3 September 2026LANTEK Computers
Estate agencies are not targeted because their systems are weak. They are targeted because of the shape of a property transaction, and no amount of IT changes that shape.
Understanding why makes the defence obvious, and most of it is procedural rather than technical.
Why property specifically
The amounts are large and expected. A deposit or a transfer is a payment the buyer is already preparing to make. Nobody queries the existence of the payment, only its details.
The timeline is public. Anybody reading the correspondence knows roughly when money will move, because the process has known stages and everybody discusses them by email.
The buyer has no baseline. Most people buy property a handful of times in their life. They do not know what is normal, so a change of banking details with a plausible explanation does not stand out to them the way it would to a bookkeeper who pays the same suppliers every month.
There are many parties. Agent, buyer, seller, bond originator, two banks, conveyancer, sometimes a second agency. Every one of those is a mailbox, and a compromise at any of them produces a genuine message from a genuine address.
Everything happens by email. Offers, addenda, instructions, details. The channel that carries the transaction is the channel the attack uses.
That last point is worth sitting with. The attack does not have to breach the agency. It only has to reach any one of the mailboxes in the thread. How that unfolds is in the property transfer fraud that starts inside a real email thread and the general mechanism in how business email compromise works.
The control that matters most, and it is not software
Tell the client, at the very start, that banking details will never change by email.
In writing, at mandate or offer stage, before any money is discussed. Give them a telephone number, verified, that they must use to confirm any payment details. Tell them explicitly that any message saying details have changed is fraudulent, no matter how convincing, and no matter whose address it appears to come from.
Then repeat it. In the offer pack, in the email that carries the details, and verbally.
This works because it inoculates the person who will actually be at the keyboard. The buyer is the one making the transfer, and they are the one the whole attack is aimed at. Every other control on this page protects your systems. This one protects the transaction.
Agencies sometimes worry it looks alarmist or suggests their systems are insecure. In practice clients read it as competence, and it is the single intervention most likely to prevent a loss.
The technical controls, in order
Multi-factor authentication on every mailbox. Every agent, every administrator, the info@ address, and the principal. Agencies frequently have high staff turnover and a lot of mobile working, which makes this more important rather than less. Why it is not optional.
Alerting on forwarding rules. An external forwarding rule is the fingerprint of a compromised mailbox. Being told when one is created is one of the cheapest early warnings available.
Agents on company accounts, not personal ones. The common finding in agencies. Agents working from personal email addresses, or forwarding company mail to a personal account so it is easier on their phone. That takes the correspondence outside anything the agency controls, monitors or can recover, and it means a compromise of that personal account is a compromise of your transactions.
Devices that lock and encrypt. Agents work from cars, show houses and coffee shops. Phones and laptops get left places.
Access that ends when the agent does. Agencies have movement between them. An account still working after somebody has moved to a competitor is both a security and a commercial problem.
The POPIA side, which agencies underestimate
An agency holds a striking amount of personal information: identity documents, proof of income, bank statements, marital status, employment details. For FICA purposes it holds documents it is obliged to collect and then obliged to look after.
Three things follow.
Those documents need to be somewhere controlled. Not in a mailbox, not in an agent’s personal cloud storage, not in a WhatsApp thread. This is the most common finding we see in the sector.
Retention has to be a decision. There are obligations to keep records for defined periods. There is no reason to keep an unsuccessful applicant’s bank statements forever. Get the periods confirmed by your compliance adviser and then apply them.
The sector has its own framework on top. Property practitioners operate under regulatory requirements of their own, and those may add obligations about record keeping and client information. We are not citing a specific rule, because we would need the source in front of us. Confirm the current position with your compliance adviser, and be cautious about anything an IT supplier tells you about property regulation.
The general obligations are in what POPIA requires from a business with no IT department, with the checklist at the readiness checklist.
What to do if it has already happened
Speed is what determines whether any of the money comes back.
Telephone the bank immediately, not by email. Telephone the receiving bank. Change the affected mailbox password and sign every session out. Check for forwarding rules before assuming it is contained. Tell every other party in the transaction, by telephone, because their mailbox may be the compromised one rather than yours. Then take advice on notification, because personal information was almost certainly reachable.
The full sequence is in the first 24 hours.
The short version
Tell clients at the outset that details never change by email, and give them a number to ring. Multi-factor on every mailbox. Agents on company accounts. FICA documents somewhere controlled. Alerting on forwarding rules.
Five things, only two of which are technical.
What we do for the sector is on Real Estate and Property. If you would like to know whether any of your agency’s addresses and passwords are already circulating, the free dark web scan answers that in thirty minutes.