11350 – Cybersecurity & Data Protection

Real estate agencies hold an unusually concentrated pool of sensitive data — identity documents and financial information from tenant screening (Tenant Screening, 11210), trust account funds and banking details (Financial Management in PM, 11240), and settlement figures worth hundreds of thousands of dollars moving through email correspondence at closing (Closing, 11130). That combination makes agencies a specifically documented target for financial fraud, not just a generic data-privacy concern, and this entry treats security as a business-continuity issue rather than an IT afterthought.

The threat that matters most in practice isn’t a sophisticated technical breach — it’s a comparatively simple social-engineering attack exploiting the trust and urgency built into a normal transaction. Understanding that distinction changes where an agency should actually put its limited security effort: less on exotic technical defences, more on the specific verification habits that close off the fraud pattern described below.

This entry covers:

• Business email compromise and settlement-redirection fraud specifically
• Baseline security practice — multi-factor authentication, access control
• Data breach response and notification obligations

This entry does not cover:

• The trust accounting discipline this entry’s fraud risk most directly threatens → addressed in Financial Management in PM (11240) and Trust Accounting Compliance (11440)
• General data-handling and consent obligations covered at the point of collection → addressed in Lead Generation (11110) and Tenant Screening (11210)
• Platform-specific security features of any one category of software — addressed within each relevant entry (CRM Platforms, 11310; Transaction Management & E-Signature, 11380) where it’s a distinguishing factor

The Privacy Act 1988‘s Notifiable Data Breaches (NDB) scheme requires organisations to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) of an eligible data breach — one likely to result in serious harm — as soon as practicable after becoming aware of it.^1,2 Real estate agencies’ concentration of identity, financial, and trust-fund data, described above, makes this a live obligation rather than a theoretical one. The NDB scheme binds every agency the Privacy Act covers: those above the $3 million small-business turnover threshold in full, and, since 1 July 2026, every agency regardless of turnover in respect of personal information handled as a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. A broader removal of the small-business exemption remains a proposed reform, not enacted law.^3,4,5

Trust account fraud specifically also intersects with the trust accounting compliance regime discussed in Financial Management in PM (11240) and Trust Accounting Compliance (11440) — a fraudulently redirected settlement payment is both a cybersecurity incident and a trust-account event, and an agency’s response needs to address both angles, not treat it purely as an IT problem.

Making Callback Verification a Standing Rule

The single most effective practical defence against settlement-redirection fraud is a standing rule to verify any changed bank account details by phone, using a previously known number, before actioning a payment — never by replying to the email that provided the new details, since that email is exactly what a compromised or spoofed account would send. This rule needs to apply without exception, including when the changed details arrive from what appears to be a trusted, familiar contact.

Getting the Fundamentals Right First

Basic controls — MFA on email and core systems, defined access levels, and staff awareness of the business-email-compromise pattern described above — close most of the real-world attack surface an agency actually faces, and are consistently more valuable than expensive security tooling layered on top of weak fundamentals. An agency evaluating security spend should confirm these basics are genuinely in place before investing further.

Common Mistakes

The most common mistake is actioning a bank-detail change based solely on an email instruction, without an independent verification call. A second is treating cybersecurity as a purely technical, IT-owned problem rather than a process discipline every staff member handling settlement funds needs to understand. The third is having no documented incident response plan, leaving an agency to improvise its notification and containment steps under pressure during an actual breach.

1. Privacy Act 1988 (Cth) — Federal Register of Legislation
2. About the Notifiable Data Breaches scheme — Office of the Australian Information Commissioner
3. Small business — Office of the Australian Information Commissioner
4. Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act (updated 28 August 2026) — Office of the Australian Information Commissioner
5. Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — Federal Register of Legislation