Payment and Transaction Fraud
Fraudsters target deposits, completion funds and supplier payments with convincing emails at exactly the right moment. Once the money has gone, recovering it is rarely possible.
Built Environment
Build on foundations attackers cannot shake.
Property firms, estate agents and construction businesses move large sums of money and share sensitive project data across many partners and sites. Attackers only need one weak link in that chain.
TOP THREATS: PROPERTY & CONSTRUCTIONSector focus
Payment and Transaction FraudFraudsters target deposits, completion funds and supplier payments with convincing emails at exactly the right moment.
Project Data TheftDrawings, bids, site plans and client details are valuable to competitors and criminals.
Building Management SystemsHeating, access control, lifts and CCTV are increasingly connected and remotely managed.
Multi-site OperationsTemporary site offices, shared devices and short term connections are hard to secure consistently.
The threat picture
Why attackers target property & construction
A property sale or a construction project involves dozens of parties exchanging documents, drawings and bank details by email. That is ideal ground for fraud, and for attackers looking to steal designs or disrupt a project.
We help property and construction organisations cut fraud risk, protect project and client data, secure the building management systems behind modern sites and meet the security expectations of public sector clients.
Project Data Theft
Drawings, bids, site plans and client details are valuable to competitors and criminals. Security information about sensitive buildings needs particular care.
Building Management Systems
Heating, access control, lifts and CCTV are increasingly connected and remotely managed. Weak passwords and exposed interfaces can give attackers physical consequences.
Multi-site Operations
Temporary site offices, shared devices and short term connections are hard to secure consistently. They often become the easiest way into the wider business.
Partner and Supplier Access
Architects, subcontractors and agents all need access to project systems. Every account that is not removed at the end of a project is a door left open.
Regulation and standards
The rules you work under
The obligations that shape security in property & construction, and how we help you meet them with evidence rather than paperwork.
Building Safety Act Golden Thread
For higher-risk buildings, safety information must be kept digitally, kept secure from unauthorised access and available to the people who need it, with changes tracked.
Official guidanceUK GDPR and the ICO
Agents, landlords and builders must protect personal data of buyers, tenants and staff and report qualifying breaches to the ICO within 72 hours of becoming aware of them.
Official guidanceCyber Essentials for Public Contracts
UK central government contracts that involve handling personal information or certain ICT services generally require suppliers to hold Cyber Essentials.
Official guidanceISO/IEC 27001
The information security standard many developers, public bodies and major contractors ask their supply chain to hold or align with.
Official guidanceIllustrative scenario
The Deposit That Nearly Went Missing
How a typical attack on property & construction unfolds, step by step. Press play to watch it run.
- 1The phish
An agent's email account is compromised through a fake file sharing link.
- 2The watch
The attacker reads emails about a sale that is about to exchange and learns the names, amounts and dates.
- 3The switch
The buyer receives an email from the agent's real account with new bank details for the deposit.
- 4Where it breaks
Email security spots the suspicious sign-in and forwarding rule, the account is locked, and the buyer follows the agent's published rule to always confirm bank details by phone.
Where Cybergen breaks the chain
Multi-factor authentication, email security, monitoring and a clear payment verification rule for clients stop the most common and costly fraud in the sector.
Illustrative example, not a real incident.
How we help
Security that fits how you operate
Sector insights
Latest thinking for property & construction
Protecting Real Estate Platforms from Data Breaches
Real estate data breach prevention for property platforms: common threats, proptech security gaps and practical steps to protect client data and privacy.
Read article · 8 min
How Construction Firms Can Protect Project Data from Cyber Theft
Cyber security for construction companies: how to protect project data, designs and payments from cyber theft. Practical steps to defend against phishing.
Read article · 10 min
Cyber security in Building Management Systems and Smart Sites
Building management system cyber security protects smart sites from attacks on HVAC, lighting and access controls. Learn the threats and how to secure access.
Read article · 9 minOther sectors
Explore more sectors
How do we protect clients from payment diversion fraud?
Secure your email accounts with multi-factor authentication, monitor for suspicious sign-ins and forwarding rules, and tell clients you will never change bank details by email.
Does the golden thread have security requirements?
Yes. Information about higher-risk buildings must be kept digitally, kept secure from unauthorised access and remain available to the people who need it.
Are building management systems really a cyber risk?
They can be. Connected heating, access control and CCTV systems are often exposed with weak passwords, and compromising them can have physical as well as data consequences.
Do construction firms need Cyber Essentials?
Many public sector and major contractor frameworks ask for it, and it is a sensible baseline for any firm that handles client data or connects to partner systems.
Get in touch
Talk to us about property & construction
Tell us about your organisation, the regulations you work under and what is worrying you most.
Prefer to talk? Call +44 (0) 1865 950 828
Or email [email protected]
Thanks, we've received your enquiry
A member of our team will be in touch to talk through your sector and requirements.