EMAIL SECURITY FOR ESTATE AGENTS, LETTING AGENTS AND SURVEYORSDeposits and rent,
paid to the right account.
Agents handle tenants', landlords' and buyers' money under time pressure, and every party in the chain emails. An email saying your bank details have changed only has to fool one of them.
Hi Alex,
Just a quick one. I have changed banks, so please can you pay this month's rent for 7 Mill Lane, and all future payments, into my new account belownote 1. Please do not use the old account as it is now closed.
Note 1: Rent moved to a new account by email
Account name: G Whitfield Sort code: 11-22-33 Account number: 12345678
I am writing from my personal emailnote 2 as my work one is playing up. I am abroad until the end of the month so email is the best way to reach menote 3.
Note 2: Not the address you hold for him
Note 3: Steers you away from a phone call
Kind regards, Graham Whitfield
High riskJatzo's result for this fictional email
What moved the score
- Payment change with a warning sign+28
- Supplier payment details changed+16
- Business email compromise pattern+14
Invoice and mandate fraud, as UK Finance recorded it.
- £41.3 millionlost to invoice and mandate fraud in 2025
- 2,305cases recorded in the year
- 68%of the losses came from business accounts
Criminals intercept emails or take over an email account, then pose as a supplier, a solicitor or a builder with new bank details. UK Finance, Annual Fraud Report 2026, June 2026 (opens in a new tab)
What estate and letting agents worry about.
And what Jatzo does about each, in the inbox your team already uses.
Rent and deposits paid to the wrong account
The Payment Systems Regulator describes a tenant whose bank paused a £14,000 rent payment after a fake email said the agent's account had changed. It was the agency's name on that email.
What Jatzo does
Whoever has the email open presses Check before money moves, and a High risk result emails your branch manager at once.
Business and Business ProTenants' and landlords' details
An agency keeps identity documents, bank details and addresses. A phishing email that takes one negotiator's password can open all of it.
What Jatzo does
The check flags fake sign-in requests, QR codes that lead somewhere to sign in, and emails borrowing a name they do not come from, before anybody types a password.
Every planA colleague's mailbox used against you
RICS records cases where a compromised internal mailbox sent new bank details that appeared to come from a colleague.
What Jatzo does
Domain Watch checks whether anybody could send email as your domain, and training shows every negotiator what these emails look like, with a record of who completed it.
Business Pro
How it unfolds for estate and letting agents.
Money is due
Rent is about to be paid on to a landlord, or a deposit or completion falls due.
- Check it here
New details arrive
An email in a landlord's, a solicitor's or a colleague's name gives new bank details for the payment.
It looks legitimate
It comes from a real mailbox somebody has taken over, or one made to look like it.
The money goes
Unless somebody rings the payee on the number held on file, the rent or deposit goes to a criminal.
The gold mark is where Jatzo's check fits: somebody has the email open and nothing has been paid yet.
The check before you pay.
Six steps, every time. Print it, put it by whoever pays the invoices, and agree that nobody skips it because somebody senior is in a hurry.
Download the one-page checklist (PDF)Never pay, or change who you pay, because of an email alone, from a landlord, buyer, seller or solicitor.
Ring them on the number held on file from when you took them on, not a number in the email.
Tell every tenant and buyer in writing at the start that your bank details will never change by email.
A second person approves any change to landlord, contractor or client account details.
For a first payment to new details, send a small amount and have the payee confirm receipt by phone.
If money has gone, ring your bank's fraud line at once, then report to Report Fraud on 0300 123 2040 or reportfraud.police.uk (Police Scotland on 101 in Scotland).
Also on day one: tell the client affected, and your insurer.
What the agency gets.
It does not replace the call. It makes sure somebody makes it. Jatzo adds a check beside the message in Outlook and Gmail, at the moment somebody decides whether to pay, reply or click, and your existing email protection stays as it is.
Check before the rent goes out
Every planAnybody unsure about a landlord's or solicitor's new bank details presses Check in Outlook or Gmail and sees a score out of 100 with the reasons.
Contractor invoices against confirmed details
Separate licence, from £129 a yearInvoice Fraud Checker, a separate Windows program, compares the bank details on each contractor's invoice with the ones you confirmed, and says Stop before you pay somewhere new. About the Invoice Fraud Checker
Web addresses that copy your agency's
Business ProDomain Watch, on Business Pro, looks for new web addresses made to look like your agency's, and checks whether anybody can send email as you.
Your branch manager hears at once
Business and Business ProWhen anybody in the branch checks a message scoring High risk or above, an email goes to addresses you choose at your own domain, such as your branch manager's.
Training for everyone who handles money
Business ProBusiness Pro includes every Training Centre course for everyone in the team, Invoice and payment fraud among them, with a record of who completed it.
Which plan fits: an example
For estate and letting agents with 10 people, we suggest Business Pro: £120 a month, or £1,200 a year paid annually.
That is £12 a person a month.
Domain Watch for web addresses that copy your agency's, and training for everyone who handles tenants' and landlords' money, are both on Business Pro.
Business Pro includes the threat report, so you know what is being aimed at the agency and whether it is getting worse: every email your team checked that came back Suspicious or above, by kind of attack, the last 30 days against the 30 before, naming nobody. At the start of each month a report goes by email to the addresses you choose, saying what was checked and what is still waiting.
- The Check button in Outlook, including on a phone, and in Gmail, for everybody in the team.
- Staff do nothing. Whoever looks after your email adds it once, for everybody.
- Nothing to replace. Your email, and the protection it already has, stay as they are.
- Jatzo keeps the score and the findings for up to 90 days, never the email or its attachments.
- Pay monthly, or a year in advance for ten months' price.
The Invoice Fraud Checker is a separate licence, from £129 a year. About the Invoice Fraud Checker
What your sector's own bodies say.
Each point is linked to where it was published, with its date.
Relying on email alone to verify a change of bank details is not sufficient; confirm it a second way, such as a phone call to a number already known for that client.
Get bank details in person or by phoning the solicitor directly, never from an email, and treat any change of account email as suspicious.
Report Fraud replaced Action Fraud in December 2025. The number, 0300 123 2040, did not change. GOV.UK, Report Fraud: new service from City of London Police, December 2025 (opens in a new tab)
Questions estate and letting agents ask.
Does Jatzo read our client files or the rest of the mailbox?
No. Jatzo reads only the email somebody chooses to check, and the add-in cannot reply, forward, move, delete or change anything in the mailbox. It keeps the subject line, the score and the findings for up to 90 days, never the message or its attachments. Links in it are checked against Google Web Risk.
Does it replace ringing the landlord or the solicitor?
No. RICS is clear that email alone is not enough to verify new bank details. Ring them on the number held on file. Jatzo helps whoever reads the email notice that it needs that call, before the money moves.
Will our IT company need to do anything?
A little, once. Whoever looks after your email proves your domain with one DNS record. For Microsoft 365 they then upload one file in the admin centre, which needs the Exchange Administrator or Global Administrator role, and Microsoft takes 24 to 72 hours to add the button. For Google Workspace they install Jatzo for the domain. Staff do nothing.
Check the next email that makes you pause.
For other businesses: Law firms; accountants; construction firms and architects; manufacturers, wholesalers and distributors; recruitment agencies; marketing and digital agencies; healthcare practices; insurance brokers and charities.