How phishing hits estate agencies

Why estate agencies sit in the crosshairs

Few small businesses in South Africa move larger sums of money by email than an estate agency branch. Between rental deposits, first-month rent, municipal clearance figures, commission splits and conveyancing transfer correspondence, six- and seven-figure EFT instructions pass through branch inboxes every week.

At the same time, an agency only works if staff open links and attachments from strangers. When a prospective buyer or tenant replies to a Property24 or Private Property listing with a link to a 'signed Offer to Purchase', a 'pre-approval certificate' or a 'complete FICA pack', the agent or branch administrator is expected to open it immediately. Attackers know this routine by heart.

Step 1: The fake offer or portal alert that steals the login

Most estate agency compromises do not start with Hollywood hacking; they start with a single link in an ordinary-looking email or WhatsApp Web message. The message claims to be a shared OneDrive, SharePoint, Dropbox or Adobe Sign document containing a signed lease agreement, an updated Offer to Purchase, or a buyer's FICA documents.

When the agent or administrator clicks the link, it opens a convincing replica of a Microsoft 365, Google Workspace or webmail sign-in screen. If the staff member types in their email address and password, the attacker captures those credentials immediately. Even worse, modern phishing kits proxy the login in real time so they can also capture a one-time SMS or authenticator code if the user enters it on the fake page.

Where protective DNS helps here is simple: when the link points to a domain on Google Web Risk's list of suspected phishing and malware sites, a DNS filter on the branch router answers 'does not exist' before the browser can even load the fake login page. It will not catch every brand-new page, which is why staff awareness and two-factor authentication still matter, but it stops known traps across every laptop and Wi-Fi phone in the branch.

Step 2: Silent inbox rules and rental deposit redirection

Once an attacker is inside an administrator's or agent's email account, they rarely send spam right away. Instead, they quietly create an inbox forwarding or 'sweep' rule that hides or forwards any email containing words like 'deposit', 'invoice', 'banking details', 'Nedbank', 'FNB', 'Standard Bank', 'Absa', 'Capitec', 'transfer' or 'trust account'.

The attacker then watches the conversation until the exact moment the agency emails a new tenant the invoice for their rental deposit and first month's rent, or emails a buyer the conveyancer's trust account details. Minutes later, using the real staff member's email account (or a near-identical lookalike domain), the attacker sends a 'corrected banking details' PDF claiming the agency's regular account is under audit or maintenance.

Because the email comes from the real thread and uses the tenant's real property address and move-in date, the tenant pays the scammer's account. By the time the agency notices the deposit has not cleared, the money has been withdrawn.

Step 3: FICA packs and SA ID numbers sitting on branch PCs

Under the Financial Intelligence Centre Act (FICA), estate agencies are accountable institutions that must collect and store identity documents, proof of residential address, tax numbers and often bank statements or payslips for buyers, sellers and landlords. At the same time, Section 19 of the Protection of Personal Information Act (POPIA) requires responsible parties to take reasonable technical and organisational measures to prevent loss of, damage to or unauthorised access to that personal information.

In many six- or eight-person branches, those FICA packs sit in shared folders or Downloads directories on the administrator's desktop PC. If an attachment installs information-stealing malware on that PC, the malware scans recent files for 13-digit South African ID numbers and bank account numbers and tries to smuggle them out to the attacker's server—often disguised inside DNS lookups because office routers allow DNS traffic out by default.

A DNS filter that inspects lookup names for valid 13-digit SA ID numbers (verified using the official check digit) and payment card numbers blocks those lookups at the resolver and alerts the principal on the dashboard.

Four practical habits for every agency branch

1. Never accept or issue a change of banking details by email alone. Put a bold notice on every lease, Offer to Purchase and email signature stating that your agency and its conveyancers will never change banking details by email, and require tenants and buyers to phone a known landline number before paying.

2. Turn on phishing-resistant two-factor authentication on every Microsoft 365 or Google Workspace mailbox, and check your mail settings monthly for unfamiliar auto-forwarding rules.

3. Don't leave years of old FICA ID copies in the Downloads folder of the front-desk PC; move completed files to access-controlled storage and clear local Downloads regularly.

4. Put a protective DNS filter on the branch router so known phishing links and DNS-based ID leaks are blocked for every computer on the office network.