Property and construction deals move large sums by email between people who rarely meet. That makes them a favourite target for payment fraudsters, who only need to sit in the right inbox at the right time.
Cyber insurance for real estate and construction firms pays for the response, the fraud losses and the downtime that follow an attack. This page explains how underwriters look at agencies, developers, property managers and contractors, and what they want to see.
Why insurers look closely at real estate and construction
Payments in this sector are large and frequent. Buyers pay deposits, developers pay stage payments, and main contractors pay dozens of subcontractors every month. Each payment is a chance for a fake bank detail change.
The people side adds risk too. Construction firms work with many subcontractors and temporary staff, often on phones and tablets at site. Property managers hold tenant data and may run building management systems, which some forms treat like operational technology.
For example, a contractor with 50 staff and 40 regular subcontractors pays most of them by bank transfer after an emailed invoice. The underwriter will ask how the finance team confirms a change of bank details.
The cyber risks underwriters see in real estate and construction
- Deposit diversion. A buyer receives a fake email from "the agent" and sends a deposit to a criminal.
- Subcontractor bank detail fraud. A fake request changes a subcontractor's account just before a stage payment.
- New vendor fraud. The firm pays a supplier it has never used, and the materials never arrive.
- Ransomware on project files. Drawings and models become unreadable a week before handover.
- Missed tenders. Systems go down on the day a bid is due.
- Tenant data breaches. Lease files with ID copies and bank details leak.
- Leftover access. Subcontractors keep logins to shared project folders after the job ends.
What underwriters usually ask real estate and construction businesses
- How do you verify bank detail changes and new suppliers? A call-back procedure using a known number is the evidence. Dual approval above a set amount helps further.
- Do you hold client money in escrow or have access to client accounts? State it clearly, since it changes the cover you need.
- Is MFA on for every user, including site staff, remote access and third parties? A console export answers it.
- Do you manage mobile devices? A device management console screenshot shows it.
- Do you remove leavers' and subcontractors' access within one working day? A leaver checklist shows the process.
- Do you keep backups of project files offline or in a purpose-built cloud service, with a recent restore test? A dated test record from the last six months is what many forms ask for.
- How many personal records do you hold? A data inventory gives the number.
- If you run building systems, are they separate from IT and the internet? A network diagram is the evidence.
Cover that matters most for real estate and construction
- Funds transfer fraud and invoice manipulation. Cover when your money, or a client's payment to you, goes to a criminal. Many policies set a lower sublimit, so check it against your largest payments.
- New vendor fraud. Some wordings cover payments to a fake supplier you dealt with for the first time.
- Theft of funds held in escrow. Some wordings cover client money stolen from an account in your name, including what you must repay.
- Customer payment fraud. Some wordings reimburse customers deceived by emails or sites that impersonate you.
- Lost or missed bids. Some wordings pay for income lost when an attack stops you submitting a tender.
- System damage and business interruption. Rebuilding project data and lost income after the waiting period.
- Privacy liability. Claims from tenants or buyers after a data breach.
Many wordings exclude theft by your own staff, so insider fraud usually needs a crime policy. Read cyber insurance coverage explained for how the fraud clauses differ.
How PrismX helps real estate and construction businesses get insurance ready
- Discover records your offices and sites, systems, data, suppliers, subcontractors and people.
- Assess checks each control, including payment verification, and shows how your answers read on the insurer's question set.
- Improve gives each gap an owner and a date, for example "add call-back checks for stage payments, owner: finance lead".
- Verify stores the evidence, gives each document an AI check and advisor verification, and tracks expiry: training counts for twelve months.
- Submission pack: PrismX builds a signed pack with a sha256 fingerprint.
- During an incident: in the pilot, PrismX follows your wording's notification clocks.