Cyber Exposure Checklist for Estate Agents

What counts as cyber exposure for estate agents?

Estate agents live publicly in a way most other businesses do not.

Negotiator names and mobile numbers appear on Rightmove and Zoopla listings. Branch managers show up in local press. Directors are listed at Companies House with service addresses that may still be home addresses. Agency principals show up on data broker sites with previous addresses, household links, and associated email addresses.

Then there is the breach side. Personal emails used for work systems, portal registrations, or old industry accounts appear in breach databases more often than people expect. An account from a previous agency. A Gmail address used to sign up for a property software trial. These surface with passwords, recovery addresses, and linked accounts.

There are also lookalike domains. Fraudsters register variations of agency names — sometimes weeks before a transaction completes. A domain with a one-letter change can carry convincing emails to buyers or solicitors at exactly the wrong moment.

Exposure includes: portal agent profiles with mobile and photo, branch contact pages with direct emails, director Companies House filings, broker records with address and household data, personal emails in breach databases, and lookalike or registered agency domain variants.

None of this requires hacking anything. It is the result of how estate agencies operate publicly — and how that visibility gets used by people who study it before acting.

Why property firms get targeted

Property transactions involve large, one-way payments. And the timing is predictable.

Buyers and solicitors are conditioned to receive urgent messages near exchange. They trust agency email addresses. They act quickly when something about a deposit or bank detail change feels like it needs immediate attention. That combination — trust, urgency, and a large sum — is exactly what makes property transactions a consistent target.

The exposure side makes it easier to build a convincing attack. A negotiator's name, branch email format, and mobile number are on Rightmove. The agency domain is well-known. The buyer knows who they are dealing with. A fraudster with access to those details can construct a message that feels like it came from the right person at the right firm.

It does not require compromising any internal system. It requires enough public context to make an email look plausible and enough knowledge of the transaction to make the timing feel right.

Senior staff add another layer of risk. A director's name, home address, and family links visible on broker sites give attackers authority context they can use to impersonate leadership or pressure junior staff. The pattern is the same as CEO fraud in other sectors — but in property, the transaction window is the trigger.

The fraud path attackers actually use

Here is how a realistic property fraud pretext gets built.

A negotiator's name, email format, and branch mobile are on the Rightmove listing for an active property. The attacker notes the branch, the agent's name, and the agency's domain.

Next, they run the negotiator or branch manager through a data broker. They find a mobile number, a previous address, and a linked email address — sometimes matching the one already on Rightmove, sometimes a personal one.

They check Companies House for the director's service address. Still listed as a home address in some cases. They run a breach check on the personal email. It appeared in an old data breach. They now have a detailed picture of two or three people at the agency.

Then they register a lookalike domain — maybe the agency name with a hyphen or a different extension. They monitor the target property listing.

When exchange is close, they send an email to the buyer's solicitor — appearing to come from the agency — with updated payment details. Or they send one directly to the buyer with a bank account change request.

Total time to build the pretext: under an hour. The payment, if it goes through, is immediate and largely unrecoverable.

The agency often does not know it happened until the buyer calls to confirm the transaction.

The 15-minute branch exposure check

This is a process for agency owners, branch managers, or operations teams. It does not require collecting or sharing staff personal data — you are checking what is already publicly visible.

Start with your most active negotiators and branch managers. Search each name in quotes on a standard search engine. Note what contact details appear on the first two pages — portal profiles, branch pages, press mentions, event listings.

Run the name through one or two data broker sites. Note whether a personal mobile, home address, or household connection is visible without a subscription.

Check Companies House for any director filings. Look at the service address — is it a home address?

Run any known work or personal email addresses through a breach checking service. Note what was exposed and when.

Search for your agency domain with one-letter variations and alternative extensions. Note any registered lookalike domains.

Document what you find for each person reviewed. You are not trying to remove everything in one session. You are getting a clear picture of where the highest-risk exposure sits before anything happens.

Most agencies find exposure and then lose track of it.

They ask a portal to update a contact. They do not record when they asked, or whether it changed. Six months later they are not sure if the old mobile is still showing. A transaction gets close to exchange and nobody has checked.

A basic exposure log makes this manageable. For each staff member — starting with negotiators on active listings, branch managers, and directors — record: which site holds the data, what is visible, when you found it, what action you took, any confirmation reference, the expected response window, who owns follow-up, and when you will recheck.

A shared spreadsheet is enough. The point is that anyone in the team can open it and see what is done and what is not. That visibility matters most when a transaction is moving quickly and nobody wants to be guessing.

The honest version: exposure comes back.

Broker sites re-aggregate from public sources continuously. Portal contact details change when staff update their profiles. New breach data enters databases on a rolling basis. A negotiator who joined in the last six months may not have been checked at all.

What works: assign one person who owns the exposure log — branch manager, ops lead, whoever runs admin processes — and give them one hour a month. Check two or three current staff each month, rotating through the team. Add an exposure check to your process when someone joins or leaves. Keep the log updated so pending removals do not get forgotten.

The goal is not to clear every piece of public data. It is to remove the combinations that matter — the ones that connect a name to a mobile to a home address to an active transaction. One hour a month, done consistently, beats an intensive review once a year that nobody follows up on.