Industries · Property

The sector’s classic attack is an email about a bank account.

We run a property business ourselves, Bold Property Group, so we secure the transaction path the way an owner would, not a vendor.

Property runs on high-value transfers coordinated over email between parties who may never meet: buyers, agents, conveyancers, banks. Payment redirection is the sector’s classic fraud: compromise one inbox, change the account details on a settlement, and the money is gone. The defences are identity, process, and people, not a product.

We operate in this sector ourselves. Bold Property Group is our own buyer’s advocacy venture: we built its brand, its deal-sourcing systems, and the client portal its acquisitions run through, so the systems and the risks are ones we manage daily.

What you carry, and what we do about it.

Payment redirection rides on a compromised inbox: one changed bank detail in a settlement chain.
We harden the identity layer the fraud depends on: conditional access and MFA coverage across your Microsoft 365 tenant, privileged-role and app-consent audits, and offboarding hygiene.
Entra ID & Microsoft 365 identity security
The people in the chain are the attack surface: staff wired to act fast on emailed instructions.
Controlled phishing and pretext campaigns measure real-world susceptibility, with per-team results and targeted awareness follow-up, never naming and shaming individuals.
Phishing & social-engineering simulation
AML/CTF tranche 2 captures real estate professionals from July 2026, and identity verification is already standard in conveyancing.
We run compliance readiness programs that map the obligations to your business, close the gaps, and build the evidence trail an assessor expects.
Compliance readiness
Transaction data (contracts, client financials, identity documents) accumulates in portals, drives, and inboxes.
We build client portals ourselves, Bold’s acquisitions run through one, and we penetration-test the systems you already hold transaction data in.
Penetration testing

The obligations in play

AML/CTF Act, tranche 2: Real estate professionals become reporting entities from 1 July 2026: programs, customer due diligence, and reporting.
Verification of identity: Conveyancing rules require reasonable steps to verify client identity on land transactions.
Trust account rules: State agent legislation governs trust money: record-keeping, audits, and accountability for client funds.
Privacy Act 1988: Client identity documents and financial information under the APPs, with the Notifiable Data Breaches scheme behind them.

This list orients the engineering work. It is not legal advice; your advisers own the interpretation.

The build behind this page

Bold Property Group

Our own buyer’s advocacy venture. We built the brand, the editorial site, the off-market deal-sourcing systems, and the client portal for active acquisitions, and we operate all of it today.

See the work

The services behind this page.

Harden the path the money takes.

Australia-wide, from our Brisbane head office. Someone will contact you as soon as possible.

Open a brief info@blackshard.com.au