door with real estate lock box

Lockbox security threat to properties in the Lower Mainland

As communicated in March of 2022 through eAlert #4186, and resulting from another recent lockbox breach, the Fraser Valley Real Estate Board recommends that REALTORS® exercise heightened awareness and prudence in the release of lockbox access codes, and in the protection of e-mail access.

Initial point of breach is e-mail and damage is swift

The Board has received reports this week that a number of agents received requests for a ‘One-Day’ access code to show their properties, from someone purporting to be a REALTOR® member of one of the Lower Mainland Boards. In one case, after receiving a request for a code, the listing agent searched online for the ‘Realtor’ contact information, and reached the actual Realtor directly, confirming that no such request had been legitimately made. In another instance, an agent’s e-mail account was hacked, resulting in a breach of their Sentrilock® and Touchbase accounts.

We have been advised that on Tuesday this week, hackers accessed the lockbox of one of our members who had refused to give them a ‘One-Day’ access code on a property in Fort Langley. While the property was listed as owner occupied, with the advertising reflecting a fully furnished home, the owner had largely vacated the home. As such, very little remained in the home, and it appears that, fortunately, nothing had been stolen. Locks and security codes were promptly changed.

In response to these bold incidents, the Board strongly urges members to take immediate action to implement added layers of protection through multi-factor or two-step authentication. Your internet service provider can assist with this.

The Board further recommends that members NOT provide ‘One-Day’ access codes to anyone. All members should have their own SentriKey® access. Members who need assistance with setting up this access are welcome to visit the Board Office — the MLS® Department will assist you. This process is quick and is part of the services bundle included with your membership.

For the time-being, if a member comes from out of town to show properties, meet them at the location. Do not take the risk of providing a ‘One-Day’ access code to anyone.

What action has the Board taken to mitigate risk?

In view of an increase in attempts to penetrate security efforts, and breach lockboxes in recent months, the FVREB and its counterparts established joint measures to protect members and reduce potential threats. The actions taken include:

  • Suspension of reciprocal lockbox privileges. Automatic reciprocal lockbox privileges continue to be temporarily suspended for all BC Real Estate Boards except CADREB, FVREB and REBGV. Access to properties in the other Board jurisdictions can be obtained only by calling your Board Office, prior to planning a visit to show properties outside the Lower Mainland. While we regret the inconvenience, the security of our members and their clients outweighs the convenience as we continue to assess the threat.
  • One-device policy. Boards which had not already done so have instituted a one-device policy, so that only one device can be registered. FVREB has had this policy in place for many years.
  • New devices. Members who need to register a new device must do so by contacting their Board Office directly to undergo identity screening and authentication to set up the device.
  • Account updates. No changes or updates can be made to account settings without prior identity verification by the Board Office.
  • Multi-factor authentication. Discussions continue with SentriLock® and Clareity to incorporate multi-factor authentication measures for account access.

Security threats affect all Realtors and their clients, regardless of jurisdiction, so we urge all members to exercise added vigilance when sharing information with colleagues. If you experience a lockbox breach, please:

  • Immediately contact your local law enforcement authorities;
  • Notify the Managing Broker of your brokerage office;
  • Notify your Real Estate Board, providing details of the incident, including police file number; and,
  • Notify SentriLock®.

Thanking you for your immediate attention, the members of FVREB appreciate all the measures we collectively take to minimize threats and any added vigilance that can serve to thwart the actions of wrongdoers.