Cybercrime and Cyber Insurance

 

Australian real estate agencies have increasingly become prime targets for cybercrime, experiencing a surge in incidents such as email interception and compromise, payment redirection scams, identity theft, data breaches, and ransomware attacks. Criminals focus on high-value transactions and sensitive client information, leading to substantial financial losses. The Australian Bureau of Statistics reports that the real estate sector is one of the most severely affected by cybercrime. Surveys reveal that 1 in 6 businesses within this industry have encountered scams or fraud, while a quarter have experienced a cyber security incident, resulting in elevated risks of financial loss, reputational harm, and regulatory violations. As a primary target, the industry is subjected to frequent threats – often on a daily basis – due to its management of high-volume and high-value transactions alongside sensitive data.

The surging rise of scams is that of payment re-direct scams, with a notable case where a conveyancer’s email was compromised, leading to over $500,000 in buyer funds being stolen.

Common cybercrime vulnerabilities include weak or stolen credentials, unpatched and out of date software, phishing/social engineering, and misconfigured systems – third party tools, such as compromised apps or plugins to manage rental applications and low adoption of Cyber awareness training for all staff. Attackers frequently exploit these weaknesses for ransomware, unauthorised access, and data theft. 

While every agency should always have security on their systems to block suspicious websites and pop-ups, it is also the emails we receive and the updates to our systems that can potentially lead an agency into the hands of cyber criminals. We can always advise practices such as “don’t open suspicious emails”, however sometimes the emails don’t look suspicious. One agency had received an email that appeared to be from a utilities provider and after the property manager had opened the email the whole office system was affected.

Maintaining vigilance is crucial regarding emails, and staying informed about current phishing emails can often prove to be a challenging and time-consuming endeavour.

Prevention and protection strategies should always involve calling the recipient to confirm any changes to bank account details or before transferring funds at the settlement of a property. Additionally, it is essential to implement multi-factor authentication (MFA) on all emails and Trust Accounts.

Cyber threats have the potential to significantly disrupt operations, compromise sensitive data, and harm the reputation of the agency. Therefore, Cyber Insurance for real estate agencies is essential for protection against financial loss and data breaches. It can cover first and third-party losses, including forensics and legal fees.

While some policies offer limits, premiums vary based on agency size and risk, with insurers also mandating security protocols like multi-factor authentication (MFA), regular data backups, and encryption. 

Standard Professional Indemnity (PI) policies rarely cover cyber-attacks, making a standalone Cyber policy necessary.

Weak security measures and vulnerabilities within agency systems can be exploited by hackers to obtain unauthorised access to networks or to collect sensitive information, thereby jeopardising the security of both the agency and its clients.  Make sure that cyber protection is a regular topic of discussion with your colleagues and that cyber-vigilance is applied whenever using agency systems and emails.

Please don’t take the “it won’t happen to me” attitude to your business.  Ensure that you understand the risks of cybercrime and the cost and reputational impact that it could have on your agency.

Complete your property training with ACOP.