Agents are a prime target for payment fraud because large sums move on predictable dates. The essentials are: confirm bank details by phone before paying, keep ID and right to rent documents in a secure system, delete them on schedule, and switch on two-step verification for email and property software.
Stopping deposit and completion fraud
Criminals hack or impersonate email accounts and send convincing messages changing the bank details for a deposit, rent payment or sale proceeds. The money often moves on within hours.
- Never act on bank details sent or changed by email. Phone the person on a number you already hold.
- Tell landlords, tenants and buyers at the start that you'll never change your bank details by email.
- Have a second person approve large payments.
- Switch on two-step verification for every email account. A hacked agent mailbox is the starting point for most of these scams.
Right to rent records
If you carry out right to rent checks, the government's guidance is to keep copies of the tenant's documents for the time they're your tenants and for one year after. Store them in your property management system, not in email or downloads folders, and delete them when the period ends.
Anti-money laundering
Letting agency businesses must register with HMRC for anti-money laundering supervision if they handle individual rents of 10,000 euros a month or more. Estate agency businesses are supervised by HMRC too. Customer due diligence records contain ID documents, so they need the same protection as any other sensitive data.
Cyber Essentials for agents
Corporate landlords, housing associations and councils increasingly ask agents about security. Cyber Essentials is a clear way to answer. The checks most likely to catch agents out are shared logins on property software, laptops that no longer get updates, and missing two-step verification.
Common questions
How long should we keep right to rent documents?
The government's guidance is to keep copies for the time the person is your tenant and for one year after, then delete them securely.
Do letting agents need to register for anti-money laundering supervision?
Letting agency businesses must register with HMRC if they handle individual rents of 10,000 euros a month or more.
What's the most important cyber protection for an agent?
Confirming bank details by phone before sending money, and two-step verification on every email account.
Sources
- GOV.UK: Checking your tenant's right to rent, making copies of the documents
- GOV.UK: Money laundering supervision for letting agency businesses
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.