Website Security for UK Surveyors and Property Consultants

Surveyors and the Property Transaction Chain

Surveyors sit at a critical point in the UK property transaction chain. Whether conducting RICS HomeBuyer Reports, building surveys, party wall assessments, or commercial valuations, surveyors hold data that has direct financial value — property addresses, purchase prices, structural defects, client identity documents, and mortgage lender details.

The property transaction chain is one of the most heavily targeted sectors for cybercrime in the UK. Conveyancing fraud, payment diversion scams, and business email compromise attacks targeting solicitors, estate agents, and surveyors have collectively cost UK consumers and businesses hundreds of millions of pounds. RICS firms are a recognised target.

The Royal Institution of Chartered Surveyors (RICS) has published guidance on cybersecurity risk management for member firms, and its Regulatory Standards require firms to manage client money and data responsibly. A data breach or fraud incident involving client property transaction data can result in regulatory action, professional indemnity claims, and significant reputational damage.

What Surveying Practices Handle Online

**Client instruction and engagement forms** — Name, address, contact details, property address, purchase price, mortgage lender, and the nature of the instruction. This is a combination of identity data and financial transaction data.

**Survey report delivery** — Completed survey reports are commonly delivered by email or via a secure portal. These reports contain a detailed description of the property's condition, defects, and valuation, along with the client's full name and the agreed purchase price.

**Identity verification documents** — Anti-money laundering (AML) checks require surveyors providing certain services to verify client identity. Passport copies and proof of address documents are highly sensitive.

**Fee quotes and invoices** — Surveyors send fee proposals and invoices that include bank account details. These are a prime target for payment diversion attacks.

**Correspondence with mortgage lenders** — Lender panel surveyors communicate regularly with lenders about valuations, including sensitive property and borrower information.

The Specific Security Risks for Surveying Practices

**Payment diversion fraud** — This is the most financially damaging risk. An attacker monitors email correspondence between a surveyor and a client, then at the right moment sends an email (appearing to come from the surveyor) informing the client that bank details have changed. The client pays the fee — and sometimes the property purchase deposit — to the attacker's account.

The attack typically works because the attacker has either compromised the surveyor's email account or is spoofing the surveyor's domain. A domain without DMARC enforcement and an email account without MFA are the two most common vulnerabilities exploited.

**Survey report interception** — A compromised email account gives an attacker access to every survey report delivered to clients. Survey reports contain detailed information about properties under offer — intelligence that is useful for burglary planning, insurance fraud, and targeted scams against buyers.

**Client identity document theft** — AML identity verification documents stored in email or an inadequately secured document management system are valuable for identity fraud. A set of passport copies and utility bills for multiple clients represents a ready-made identity fraud toolkit.

**Website contact form harvesting** — An outdated CMS or a poorly configured contact form can be exploited to harvest client enquiries and instruction details. Surveyors receive enquiries containing property addresses and purchase prices — useful data for fraud even before any formal engagement begins.

**CRM and practice management software** — Many RICS firms use cloud-based practice management software. Weak credentials or shared logins (multiple staff using one account) make these systems vulnerable to unauthorised access.

RICS Regulatory Context and Professional Indemnity

RICS member firms are required to maintain appropriate data security practices under RICS Conduct Rules and the broader UK GDPR framework. A cybersecurity incident that results in client financial loss or data exposure can trigger a RICS regulatory investigation in addition to an ICO notification obligation.

Professional indemnity insurance for surveyors often has specific provisions relating to cybercrime and fraud. Some policies exclude losses arising from payment diversion if the firm did not have basic security measures in place — including email authentication and MFA on email accounts. This is worth checking with your PI insurer.

The Solicitors Regulation Authority (SRA) and RICS have jointly highlighted the risk of property transaction fraud, and RICS has specifically called out email compromise as a leading cause of client losses in the sector.

The Surveying Practice Security Priority List

**Email and domain security (critical):** - Add SPF, DKIM, and DMARC records to your domain immediately — these prevent attackers from sending emails that appear to come from you - Enable multi-factor authentication on every email account at the firm — this prevents account compromise even if passwords are stolen - Train all staff to verify bank account change requests by telephone to a known number before acting

**Document security:** - Do not email survey reports or AML identity documents as unprotected attachments — use a secure portal or password-protected delivery - Do not store AML identity documents in email inboxes — use document management software with access controls - Set a retention policy for identity documents and delete them once the engagement is complete

**Website security:** - Ensure your contact and enquiry forms are served over HTTPS - If using WordPress, keep it updated and enable automatic security updates - Use strong, unique passwords and MFA for your CMS admin - Review your contact form setup — ensure submissions are not stored indefinitely in a database accessible from the web

**Fee and payment procedures:** - Include a statement in your engagement letter and on invoices that your bank details will never change by email - Consider a telephone confirmation step for any client paying a fee over a set threshold

Why Surveyors Should Scan Their Websites

Most surveying practices assume that because they are "just" a service business with a brochure website, they are not a meaningful target. This underestimates the value of the data flowing through that website and the email account attached to it.

A Yrzo AI scan of a surveying practice website will show whether your contact forms are properly secured, whether your email authentication records are in place, whether your login pages have brute force protection, and whether any security headers are missing from pages handling client data.

The Essential scan covers the public website and email security posture. If your firm uses a client portal or practice management software with a web interface, a Professional scan tests those authenticated surfaces too.

Property transaction fraud is not an abstract risk for UK surveyors — it is an active, ongoing campaign that targets firms of every size. The defences are not expensive or technically complex. But you need to know whether they are in place.