Right-to-rent checks put estate and letting agents in an awkward spot. The law tells you to see a prospective tenant's passport or share code and keep evidence you did. What it does not tell you is to leave scans of that passport, plus payslips and bank statements, sitting in a shared info@ inbox that the whole branch logs into with the same password. That is the setup we find most often, and it is the weak point.

The problem is not that you hold the documents. It is where they sit and how long they stay. A shared mailbox has no real record of who opened what, the password tends to be written somewhere handy, and old emails are never deleted because deleting them is nobody's job. Two years on, you are holding a filing cabinet of identity documents for people who were never even your tenants, in the one system most likely to be phished.

For the fraudster, an agent's inbox is a jackpot. A passport scan, a payslip and a proof of address is enough to open accounts in someone else's name. That is a much bigger harm to the applicant than a leaked marketing list, and if it leaks from your inbox it is your breach to report and your reputation on the local high street that takes the hit.

The fix does not slow the lettings process down. Verify documents through the government online service where you can, keep only the confirmation you are required to keep rather than the full scan, and move anything sensitive out of the shared inbox into a folder with proper access. Then delete the applications that went nowhere. Holding less is the cheapest security control there is.