The technology problems that actually bite independent lettings agents

A tenant has been approved and is about to move in. They get an email that looks exactly like the last six — your branding, your negotiator’s signature, the right property address — with the account details for the deposit and first month’s rent. They pay. You find out on move-in day.

This is the single most damaging thing that happens to small agencies, and it usually does not involve breaking into your systems at all. Either the attacker is in the tenant’s own mailbox reading the thread, or they have simply registered a domain one character different from yours and copied your signature block off your website. The tenant has lost money they had saved for a year, they blame you, and the complaint goes to your redress scheme. Reported rental fraud is getting less frequent and considerably more expensive, which is what you would expect if criminals are moving from scattergun fake listings to patient, targeted interception.

Right to rent checks mean copies of passports, visas and share codes for every adult in every managed property, plus the ones who applied and were not successful. They are scanned, emailed to the branch, and saved wherever there was room.

The document set exists because the law requires it, and the penalties for getting the check wrong are now serious money rather than a slap: since 13 February 2024 a first breach can cost up to £5,000 per lodger and £10,000 per occupier, rising to £10,000 and £20,000 for a repeat. So you must keep the evidence. But keeping it turns a four-person agency into a warehouse of the exact documents used to open bank accounts and take out credit in someone else’s name — including for applicants who never became tenants and have no idea you still hold them. The failure I find is never a decision. It is an email attachment nobody deleted, a shared folder everybody can open, and a scan-to-email folder on the office printer that has been filling up since 2019.

Rent comes in, deductions come off, landlord payments go out, deposits sit in a scheme, and the whole thing is reconciled in the property management software by one person who knows how it works.

You have been legally required to belong to an approved client money protection scheme since 1 April 2019, and a local authority can impose a financial penalty of up to £30,000 for not being in one. That is the floor, not the risk. The real exposure is that client money moves on instructions produced by software, sent by email, and authorised by whoever is at the desk — and if someone is reading your mailbox, all three of those are compromised at once. The deposit side has its own trap: the legal duty to protect a deposit within 30 days sits with the landlord, not with you, so when it is missed because of something at your end the landlord takes the penalty of between one and three times the deposit and then takes their portfolio somewhere else.

A tenancy application generates an employer reference, a previous landlord reference, a credit check, three months of bank statements, and a guarantor’s details. Multiply by every applicant for every property since you opened.

Tenants and guarantors did not choose you — they chose a house — and you now hold the financial history of people who have no relationship with you at all. Most agencies have no retention position on this whatsoever, which means the oldest and most sensitive material is also the least protected and the most likely to be sitting in a mailbox rather than a system. It is worth knowing that the ICO does fine small firms for this kind of thing, and does not need a headline-sized breach to do it.

Phase 1 came into force on 1 May 2026. Every tenancy is periodic, no-fault eviction is gone, and possession now depends on establishing a ground — which means it depends on what you can prove.

Before, a landlord who wanted the property back could serve a section 21 notice and largely avoid the argument. Now the argument is the process, and the argument is won or lost on records: the notices you served, the dates you served them, the rent account, the repairs you logged and when, the correspondence. An agency whose evidence is spread across a CRM, a personal inbox and a WhatsApp thread is going to lose cases it should win, and the landlord will conclude that the agent is the problem. More is coming: Phase 2 from late 2026 brings the private rented sector database and the landlord ombudsman, though registration is being rolled out region by region and landlords are not expected to be required to join until 2028. This is a records problem long before it is a software problem.

Most independents do both. The lettings side feels like the regulated one because of deposits and client money, and the sales side feels like the simpler half.

It is the other way round. Any business carrying out estate agency work must register with HMRC for money laundering supervision regardless of transaction value, whereas letting agency work is only caught where an individual tenancy is at or above the €10,000-a-month threshold — which almost none of yours will be. So the sales desk you think of as the straightforward one is the part that obliges you to run customer due diligence, keep the records, do the risk assessment and appoint a nominated officer. And AML records are, by their nature, exactly the identity documents from problem 2 — held for longer, under a legal duty, in the same shared folder.

The CRM is unavailable, or the office internet is down, on a Friday afternoon in February. There are viewings booked, a contractor waiting for a purchase order, and a tenant with no heating.

Other businesses that lose a day lose a day’s turnover. You lose your ability to discharge a legal duty to keep a property fit to live in, on the day the duty is most obviously engaged — and the tenant’s account of it will be that the agent did nothing. Bear in mind too that the standard ransomware playbook is to encrypt on a Friday evening, when nobody is watching. If the property management system, the keys register and the contractor list are all on one machine in the back office, that machine is the agency.

One CRM login the whole office uses, one portal account for Rightmove, one email password everyone knows, and a staff list that turns over faster than any other part of the business.

Lettings has more people coming and going than almost any comparable trade, and shared logins mean nothing is ever really removed when they go. You also lose attribution: when a landlord’s bank details are changed, a deposit is registered late, or a tenant’s documents are downloaded, you cannot say who did it. The way in is rarely clever. The ICO fined a small professional firm £60,000 after attackers reached its network through an infrequently used administrator account that had no MFA on it — a forgotten login, not a sophisticated attack.

Contractors, the inventory clerk, the referencing provider, the deposit scheme, the conveyancer on the sales side, and every landlord’s personal webmail.

Confidential material moves between all of them constantly, mostly by email, and their security is not something you control. A landlord with a compromised personal email account is a genuine route into your rent payments, and neither of you will spot it quickly. This is also the mechanism behind problem 1: the attacker does not need to be in your systems if they can be in the mailbox of someone who emails you every week. The same pattern that hits conveyancing on completion day hits you on move-in day, for smaller sums and far more often.