A supplier’s emailed bank-detail change can look routine. Yet client or service-charge money may land in a fraudster’s account.
For estate and property managers, one compromised mailbox or resident portal can expose tenant and landlord data. It can also disrupt building operations and raise urgent questions about repayment.
This is general information, not insurance or legal advice.
Cyber cover for property firms: what drives the need
Cyber cover is usually worth considering if your firm stores tenant or landlord data. It also matters if you hold client money or use email for payment changes.
It also matters when you depend on cloud property-management software. A cyber incident is a harmful digital event.
Ransomware can lock files. A criminal can also take over an email account.
Property data creates a real duty
Property firms often hold names, addresses, bank details, tenancy records and repair reports. A lost laptop or hacked portal can expose all of this data.
The Information Commissioner’s Office expects organisations to keep personal data secure. Its guidance applies to small property firms as well as large landlords.
A cyber policy can fund expert help after an attack. It does not remove your duty to protect data before one occurs.
Payment fraud needs cyber, crime and PI checks
A spoofed invoice or changed bank detail can trigger cyber, crime and professional indemnity insurance. Each policy may treat the loss differently.
| Policy type | Typical trigger | Payment fraud position | Key check |
|---|
| Cyber insurance | Ransomware, breach or system attack | Only if a social-engineering or funds-transfer extension applies | Fraud limit and verification rules |
| Crime insurance | Theft, employee dishonesty or external fraud | May respond, subject to wording and client-money exclusions | Who owns the lost funds |
| Professional indemnity insurance | Negligent professional service | May address a claim against you, not the direct theft | Cyber and fraud exclusions |
| Public liability insurance | Injury or physical property damage | Usually not relevant to email fraud | Do not treat it as cyber cover |
The same stolen payment can fall within the scope of several policies. The wording decides which policy responds.
Controls insurers may require
For a block manager, cyber risk is not limited to a database breach. A compromised managing-agent mailbox can redirect service-charge payments.
It can alter contractor instructions or expose leaseholder arrears data. It can also send convincing urgent funding requests to a freeholder.
The position becomes more complex when the firm operates client accounts. The policy may insure the manager’s loss or a claim against them.
It may insure neither loss. Ownership of the money and policy wording decide the result.
Check cyber cover, crime insurance and client money protection before relying on any policy. This matters for reserve funds, service charges and supplier payments.
Portals, smart locks and BMS change the risk
Resident portals, smart locks, CCTV, access-control systems and building management systems should be disclosed to an insurer. These systems can affect both safety and business continuity.
A hacked portal may expose resident data. A disrupted access system may prevent contractors or residents from entering a building.
Tell insurers about connected building technology before cover starts. Undeclared systems can create disputes when you make a claim.
A property-firm cyber incident: the first 72 hours
0 to 2 hours
Isolate the affected device. Preserve emails and call the insurer.
Same day
Use approved forensic and legal support. Stop suspect payments.
Up to 72 hours
Assess personal-data impact. Check whether ICO notification is required.
A security key for payment staff
🛒
Recommended product
A USB security key can help protect accounts used for client-money approvals. It can also protect property-management platforms.
Choose one that works with your email provider. Test it with spare administrator access first.
- It adds a physical check when staff sign in to payment and email accounts.
- It reduces the risk that a stolen password opens a resident portal.
- It supports multi-factor authentication when insurers ask for stronger access controls.
View on Amazon →
Payment controls should sit within an incident plan. Do not leave them to staff judgement during a busy maintenance period.
For each new or changed payee, call a previously verified number. Require dual approval and keep the confirmation record.
Never use the phone number in the change email. That number may belong to the fraudster.
Apply multi-factor authentication to email, banking and property platforms. Review administrator access and set alerts for mailbox forwarding rules.
Resident portal security matters too. Restrict access by role and remove departed staff promptly.
Test recovery procedures before an incident. A backup is useless if no authorised person can restore it.
If an incident may affect personal data, preserve evidence and assess the risk to people. Record why you did or did not notify the ICO.
Notify the ICO within 72 hours where feasible. This rule applies when the breach is likely to risk people’s rights and freedoms.
Choose limits for systems, data and client money
Choose a cyber limit based on serious outage and response costs. Do not base it only on the number of managed flats.
A useful limit should reflect your largest routine supplier payment. It should also reflect likely forensic, legal and recovery costs.
This is where many property firms underinsure. A low limit can be exhausted before systems return to normal.
A buying checklist that avoids gaps
- Confirm a 24-hour incident-response line. Ask if insurer approval is needed before appointing IT support.
- Ask if ransomware, forensic work, legal advice, recovery and business interruption share one limit.
- Ask whether these costs have separate limits. Shared limits can reduce funds available later.
- Request written confirmation for social engineering, invoice fraud and funds-transfer fraud involving client funds.
- Check the waiting period before business-interruption payments begin. It can range from 0 to 24 hours.
- Test offline backups. Ensure at least two authorised people can access critical accounts securely.
A property management cyber cover policy should be tested against three separate cost types. These are response costs, liability and stolen-money losses.
It will commonly pay for forensic work, legal and privacy support, and data restoration. It may also pay notification costs and business interruption after a covered event.
It may not repay a voluntary bank transfer after a fake bank-detail email. It may also exclude contractual penalties or pre-existing system weaknesses.
Estate managers should ask for ransomware cover and email account takeover response. They should also ask for social engineering and funds-transfer fraud cover.
The fraud limit must match meaningful supplier or service-charge payments. A small fraud sub-limit may not protect reserve funds.
Common questions
Does a property manager need cyber insurance?
Usually yes, if the firm holds personal data or takes digital payments. It also matters if the firm relies on email and property software.
It is less relevant without meaningful personal or financial data. That position is unusual in England.
Does cyber insurance cover a fake supplier?
Sometimes, if the policy includes social-engineering or funds-transfer fraud cover. Its conditions must also be met.
Check whether call-backs and dual approval are required. Check for a separate fraud limit too.
How much does cyber insurance cost in the UK?
Small firms may see annual premiums from roughly £300 to £1,500. Firms with larger client-money exposure or complex systems can pay more.
Turnover, staff numbers and claims history affect the price. Security controls, chosen limit and excess also affect it.
Does professional indemnity cover a cyber attack?
Professional indemnity may cover a negligence claim from your professional work. It often will not fund ransomware recovery or breach response.
Check its cyber exclusion. Compare it with the cyber policy’s first-party costs.
What should I tell the ICO after a data breach?
Report a notifiable personal-data breach within 72 hours where feasible. Explain what happened and whose data is involved.
Explain the likely effects on people. The ICO does not need notification for every incident.
Document why you did or did not report it. Keep this record with your incident evidence.
Are smart locks and CCTV covered by cyber insurance?
They can be relevant if a cyber event disrupts them. Cover depends on declared technology and policy wording.
Tell the insurer about smart access, CCTV, BMS and connected devices. Do this before cover starts.
Buy cover after testing your real payment route
Buy cyber cover that includes incident response, restoration, GDPR support and business interruption. Then check fraud and client-money protection separately.
Test the policy against your real payment route. Use a recent contractor invoice and follow each approval step.
A policy only helps when its conditions match your working practices. Check the wording before renewal, not after a payment loss.
This guidance is less relevant where a business stores no personal or financial data. It is also less relevant where it does not depend on digital systems. That is uncommon in modern property management. This guidance does not replace a broker’s policy comparison or legal advice after an incident. Firms holding substantial regulated client money may need specialist support.
Related sources
These articles can help you explore the topic in more depth:
