Industries · Property
The sector’s classic attack is an email about a bank account.
We built the deal-sourcing systems and client portal a buyer’s advocacy business ran on.
Property runs on high-value transfers coordinated over email between parties who may never meet: buyers, agents, conveyancers, banks. Payment redirection is the sector’s classic fraud: compromise one inbox, change the account details on a settlement, and the money is gone. The defences are identity, process, and people.
We built Bold Property Group’s brand, deal-sourcing systems, and the client portal its acquisitions ran through.
What you carry, and what we do about it.
Payment redirection rides on a compromised inbox: one changed bank detail in a settlement chain.
We harden the identity layer the fraud depends on: conditional access and MFA coverage across your Microsoft 365 tenant, privileged-role and app-consent audits, and offboarding hygiene.
Entra ID & Microsoft 365 identity securityThe people in the chain are the attack surface: staff wired to act fast on emailed instructions.
Controlled phishing and pretext campaigns measure susceptibility, with per-team results and targeted awareness follow-up, without naming individuals.
Phishing & social-engineering simulationAML/CTF tranche 2 captures real estate professionals from July 2026, and identity verification is already standard in conveyancing.
We run compliance readiness programs that map the obligations to your business, close the gaps, and build the evidence trail an assessor expects.
Compliance readinessTransaction data (contracts, client financials, identity documents) accumulates in portals, drives, and inboxes.
Bold Property Group’s acquisitions ran through a client portal we built, and we penetration-test the systems you already hold transaction data in.
Penetration testing
The obligations in play
- AML/CTF Act, tranche 2
- Real estate professionals become reporting entities from 1 July 2026: programs, customer due diligence, and reporting.
- Verification of identity
- Conveyancing rules require reasonable steps to verify client identity on land transactions.
- Trust account rules
- State agent legislation governs trust money: record-keeping, audits, and accountability for client funds.
- Privacy Act 1988
- Client identity documents and financial information under the APPs, with the Notifiable Data Breaches scheme behind them.
Not legal advice; your advisers own the interpretation.
Built and running
Bold Property Group
A buyer’s advocacy business. We built the brand, the editorial site, the off-market deal-sourcing systems, and the client portal for active acquisitions.
The services behind this work.
Defensive & advisory
Ongoing security leadership for organisations that need somebody to own cyber risk but do not require a full-time CISO.
Read more
Offensive testing
We test applications, APIs, networks and cloud environments for vulnerabilities that can be reproduced and exploited.
Read more
Compliance readiness
Black Shard works with organisations preparing for the Essential Eight, SMB1001 and ISO 27001, as well as businesses reviewing their obligations under the Australian Privacy Principles.
Read more
Identity, process and people hardened along the settlement path.
Brisbane head office. Work delivered across Australia.