Millions of leasing documents held by rental application platforms in Australia could be accessible online without any authentication required, according to a detailed analysis of seven major services. This alarming security flaw exposes sensitive personal information of countless renters to potential identity theft and fraud.
Victorian Teacher's Identity Stolen After Rental Applications
A 47-year-old Victorian school teacher, identified only as Michael, spent two months trying to regain control of his digital identity after someone accessed his bank and superannuation accounts. Michael had been actively applying for rental properties online through various platforms when his mobile phone number was transferred to another person without his knowledge.
"I'd been applying for heaps of rentals through November, through December. And it was just the right time that I suspect that all these leaked to someone," Michael explained. He believes the breach originated from passport information he submitted to rental application platforms, which was then used to bypass identity verification systems.
After regaining control of his phone number, which allowed him to receive two-factor authentication codes, Michael managed to secure his accounts. "I think it took a couple of weeks to get everything sorted out and change all my passwords," he said, highlighting the extensive recovery process required after such breaches.
Widespread Data Vulnerability Across Rental Platforms
The security concerns extend far beyond individual cases. Analysis reveals that millions of leasing documents across multiple rental platforms remain accessible online without proper authentication protocols. This creates a massive vulnerability for Australian renters who must provide extensive personal information during application processes.
Over-Collection of Personal Data Creates Risks
A recent Australian Housing and Research Institute (Ahuri) report identifies significant risks in how rental platforms handle personal data. While collecting information is necessary for rental agreements, the "over-collection of data poses significant risks to renters' data security and privacy."
The report, which examined 57 rent technology platforms operating in Australia, found that renters have little understanding of where their data goes, who accesses it, or how it might be used to create profiles or rankings of candidates. "Platforms rely on the collection, storage, sharing and linking of large volumes of data," the report states, noting that multiple third-party actors beyond tenants and landlords increase the risk of data misuse and breaches.
Regulatory Gaps and Security Concerns
Dr. Sophia Maalsen from the University of Sydney, lead author of the Ahuri report, acknowledges the benefits these platforms offer but expresses concern about their data collection practices. Some platforms include up to 50 different data fields regarding individual rental applicants, collecting information about household composition, pet ownership, smoking habits, and other personal details.
"They're not going to be 100% hackable proof, and some are likely going to be stronger than others," Maalsen warns, emphasizing that renters often lack clarity about platform security when submitting information to multiple services. She calls for stronger regulation of the sector, particularly regarding how collected data is used and protected.
Industry Response and Regulatory Challenges
Jacob Caine, president of the Real Estate Institute of Australia, acknowledges that agents must collect personal information to verify tenant identities but stresses the importance of proper due diligence regarding platform security. "As agencies increasingly adopt regulatory technology, it is critical they ensure these systems meet the highest privacy and security standards," he states.
The REIA supports reducing data collection through initiatives like the federal government's digital ID rental pilot program, recognizing that "less data collected means less data exposed." However, Caine warns that new anti-money laundering reforms taking effect from July 1 will require real estate agents to collect and store even more data, creating additional security challenges.
Moving Toward Enhanced Privacy Protections
Caine advocates for digital ID solutions as a forward-looking approach that could enhance privacy while improving efficiency. "Utilising digital ID is exactly the kind of forward-looking solution our sector needs – one that enhances privacy, improves efficiency, and gives renters confidence that their information remains secure," he explains.
With an influx of new regulatory technology providers entering the market, Caine emphasizes that providers must demonstrate strong governance, verified cybersecurity credentials, and clear understanding of privacy obligations. "The risks are too great for anything less," he concludes, highlighting the urgent need for improved security standards across the rental application industry.
