Real estate is where very large one-off payments, detailed personal data and increasingly connected buildings meet, and attackers have learned to exploit all three. Agents, brokers, conveyancers, title and settlement firms, landlords, property managers and the PropTech platforms that serve them each hold a different part of the risk. This guide covers the sector's threat picture (transaction fraud above all), the regulation that applies across the US and UK, the security of smart buildings and tenant-facing platforms, and the controls to prioritise. It is written for security and IT leads at property firms and PropTech companies, compliance officers at brokerages and settlement providers, and anyone assessing real estate suppliers.
Key takeaways
- Transaction fraud dominates. Diverted deposits and closing funds cause the most direct loss, and the FBI's IC3 recorded 9,359 real estate complaints with losses of about US$173.6 million in 2024.
- The weakest party sets the risk. A purchase involves buyers, sellers, agents, lenders, title or conveyancing firms and their suppliers, and a single compromised mailbox among them is enough.
- Regulation follows the money and the data. Mortgage businesses fall under the FTC Safeguards Rule in the US, and all firms handling personal data fall under GDPR or state privacy and breach laws.
- Buildings are now networks. Building management, access control, cameras and smart home devices extend a landlord's attack surface to every property it manages.
- PropTech platforms concentrate risk. Tenant apps, listing portals and property management SaaS hold data and credentials for thousands of properties, so their API and identity design matters to the whole sector.
How the sector is structured, and why it matters for security
CISA places real estate in the Commercial Facilities critical infrastructure sector, alongside lodging, retail, entertainment and sports, with the Department of Homeland Security as the sector risk management agency. CISA's sector page lists physical security resources but no cyber guidance specific to real estate, so firms have to assemble their own baseline. Four segments face different risks:
| Segment | Main assets at risk | Dominant threat |
|---|---|---|
| Residential agents, brokers, conveyancers, title and settlement firms | Client funds in escrow or client accounts, identity documents, bank details | Payment diversion through email compromise and impersonation |
| Commercial landlords and property managers | Building systems, tenant data, rent and service charge collection | Ransomware, compromise of building technology vendors, invoice fraud |
| Residential landlords and build-to-rent operators | Tenant identity and referencing data, smart locks and home devices | Data breaches, account takeover of tenant portals, device compromise |
| PropTech platforms | Multi-tenant data across many clients, API keys and integrations into listing, payment and building systems | API authorisation flaws, credential stuffing, supply chain compromise |
Transaction and payment fraud
The pattern is consistent across markets. An attacker compromises or spoofs the mailbox of an agent, conveyancer or title officer, watches the transaction, and just before completion sends the buyer new bank details for the deposit or closing funds. Variants target sellers' proceeds, landlords' rent accounts and agents' commission payments. The IC3 2024 report recorded 9,359 complaints in its real estate category with losses of about US$173.6 million, and 21,442 business email compromise complaints with about US$2.77 billion in losses across all sectors. IC3's September 2024 BEC announcement advises verifying any change of account details through a secondary channel and, if a fraudulent transfer is found, contacting the bank immediately to request a recall and filing a complaint at ic3.gov.
| Scenario | ATT&CK technique | Control that breaks it |
|---|---|---|
| Agent or conveyancer mailbox phished and monitored | T1566.002 Spearphishing Link; T1078 Valid Accounts | Phishing-resistant MFA, alert on new inbox rules and external forwarding |
| Look-alike domain sends revised wiring instructions to the buyer | T1566 Phishing | Bank details given once at engagement, in person or through an authenticated portal, with a standing warning that they will never change by email |
| Funds sent to the attacker's account | T1657 Financial Theft | Call-back to a number from the original engagement letter; confirmation-of-payee or account verification services where available |
| Fraudster poses as the property owner to sell or mortgage it | T1657 Financial Theft | Strong identity verification of sellers, extra checks on vacant, unmortgaged or overseas-owned properties |
- Put payment details in a portal, not email: a client portal with MFA, where bank details are entered once and every change triggers a verified call, removes email from the critical path.
- Brief clients at engagement: state in writing that the firm will never change its bank details by email, text or phone, and repeat it in every email footer and before completion.
- Verify the seller: ALTA's Best Practices programme (now at version 5.0) publishes identity verification guidance for title and settlement companies, and UK estate agents and conveyancers carry customer due diligence duties under the Money Laundering Regulations. Treat unusual seller behaviour (remote only, urgent sale, cash buyer, vacant land) as a fraud signal.
See the Payment Fraud Guide, the Email Identity and BEC Guide and the Deepfake-Resistant Identity Verification Guide.
Regulation and industry requirements
Requirements depend on the activity, not the label a firm gives itself. Check each line of business separately.
| Instrument | Who it reaches in real estate | Key security expectation |
|---|---|---|
| FTC Safeguards Rule (16 CFR Part 314, US) | Non-bank financial institutions, including mortgage brokers and lenders; coverage depends on the activities a business undertakes | Written information security programme with a Qualified Individual reporting annually; MFA; encryption in transit and at rest; notify the FTC within 30 days of discovering a notification event affecting at least 500 consumers (in force since May 2024) |
| ALTA Title Insurance and Settlement Company Best Practices (US industry framework) | Title agents and settlement companies, usually required by underwriters and lenders | Written information security programme, identity verification and vendor vetting guidance; version 5.0 framework published October 2026 |
| US state privacy and breach notification laws | Any firm holding residents' personal data | Reasonable security and notification of affected residents and regulators |
| UK GDPR and EU GDPR | Agents, landlords, property managers and PropTech firms handling tenant, buyer and visitor data, including CCTV | Art. 32 security appropriate to risk; Art. 33 notification within 72 hours where required; DPIAs for intrusive monitoring |
| UK Money Laundering Regulations 2017 | Estate agents and letting agents within scope, supervised by HMRC | Customer due diligence, identity verification and record keeping |
| UK Building Safety Act golden thread | Accountable persons for higher-risk residential buildings | Building safety information kept digitally and secure from unauthorised access |
| UK PSTI Act and EU Cyber Resilience Act | Smart home and building device makers and importers, and PropTech hardware vendors | No universal default passwords, vulnerability disclosure, stated support periods (PSTI); essential cybersecurity requirements for products with digital elements (CRA) |
The US FinCEN residential real estate reporting rule has been the subject of litigation and its status has changed repeatedly, so it is not summarised here; confirm its current position with counsel. See the GLBA Safeguards Rule Guide, the UK PSTI Act Guide, the EU Cyber Resilience Act Guide and the Data Breach Notification Checklist.
Smart buildings and connected properties
A commercial portfolio may run building management systems (BMS), access control, lifts, CCTV, energy metering and tenant Wi-Fi across hundreds of sites, mostly installed and supported by different contractors. Residential landlords add smart locks, thermostats, doorbells and leak sensors. The ICO notes that smart doorbells and wireless cameras are increasingly common and that some uses of facial recognition can be especially intrusive, so monitoring choices are a privacy decision as well as a security one.
- Inventory first: list every connected system per building with owner, maintainer, firmware version, remote access route and credential holder. Most landlords cannot do this on day one. See the Building Management System Security Guide.
- No direct internet exposure: building controllers and camera recorders should not be reachable from the internet (ATT&CK for ICS T0883 Internet Accessible Device). Vendor support goes through a brokered, logged remote access service. See the OT Remote Access Guide.
- Segment per building and per system: building systems, tenant networks and the landlord's corporate network must not share a flat network.
- Buy secure devices: use NIST IR 8259A's core device capabilities (device identification, device configuration, data protection, logical access to interfaces, software update and cybersecurity state awareness) as procurement criteria, and require PSTI or CRA conformity where it applies. See the IoT Security Guide.
- Plan for tenant turnover: smart locks and home hubs must be reset and re-enrolled between tenancies, with access codes and app accounts of the previous occupant revoked.
PropTech platform security
Property management systems, tenant apps, listing portals, digital referencing and e-signing platforms are multi-tenant SaaS products holding data for many landlords and agents. Their failures scale across the sector.
- Object-level authorisation: a tenant must never be able to retrieve another tenant's lease, payment history or door code by changing an identifier. This is OWASP API Security Top 10 2023 API1:2023 Broken Object Level Authorization. See the OWASP API Top 10 API1 Broken Object Level Authorization Guide.
- Tenant isolation: separate each client's data logically and test the separation. See the Multi-Tenant SaaS Architecture Security Guide.
- Customer account protection: credential stuffing against tenant and landlord portals is cheap for attackers; offer passkeys, rate-limit logins and detect anomalous sign-ins. See the Account Takeover Prevention Guide.
- Payment flows: rent and deposit collection should use the payment provider's hosted components so card and bank data stay out of the platform's scope.
- Identity documents: referencing and right-to-rent checks collect passports and payslips; encrypt them, restrict staff access and delete them on a defined schedule. See the Data Retention and Secure Deletion Guide.
Where identity fits
Real estate depends on machine-to-machine trust more than it appears. Listing portals pull feeds from agency software, property management systems push to accounting and payment platforms, and building systems report to cloud dashboards. Each link is an API key, OAuth grant or service account, often created by a vendor during onboarding and never reviewed. Keep an inventory of integrations per system, give each its own scoped credential, store secrets in a vault, rotate them when a vendor relationship ends, and review OAuth grants into email and document platforms quarterly. See the API Key Management Guide and the Third-Party Access Guide.
Priority controls and decision guidance
| Priority | Control | Independent agency or small landlord | Large brokerage, REIT or PropTech platform |
|---|---|---|---|
| 1 | Payment instruction security | Written "we never change bank details by email" notice; call-back on a known number before every transfer | Client portal for payment details, verified change workflow, account verification before release |
| 2 | Mailbox protection | MFA on email for all staff, block auto-forwarding to external addresses | Phishing-resistant MFA, conditional access, DMARC at p=reject, alerting on inbox rules |
| 3 | Personal data protection | Identity documents stored in an encrypted, access-controlled system, not inboxes | Data classification, DLP on identity documents, retention automation |
| 4 | Backup and recovery | Cloud backup of email and client files | Immutable backups of transaction, property management and finance systems with tested restores |
| 5 | Building technology | Change default passwords on managed devices; reset smart locks between tenants | Portfolio-wide asset inventory, segmentation standard, brokered vendor access |
| 6 | Supplier assurance | Ask key software suppliers for MFA and backup evidence | Structured third-party risk programme with contract clauses and annual review |
Build or buy building security: landlords with a few properties should require secure configuration and remote access controls from their facilities management contractor in the contract. Portfolios of dozens of buildings or more usually justify a central OT and IoT monitoring capability, because no single contractor sees the whole estate.
Rolling it out
- First month: issue the bank details warning to all active clients, introduce call-back verification, enable MFA on email and block external auto-forwarding. Test with a simulated change request to the finance or completions team.
- Months 1 to 3: move to phishing-resistant MFA for staff who handle funds, enable conditional access in report-only mode first and enforce by group, keeping an excluded and monitored break-glass account so a bad policy can be rolled back.
- Months 2 to 4: map where personal data and identity documents live, move them out of mailboxes and shared drives, and set retention.
- Months 3 to 6: inventory building systems across the portfolio, starting with the largest or most sensitive buildings; remove internet exposure and route vendor access through a brokered service.
- Months 4 to 9: review integrations, API keys and OAuth grants; add security schedules to supplier contracts at renewal.
- Ongoing: test restores, run an incident exercise built around a diverted completion payment, and review metrics quarterly.
Detection and measurement
- Log and alert on: new inbox rules and forwarding, sign-ins to finance and completions mailboxes from unfamiliar locations, changes to client or supplier bank details, newly registered domains resembling the firm's own, bulk downloads from document management systems, and remote sessions to building systems outside agreed windows.
Metrics:
- Percentage of outgoing client fund transfers preceded by a recorded call-back verification (target 100 per cent).
- Share of staff handling funds on phishing-resistant MFA.
- Number of building system devices directly reachable from the internet (target zero).
- Percentage of buildings with a complete connected-asset inventory.
- Integrations and API keys with a named owner and review in the last 12 months.
- Time to recall request after a suspected diverted payment is reported.
Framework mapping
| Real estate control | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| MFA for staff and clients | PR.AA-03 | IA-2 | Control 6 | 8.5 |
| Personal data and identity document protection | PR.DS-01 | AC-3 | Control 3 | 5.34, 8.11 |
| Supplier and PropTech vendor requirements | GV.SC-05 | SR-3, SR-6 | Control 15 | 5.19, 5.20 |
| Building system segmentation and remote access | PR.AA-03 | AC-17, SC-7 | Controls 12, 13 | 8.20, 8.22 |
| Integration and device credential inventory | PR.AA-01 | IA-5 | Controls 1, 5 | 5.9, 5.17 |
| Backups | PR.DS-11 | CP-9 | Control 11 | 8.13 |
Common failure patterns
- Bank details sent by email: once clients are used to receiving payment details by email, a spoofed or hijacked email with new details looks normal.
- Verification by reply: staff "verify" a changed account by replying to the same email thread or calling the number in the suspicious message, which reaches the attacker.
- Identity documents in inboxes: passports and bank statements accumulate in mailboxes and shared drives for years, so a single mailbox compromise becomes a reportable data breach.
- Building systems left on vendor defaults: controllers and recorders installed with factory credentials and opened to the internet for remote support, with no one at the landlord aware they exist.
- Previous tenant still has access: smart lock codes, building app accounts and access cards not revoked at move-out.
- Unreviewed integrations: API keys created for a listing feed or payments partner years ago, never rotated and still active after the relationship ended.
Practitioner checklist
- Tell every client in writing that bank details will never change by email, and verify every transfer by call-back to a known number.
- Enforce MFA on all mailboxes, with phishing-resistant methods for staff who handle funds, and block external auto-forwarding.
- Set DMARC to p=reject and monitor look-alike domain registrations.
- Move identity documents out of email into an encrypted system with retention rules.
- Confirm which regulations apply per business line (FTC Safeguards, ALTA, GDPR, Money Laundering Regulations, state breach laws).
- Inventory connected building systems per property, remove internet exposure and broker vendor access.
- Reset smart locks, codes and app accounts at every change of tenancy.
- Inventory integrations, API keys and OAuth grants, assign owners and rotate on supplier exit.
- Test object-level authorisation and tenant isolation in every PropTech release.
- Rehearse a diverted completion payment incident, including the bank recall and regulator notification steps.
Standards and references
- FTC: FTC Safeguards Rule, What Your Business Needs to Know
- ALTA: Title Insurance and Settlement Company Best Practices
- NIST: IR 8259A IoT Device Cybersecurity Capability Core Baseline
- CISA: Commercial Facilities Sector
- ICO: Guidance on video surveillance (including CCTV)
- GOV.UK: Keeping information about a higher-risk building, the golden thread
- FBI IC3: 2024 Internet Crime Report
- FBI IC3: Business Email Compromise, the $55 Billion Scam
Related NHI Mgmt Group resources: Cybersecurity for Construction Guide · Building Management System Security Guide · Third-Party Risk Management Guide · Business Email Compromise Response Playbook. This guide summarises regulatory requirements relevant to real estate and is not legal advice.