous landlord, credit results) | Agency's lettings process and UK GDPR | Keep only what the decision needs; delete unsuccessful applicants' documents promptly under a written retention schedule |
| Right to rent check copies | Home Office scheme for landlords and agents in England | Keep securely for the period the scheme requires, access limited to the lettings team |
| Deposit records and prescribed information | Tenancy deposit protection rules: landlords have 30 days from receiving a deposit to give the tenant the scheme details and prescribed information | Keep with the tenancy file; restrict editing of deposit amounts and scheme references |
| Keys, key safe and alarm codes | Operational | Store separately from tenant contact details, restrict to property management staff, change codes at tenancy end and after staff departures |
The ICO's July 2019 penalty against Life at Parliament View Ltd shows how these documents leak. When the agency transferred data from its server to a partner organisation it failed to switch off an "Anonymous Authentication" function, so bank statements, salary details, passport copies, dates of birth and addresses of tenants and landlords were accessible to anyone online from March 2015 to February 2017, affecting 18,610 people. The agency reported only after a hacker contacted the ICO, and the ICO fined it £80,000, noting that staff had not been adequately trained and had used an insecure file transfer system without monitoring it. The lesson for any agency: check access settings whenever documents move between systems or to a partner, and delete what the retention schedule no longer requires. See the Data Minimisation guide and the Identity Proofing and KYC Guide.
Branch accounts and where identity fits
Most agency compromises begin with an account, so identity is the core control. The table sets the minimum for each system an agency typically runs.
| System | Common shortcut | Minimum standard |
|---|---|---|
| Email and branch shared mailbox (lettings@, sales@) | Everyone signs in to the shared mailbox with one password | Individual accounts with delegated access to the shared mailbox, sign-in disabled on the shared mailbox itself, MFA for every user |
| Agency and property management software | One login per branch; former staff accounts left active | Named users, role based permissions (only accounts staff can edit payee details), MFA, leavers removed on their last day |
| Listing portal accounts | Branch login shared by negotiators | Named users where the portal allows it, otherwise the credential held in a password manager and rotated on departures |
| Online banking for client accounts | Directors share a card reader or app | Individual logins, dual authorisation, payment limits per user |
| Referencing, deposit scheme and e-signature services | Logins stored in a browser on a shared PC | Named accounts with MFA, password manager, access review each quarter |
| Integrations and API keys between these systems | Created by a former IT contractor and never reviewed | Inventory each connection, its owner and scope; rotate keys when a provider or staff member leaves |
- Phishing-resistant MFA for money roles: accounts staff, directors who release payments and anyone with admin rights in the agency software should use security keys or passkeys. See the Phishing-Resistant MFA Guide.
- Mobile working: negotiators read email on phones at viewings; require a screen lock, device encryption and the ability to remove company data from lost devices.
- Leavers: agency staff turnover is high, and leavers often join competitors. Disable accounts on the last day, review mailbox delegations and change any shared code or credential they knew. See the Mailbox Delegation Review Checklist.
Implementation roadmap
- Weeks 1 to 2, money first: write and enforce the bank detail change procedure with call-back and second-person approval; add the "we will never change bank details by email" warning to all documents and footers; turn on dual authorisation in online banking.
- Weeks 2 to 4, accounts: give every staff member named accounts in email, agency software and banking; MFA everywhere; move remaining shared credentials into a password manager; disable sign-in on shared mailboxes.
- Month 2, email domain: publish SPF and DKIM, then DMARC starting at p=none to collect reports and moving to quarantine and reject once legitimate senders (agency software, e-signature, mailing tools) pass. Register obvious lookalike domains. See the DMARC, SPF and DKIM Guide.
- Month 2, alerting: turn on alerts for new forwarding rules, inbox rules, MFA method changes and payee detail changes in the agency software.
- Month 3, data: inventory document stores, shared drives and file transfer links; remove anonymous or public links; write a retention schedule covering AML, referencing and right to rent records; delete what has expired.
- Month 3, test and rehearse: run a tabletop of a diverted landlord payout, including who calls the bank to request a recall, who reports, and who tells the client. If a new control blocks legitimate work (for example a DMARC policy rejecting the agency software's emails), step back to the previous policy while the sender is fixed rather than removing the control.
Decision guidance by size
| Agency | Typical setup | Priorities |
|---|---|---|
| Independent single branch | Owner and a few staff, cloud agency software, one shared mailbox, local IT support | Bank change procedure, named accounts with MFA, password manager, DMARC, retention schedule. Cyber Essentials gives a useful target; see the Cyber Essentials Guide. |
| Multi-branch or franchise | Several offices, central accounts team, block management | Everything above, plus central payee control in the accounts team, conditional access, sign-in log review, a security clause in the IT provider contract. See Choosing an IT Support Provider or MSP Securely. |
| Large property manager or build-to-rent operator | In-house IT, tenant apps, building systems, many integrations | Everything above, plus monitoring of integrations and API keys, identity governance for staff and contractors, and the platform and building controls in the Cybersecurity for Real Estate and PropTech Guide |
Outsourced referencing, AML checks or block accounting move processing but not accountability: the agency remains responsible for choosing suppliers that protect the data and for confirming how they handle bank detail changes.
Detection and measurement
- Email: new forwarding or hiding rules, sign-ins from unexpected countries, impossible travel and MFA registrations on accounts staff mailboxes.
- Agency software: payee detail changes, permission changes and bulk exports of tenant or landlord records.
- Banking: new payees added, payments to accounts first used in the same week, and payee name check mismatches.
- External: lookalike domain registrations and copied listings on portals and social marketplaces.
| Metric | Target |
|---|---|
| Bank detail changes verified by call-back on file number with second approval | 100% |
| Users with MFA on email, agency software and banking | 100%, phishing-resistant for money and admin roles |
| Shared logins still in use | Zero outside the password manager |
| Leaver accounts disabled on the last working day | 100% |
| AML and referencing records past retention date | Zero at quarterly review |
| DMARC policy on the agency domain | p=reject |
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Named accounts, MFA and leavers | PR.AA-01, PR.AA-05 | AC-2, IA-2 | A.5.16 Identity management, A.5.18 Access rights |
| Staff awareness of payment diversion | PR.AT-01 | AT-2 | A.6.3 Information security awareness, education and training |
| Inventory of tenant, landlord and AML data | ID.AM-07 | CM-12 | A.5.9 Inventory of information and other associated assets |
| Retention and deletion | PR.DS-01 | SI-12 | A.8.10 Information deletion |
| Suppliers (referencing, software, IT provider) | GV.SC-05 | SA-9 | A.5.19 Information security in supplier relationships |
| Incident handling and reporting | RS.CO-02, RS.MA-01 | IR-6 | A.5.24 Information security incident management planning and preparation |
Common failure patterns
- Bank details changed on the strength of an email. A landlord or contractor "update" arrives from a familiar looking address and is keyed in by the person who received it, with no call and no second check.
- The call-back uses the fraudster's number. Staff ring the phone number in the suspicious email, which reaches the fraudster, instead of the number already on file.
- Shared branch passwords. One password for the agency software and the shared mailbox means no MFA, no record of who changed a payee and no clean way to remove a leaver.
- Documents left on open links. Referencing packs and AML documents are shared through public file links or a misconfigured transfer system, as in the ICO's £80,000 penalty against Life at Parliament View Ltd.
- Everything kept forever. Unsuccessful applicants' payslips and expired AML files stay in the system for years, despite the regulation 40 duty to delete after five years.
- Key codes next to tenant data. Key safe and alarm codes stored in the same record as tenant contact details turn a data breach into a physical security problem.
Practitioner checklist
- Enforce a bank detail change procedure: call-back to the number on file, second-person approval, new payee hold.
- Add the "we never change bank details by email" warning to tenancy agreements, terms, invoices and footers.
- Turn on dual authorisation and individual logins for client account banking.
- Give every staff member named accounts with MFA, and use phishing-resistant MFA for money and admin roles.
- Disable sign-in on shared mailboxes and move shared credentials into a password manager.
- Publish SPF, DKIM and DMARC, and move DMARC to p=reject.
- Alert on forwarding and inbox rules, MFA changes and payee changes in the agency software.
- Remove public file links and write a retention schedule for AML, referencing and right to rent records.
- Store key safe and alarm codes separately from tenant data and change them at tenancy end.
- Rehearse a diverted payment: bank recall, reporting and client communication.
Standards and references
- legislation.gov.uk: Client Money Protection Schemes for Property Agents (Requirement to Belong to a Scheme etc.) Regulations 2019
- legislation.gov.uk: Money Laundering Regulations 2017, regulation 40 record keeping
- legislation.gov.uk: Money Laundering Regulations 2017, regulation 4 business relationships
- HMRC: Money laundering supervision for letting agency businesses
- GOV.UK: Tenancy deposit protection, information landlords must give tenants
- ICO (published via Wired-Gov): Estate agency fined £80,000 for failing to keep tenants' data safe
- FBI IC3: Internet Crime Report 2024
Related NHI Mgmt Group resources: Cybersecurity for Real Estate and PropTech Guide, Conveyancing Completion Fraud, Business Email Compromise Response Playbook, Email Identity and BEC Guide.