Website Security Basics for Real Estate Agencies Managing Vendor and Buyer Data

22 September 2026·5 min read

Quick answer: A real estate agency website needs basic, unglamorous ownership: real automated backups, 2FA on every admin login, a reviewed access list across every agent who's ever had a login, and a firm policy that settlement-related communication is always verified out-of-band, by phone, never by email alone. Most agency website incidents come from stale access and unverified email trust, not sophisticated hacking. 🚀

Real estate runs on trust and speed — vendors and buyers moving fast, large sums changing hands, and a lot of communication happening by email under time pressure. That combination is exactly what makes a compromised agency website so dangerous: it's not really about defaced pages, it's about a scammer using your enquiry form or a spoofed version of your email to slip fake "updated bank details" into a settlement conversation. This is a real, documented category of scam targeting the property sector, and it starts with basic access hygiene most agencies have never actually checked 💖. Here's the practical version, no jargon required.

What most real estate agencies get wrong about website security

Multi-agent offices are particularly prone to a specific gap: nobody agrees on who actually owns the website. The original developer built it years ago, an agent who's since moved on had the login, and the current admin might be a principal who's never actually logged in themselves. Everyone assumes someone else has it handled. Meanwhile the website's enquiry form and contact details are exactly what a scammer needs to look convincing when impersonating your agency mid-transaction — and settlement periods, with money moving and time pressure high, are prime targets.

The 5-minute security audit (copy this and actually do it)

Run through this with whoever manages the agency website. Yes or no, no essay required.

Access list: Do you have a current list of every login with website admin access, including agents who've left?
2FA: Is two-factor authentication on for website admin, domain registrar, hosting, and the linked email?
Backups: Are automated backups switched on, and has anyone confirmed a recent file exists?
Settlement communication policy: Does your team have a standing rule to verify any bank detail changes by phone, on a known number, never by replying to the email?
Domain access: Do you know which email controls your domain renewal, and is it agency-controlled rather than tied to one agent?

Less than five yeses is completely normal — now you know exactly where to start.

The spoofed settlement email: A vendor mid-settlement received an email that appeared to come from their agency, advising "updated bank details" for the sale proceeds. It was a spoof, timed perfectly around the real settlement date pulled from public listing information. The vendor's solicitor caught it only because they called the agency directly to confirm — a step that isn't always taken.

The ownerless login: A multi-agent office spent weeks arguing about who actually owned their website login after the original web developer left the industry entirely, taking institutional knowledge of the hosting and domain setup with him. No single agent or principal had ever been the named account holder, and recovering access required proving ownership to a hosting provider that had no record of who they were dealing with.

How to actually do this (plain English, no jargon)

2FA: in each account's security settings — admin, registrar, hosting, email — find "two-factor authentication" and link it to an authenticator app or text code.

Auditing access across a multi-agent office: log into the website admin, check "users," and cross-reference every login against your current staff list. Remove anyone who's left, and assign named, individual logins rather than one shared account everyone uses.

Settlement communication policy: put it in writing and brief every agent — any change to bank details or payment instructions gets a phone call to a known, previously used number before anyone acts on it, no exceptions.

Domain ownership: confirm the registrar account is under an agency-controlled email, not one tied to a specific agent who might leave.

💡 Bank detail changes by email should never be trusted on their own. This one rule, briefed to every agent and admin in your office, stops the most financially damaging scam in this category cold — and it costs nothing to implement.

Mistakes to avoid

Leaving website admin access with an agent or developer who's since left the industry.
No written policy on verifying settlement-related bank detail changes by phone.
One shared login used by the whole office instead of individual, revokable accounts.
Registering the domain under a single agent's personal email rather than the agency's.
Assuming a "professional-looking" email about settlement details is automatically genuine.

Please note: general information, not legal advice — check current official guidance before relying on it, and confirm specific requirements with your agency's IT or legal adviser given the vendor and buyer data your website and enquiry forms handle.

Frequently asked questions

How do we stop settlement scams targeting our vendors and buyers?

The single most effective step is a standing policy: any change to bank details or payment instructions is verified by phone on a known number before anyone acts on it, no exceptions, even if the email looks completely legitimate. Brief every agent and admin on this, not just settlements staff.

Who should own website access in a multi-agent office?

Ideally a named principal or office manager, with a current list of every login reviewed whenever an agent joins or leaves. It shouldn't sit with one individual agent whose departure could leave the whole office locked out.

What's the first thing to do if we suspect our website or email has been compromised?

Change passwords on hosting, registrar, and website admin immediately, take the site into maintenance mode if you can, and warn your team and any active vendors or buyers by phone that email communications should be verified before anyone acts on them.

Is this checklist enough, or do we need a proper security review?

For most agencies, working through this checklist and briefing your team on settlement verification covers the realistic risks. It's not a substitute for a proper security and process review if you're handling unusually high transaction volumes or have had an incident before.

Keep reading 🤍

Written by

Kate, founder of Chronically Online

I help Gold Coast and Brisbane businesses grow with branding, websites and marketing that actually works.

Work with me ✦