Property Management Cybersecurity: 5 Habits That Protect Resident Data

What AI changes about attacks on residential communities

Attackers still want a working login. AI has made them faster and their phishing attempts harder to spot.

Speed is the first change. In the password spraying campaign Microsoft described, automated tools made more than 151,000 failed sign-in attempts against 327 accounts in 5 days, peaking at about 2,900 attempts a minute. No person types that fast.

Polish is the second change. CISA now tells people not to rely on poor grammar as a warning sign, because AI phishing messages can be flawless. The October 16 alert added that attackers are using deepfake audio and video to impersonate real people.

A staffed front desk is exposed to both changes. Its job is to handle urgent requests from residents, owners, and vendors all day, and a convincing fake message looks exactly like one of those requests.

5 property management cybersecurity habits for managers and boards

The October 16 FBI and CISA alert covers four of them.

1. Turn on multi-factor authentication for staff and residents

Multi-factor authentication (MFA) asks for a second proof of identity after the password, usually a one-time code. With MFA on, a stolen or guessed password isn't enough to sign in. Microsoft, which recommends phishing-resistant MFA in particular, reports that MFA can block over 99% of identity-based attacks.

The method matters. CISA ranks authenticator apps above codes sent by text or email, so encourage staff and residents to use an app wherever they can.

BuildingLink offers MFA for both staff and residents. Users can verify with a code from an authenticator app, such as Google Authenticator or Microsoft Authenticator, or with a one-time code sent by email. If MFA isn't turned on for your property yet, a security officer-level user can email support@buildinglink.com to enable it.

2. Set permissions by role

Not everyone on staff needs the same access. For example, a front desk associate may need to look up a resident's phone number but rarely needs to edit resident records, issue refunds, or email the whole community.

Matching access to each role limits the damage if one login is compromised, because an attacker who gets into a limited account can see and change far less. The October 16 alert recommends role-based, least-privilege access that is reviewed regularly.

In BuildingLink, special permissions let you override the default permissions for specific employees or user types. For example, you can let one staff member approve amenity reservations or send email blasts without raising that person's overall access level.

Review who holds the highest level of access once a quarter, and again after any staffing change.

3. Train front desk staff to spot phishing

Front desk staff field a steady stream of messages from residents, owners, and vendors. That makes them a natural target, and AI is making the old giveaways less reliable. These warning signs from CISA still hold up:

• The message uses urgent or emotional language to push you to act fast.
• The sender asks for personal or financial information.
• The link is shortened, or the sender's address has a small misspelling.

The most useful rule is simple: verify through a channel you already trust. If a vendor emails new payment details, call the vendor at the number on file, not the number in the email. The October 16 alert gives similar advice.

Make the practice specific to your front desk. Rehearse a vendor asking to update banking details, an "owner" emailing to add someone to unit access, and an urgent request that appears to come from the board president. Run a 10-minute review at shift change so the examples stay fresh.

4. Use unique passwords

Reused passwords turn one leak into many. When one site leaks a password, attackers try it on other accounts, and automated tools like the ones Microsoft described can make nearly 3,000 attempts a minute.

Federal guidance now favors length over complexity. NIST's 2025 password guidelines call for long passwords, drop scheduled password changes, and require a change when there's evidence a password has been compromised. NIST also says systems should allow password managers. CISA's Cybersecurity Awareness Month guidance also recommends strong passwords and a password manager.

For your team, that means one password per system, a password manager for staff who use several logins, and no shared logins at the front desk.

5. Remove access when staff leave

Old accounts are easy to forget and useful to attackers. Microsoft's earlier guidance on the same hacking group recommends disabling stale or unused accounts, and the FTC advises businesses to have a set procedure so departing staff lose access to sensitive data.

Build an employee offboarding checklist and complete it on the employee's last day. It should cover property management software, email, shared drives, door and garage credentials, vendor portals, and physical keys. Our property manager's guide to key control covers the physical side.

The same rule applies to the board. When a board member's term ends, remove that person's access to the portal and to community documents. Our post on board member turnover explains how to keep records intact during the handoff.

How BuildingLink supports these habits

Two of these habits are built into BuildingLink: multi-factor authentication for staff and residents, and special permissions for role-based access. Both are part of the larger BuildingLink platform, which also supports front desk operations.

Questions boards can ask their management team

Board members don't need to manage passwords, but they can make sure the basics are in place. These questions work well on a board meeting agenda:

• Is MFA required for every staff account in our community's software, and is it offered to residents?
• Who can see or change resident records, and when did we last review that list?
• What happens to a staff member's access on their last day?
• Does our cyber insurance policy require MFA, and can we show that we have it?

Insurance is a practical reason to ask these questions. A cyber risk guide from insurance broker Risk Strategies, published on CAI's HOA resources site, notes that cyber insurers now require MFA as a condition of coverage. New board members can find more on their responsibilities in our onboarding guide for new board members.

Steady habits for faster threats

October's headlines were about speed. The answer is a set of steady habits: MFA, role-based permissions, phishing awareness, unique passwords, and same-day offboarding.

Subscribe to the BuildingLink blog for more practical guides like this one. To see MFA and special permissions in action, connect with a member of our team.