The first step in staying safe online? Better password habits.

Let’s talk about something that’s not flashy, but seriously important: your password.

Staying smart about passwords is essential, whether at work or at home. It's a simple habit that offers powerful protection. A strong password is your first line of defense.

In real estate, that matters. Agents manage a ton of sensitive information: purchase agreements, financial documents, personal details, and property records. An agent’s password could be the only thing standing between a client’s private information and a cybercriminal. And in our deadline-driven world, where transactions move fast and sensitive data flies across emails and apps, that’s a big deal.  

The truth is, nearly half of all cyberattacks – 49% – involve stolen credentials. That means the human element plays a huge role. Things like weak or reused passwords or sharing them too freely can open the door to serious problems (Verizon 2023 Data Breach Investigations Report).  

These tips can help you, your staff, and your MLS members stay ahead of password threats.

‍

Use strong, unique passwords for everything

Think of your password like a house key. You wouldn’t make 10 copies of it and hand them out at an open house, right? So, stop reusing the same one for your email, your MLS, your transaction platform, and your online shopping account.

A strong password needs:

• At least 12–16 characters

• A mix of uppercase, lowercase, numbers, and symbols

• Totally random (sorry but “123MainStreet!” doesn’t cut it)

Try using a passphrase for your password that’s quirky and memorable, like: PinkHorse!Drinks7Lattes. Weird = harder to guess.

This is a simple but effective step we all can take. Today’s bad actors can crack a 10-character password that uses lower case letters and numbers in just a few minutes. The more diverse the characters are in your password, the more resistant it becomes to hackers.  

Use a password manager

If you’re thinking “how am I supposed to remember 27 different logins?”, you’re not. That’s what password managers are for. They can generate and store all your passwords securely. You only have to remember one master password, and it takes care of the rest. It’s like a digital lockbox for all your keys. It is ‘all your eggs in one basket’ so make the master password very strong.

And yes, a password manager works on your phone too. Most have mobile apps, so you can use it anywhere. Whether you're on your laptop or checking something on your phone, your passwords are right there; no sticky notes or multiple log-in attempts required.

‍

Say “Yes” to multi-factor authentication (MFA)  

This is your second lock on the door, and it’s non-negotiable these days.

Multi-factor authentication (MFA) means you log in with your password, then confirm your identity, typically with a code sent via text to your phone, a one-click sign-in link to your email, an authenticator app, or a passkey (e.g. fingerprint, face scan, or device PIN). Cotality’s Clareity Assure™ provides all of these options.  

MFA can absolutely be the difference between a compromised account and a secure one. The real estate industry could save itself a ton of time and frustration just by putting an MFA option in place.

That said, MFA on its own isn’t bulletproof. You can have a 14-character password and MFA, but if someone’s sharing both - or if their email or device gets compromised - it defeats the whole purpose. Security isn’t just about the tools. It’s about behavior too.

And yes, email and text MFA are the least secure options, but if that’s all you can manage right now, that’s okay. Just start. The point is: have MFA in place. It’s better than nothing, and it’s a step in the right direction.

‍

Adaptive security, the newest line of defense, is even better.  

Adaptive security looks at how you are logging in: your location, device, time of day, and more. If something seems off, it might require additional verification using MFA.  Adaptive security helps address some of the weaknesses of the various methods of MFA.

MFA today is table stakes. If you have the option to use adaptive MFA, do it. It’s like having a security guard who knows your usual routine and raises a red flag when something seems off. Those using Cotality’s Clareity Assure™ get adaptive security and MFA – and with adaptive security, only 6% of logins require the extra MFA steps.

Turn MFA on everywhere you can – email, MLS, transaction platforms, even your social accounts. If your tools offer adaptive MFA, always say yes.

‍

Creating a safe physical backup  

If your computer is ever compromised, crashes, or gets locked down by malware, access to your password manager could vanish in an instant. A secure physical backup (that’s right, on paper!), stored in a safe location, can be a lifesaver when you need to regain access.

Just be sure to remove the associated user ID or shorten it to something only you would recognize (for example, a*****m@gmail.com).

And no, taped to your monitor, hidden under your keyboard, or stashed in your top desk drawer does not count as secure.

‍

The power of the human firewall

Training your staff and MLS members to spot threats can become your strongest defense. A single class when onboarding a new team member is not enough – regular training is key because new threats emerge constantly. By including ongoing security awareness training supplemented by regular reminders, updates, and better yet, simulations, you keep the conversation going and help build a strong security culture within your organization.  

Cotality has put together a library of short cybersecurity videos, perfect for anyone looking to boost their security smarts. You can use these resources to help your MLS members stay up-to-date and informed.

‍

Why it matters for your MLS

Multiple Listing Organizations – especially those which have implemented Single Sign-On (SSO) – are the gatekeepers of some of the most important and sensitive data in real estate. That’s why building better habits around security isn’t just a nice-to-have. It’s a must.

Clareity Assure™ Adaptive MFA detects and prevents potentially risky logins in real time—while allowing trusted users to continue without interruption. Reach out to your Cotality rep about implementing it for your MLS. You can also email us at sales.res@cotality.com.

‍