Website Security for UK Letting Agencies

Why Letting Agencies Face Real Data Security Risk

Letting agencies hold a concentration of sensitive data that is remarkably attractive to attackers. Tenant referencing data includes National Insurance numbers, employer details, salary information, and banking references. Landlord records include property addresses, bank account details for rent payments, and in some cases, details about multiple properties they own. Property access details — keycodes, alarm codes, and key holder information — carry physical security implications that go beyond digital risk.

The letting agency is also a constant flow of financial transactions: rent collection, deposit protection, maintenance invoicing. Each of those flows is a potential target for payment fraud.

What Letting Agency Systems Hold

**Tenant referencing and application data** — Full names, dates of birth, National Insurance numbers, employer and salary details, previous tenancy references, and bank account information for standing orders. This is some of the most sensitive personal data in routine commercial use.

**Landlord banking details** — Sort codes and account numbers for landlord rent payments are stored against every managed property. Fraudulent modification of these details redirects rent payments to attacker-controlled accounts — a specific attack known in the sector.

**Property access information** — Key safe codes, alarm codes, emergency access instructions, and key holder details give anyone who obtains them physical access to occupied properties.

**Deposit protection records** — Deposit amounts, scheme references, and tenant bank details for deposit returns involve financial data requiring careful handling.

**Maintenance contractor details** — Contractor contact details, pricing arrangements, and access scheduling information are commercially sensitive and operationally important.

Common Vulnerabilities at Letting Agencies

**Weak portal authentication** — Landlord and tenant portals that use email and password alone without multi-factor authentication are vulnerable to credential stuffing. An attacker who compromises a landlord account could redirect rent payment banking details.

**Referencing data stored in email** — Tenant reference applications submitted by email are frequently stored in shared inboxes with no access controls beyond a single shared password. This creates a low-security store for the most sensitive data the agency holds.

**Outdated property management software** — Web-based property management systems require regular updates. Outdated installations have known vulnerabilities that are actively targeted.

**Phishing of property managers** — Property managers receive large volumes of external email from tenants, contractors, and landlords. This creates a high-probability phishing environment. A compromised property manager email account gives access to tenancy data, landlord banking details, and property access information.

**Insecure document delivery** — Sending tenancy agreements, referencing results, and landlord statements by unencrypted email without password protection exposes sensitive documents to interception.

Propertymark and ICO Obligations

Propertymark member agencies are expected to maintain appropriate data security standards. The ICO has taken enforcement action against letting agencies specifically for failures in referencing data handling and for breaches exposing tenant financial information.

The sensitivity of the data letting agencies hold — particularly National Insurance numbers and banking details — means that a breach is more likely to result in direct financial harm to the individuals affected, which the ICO weighs heavily in enforcement decisions.

Yrzo AI scans letting agency websites and identifies vulnerabilities in landlord and tenant portals, insecure referencing data handling, and authentication weaknesses that put client financial data at risk.