Trust money changes the risk profile
Most small businesses face cyber risk as a data problem. Agencies face it as a money problem, because trust accounts hold funds that move on written instruction, regularly, in amounts that make a single successful fraud significant.
That puts real estate in the same category as conveyancing and law: the attack that matters is payment redirection, and the defence has to include something that does not happen over email.
The process is simple and needs to be universal rather than individual. Any change to payment details is verified by voice, on a number the agency already holds, before funds move. Told to clients at the start, so a request to skip the check reads as the warning it is.
Everyone is mobile
Sales agents are in cars, at open homes, and in cafés, working from phones and tablets. Property managers are doing inspections. The office is where administration happens, not where the business happens.
Two consequences. Anything requiring someone to be at a desk will be worked around, so the mobile experience is the real experience. And company data is sitting on personal phones belonging to people in a high-turnover industry.
App protection policies are the right tool for the second: company data controlled inside company apps, removable on departure, with the agent’s personal phone left alone and unmonitored. Given turnover rates, the ability to remove agency data from a departing agent’s phone the same afternoon is worth having in place before you need it.
Offboarding is the recurring weak point
Real estate has high staff turnover, and every departure is an access revocation across a surprising number of platforms: email, the CRM, the property management platform, forms platforms, portal logins, marketing tools, shared storage.
Almost every agency revokes email promptly. A meaningful proportion leave the CRM and portal access live for months, because nobody maintained a list of what the person had.
The fix is administrative rather than technical: a maintained inventory of platforms and who holds access, and an offboarding checklist that covers all of them. Unglamorous, and it is the entire control.
Your data volume is larger than you think
A property management business holds identity documents, bank details, rental histories, references and inspection records for hundreds or thousands of people. That is a substantial personal data holding, and the Notifiable Data Breaches scheme applies to it.
Worth knowing where all of it is — including the copies in email attachments, on individual machines, and in the marketing folder — because a breach notification obligation requires establishing what was actually exposed.
Media storage
Property photography and video accumulate faster than any other content type in an agency and are routinely stored wherever there was room at the time.
Structured storage with an archive rule for older listings keeps it findable and keeps the backup window sane. It is a small piece of housekeeping that saves a recurring frustration.