My agent shared my smart-lock password without consent. What can I do?
Sharing your smart-lock PIN, password or access code with anyone without your clear consent is a privacy breach of your right to exclusive possession under the tenancy — conduct the Valuers, Appraisers and Estate Agents Act 1981 s.24 reaches. Reset the code immediately, document who received it, and demand a written explanation from the agent and their agency.
When you sign a tenancy, you get the right to be the only one in the unit. That's what "exclusive possession" means — and it includes not having strangers texted your door code. Handing the means of entry — a physical key, an access card, or a smart-lock credential — to unnamed third parties without your permission breaks that right. The fact that the person holding the code is an agent does not make the unauthorised disclosure lawful.
Why this is a serious breach, not a minor slip
Your access credential is a key to your home. An agent who circulates it to strangers without permission has treated your possession and your personal data as if they were the agency's to share — they are not.
Each viewing still needs your consent for that specific entry: the agreed date, the named person, and reasonable notice. When the code is shared with prospective tenants, contractors, or unnamed visitors, you face three concrete harms:
- Uncontrolled entry while you are asleep or away.
- Exposure of your belongings.
- Loss of any audit trail if the unit is later entered by someone you never authorised.
Recovery of possession must go through court process, not self-help. The same rule that bars a landlord from changing locks to pressure a tenant bars an agent from using the access credential to do the same. (Self-help pressure on an occupant is governed by Specific Relief Act 1950 s.7(2) and the parallel duties on a registered estate agent sit in Section 24 of the Valuers, Appraisers and Estate Agents Act 1981 — BOVAEP's disciplinary route.)
What to do in the first hour
Reset the smart-lock code yourself from the app or panel, then revoke any shared app user. Do not wait for the agent to handle it — they leaked the code, so they are not the safest person to secure it.
- Reset the credential. Generate a new PIN or password. If the lock supports multiple codes, delete any code the agent ever had and issue a fresh one only to people you have personally approved.
- Revoke shared access. If the agent was added as a user in the smart-lock app, remove that user. Check whether the app exports a log of who opened the lock and when — that log is your evidence.
If the lock was landlord-supplied (named as an inventory item in your tenancy agreement), tell the landlord in writing the same day that you changed it and why. Changing the code is still your right to secure the home, but the written notice stops the landlord later claiming you tampered with the inventory.
What to do in the first 24 hours
Document the disclosure, notify the landlord in writing so the principal is on notice, and demand a written explanation from the agency. A reasonable agency replies within 7 working days; silence is itself a red flag and grounds to escalate.
- Document the disclosure. Note the date you learned of it, who the agent says received the code, how many people, and over what period. Save any chat messages in which the agent admits or describes sharing it.
- Notify the landlord in writing. Copy the landlord so the principal is on notice that their agent acted without your consent. The landlord, not just the agent, is responsible for how their unit is accessed.
- Demand a written explanation from the agency. Ask who was given access, why, and what the agency will do to prevent a repeat. State a reasonable reply window (7 working days) and that you will escalate to BOVAEP if you hear nothing.
| Action | Why it matters | Risk if skipped | Window |
|---|---|---|---|
| Reset the smart-lock code | Stops further unauthorised entry | Strangers keep a working key to your home | First hour |
| Pull the lock's access log | Creates a timestamped record of who entered | No proof of entries if a dispute arises | First hour |
| Revoke shared app user | Removes the agent's technical access | Agent can still unlock remotely | First hour |
| Notify the landlord in writing | Puts the principal on notice | Agent can later claim the landlord approved it | Within 24 hours |
| Demand written explanation from agency | Forces accountability and a paper trail | Incident stays informal and deniable | Within 24 hours; reply in 7 working days |
| Verify the agent's REN number | Confirms who is actually licensed before you escalate | You cannot escalate against an unverified person | Within 24 hours |
To check whether the person you dealt with is a licensed negotiator at all, the verify a real estate agent REN number guide walks through the Board of Valuers, Appraisers, Estate Agents and Property Managers (BOVAEP) register under the Valuers, Appraisers and Estate Agents Act 1981. If they are not on the register, you cannot escalate to BOVAEP — see how to verify a rental listing is real and how to verify the landlord before paying a deposit.
Can I report the agent, and to whom?
Yes. A licensed real estate negotiator is answerable to their registered estate agency first, then to BOVAEP. An unauthorised disclosure of an access credential is a conduct complaint both will take seriously.
You have two routes. First, write to the agency the agent represents — agencies have internal conduct rules and a written complaint creates a record. State the facts, attach your evidence (access log, chat screenshots, dated summary), name a 7-day reply window, and say you will escalate to BOVAEP if you hear nothing. Second, if the agency does not resolve it, or if the agent is acting outside a registered agency, escalate to BOVAEP, which regulates licensed negotiators and can investigate conduct breaches. A BOVAEP complaint that lands with a clean evidence file (incident summary + log + correspondence) typically moves faster than one without. File via the BOVAEP complaints channel at https://covemm.bovaep.gov.my/ (linked from the agency's official site) so the submission is logged.
What to send the agency / BOVAEP — copy-ready template
Use this 6-line draft as your opening message to the agency, and as the body of your BOVAEP complaint if it escalates.
``` Subject: Formal complaint — unauthorised disclosure of my smart-lock code
I am the tenant of [unit address] under tenancy dated [start date]. On [date] I learned that negotiator [name, REN number if known] shared my smart-lock PIN with [number] third parties without my consent. My access log is attached. Please reply in writing within 7 working days. If I do not hear back, I will file a conduct complaint with BOVAEP under Section 24 of the Valuers, Appraisers and Estate Agents Act 1981. ```
Attachments: smart-lock access log (PDF), chat screenshots, dated incident summary, your earlier email to the agent.
If the disclosure was used to apply pressure on you — to force an early move-out or to intimidate — the same rule that bars a landlord from locking you out or cutting utilities bars anyone handling access from abusing the credential as leverage. Document every instance with dates and messages, and raise the pressure angle in both the agency complaint and the BOVAEP complaint so the conduct record reflects the pressure, not just the disclosure.
After the 24 hours: building a record and choosing your next step
Once the immediate damage is contained, lock down a 90-day evidence file and decide whether to pursue civil compensation, a regulator complaint, or both. Which route you pick depends on what outcome you want — money, conduct discipline, or both.
Three moves that most tenants forget:
- Lock down a 90-day evidence file. Save every chat, email, and screenshot to one dated folder. If a stranger actually used the code to enter, also preserve any CCTV from the building lobby or corridor, and export the smart-lock access log before the app overwrites it.
- Decide between civil compensation and a regulator complaint. Civil compensation goes through the Magistrate's Court (small claims track) under the Subordinate Courts Rules 1980 or, for higher sums, the Sessions Court under the Courts of Judicature Act 1964. The regulator complaint (BOVAEP) targets the agent's conduct, not your losses, and the two routes run in parallel.
- Use the SPEEDHOME platform route if the listing is SPEEDHOME-managed. SPEEDHOME-managed tenancies carry a built-in platform reporting flow separate from the agency or BOVAEP route — use it in parallel so the platform can flag the agent's record internally even before BOVAEP responds.
The SPEEDHOME angle: how access should be coordinated
SPEEDHOME-managed listings route every viewing through a logged platform workflow with REN-verified negotiators, so the access credential never has to leave the platform.
The root failure in "agent shared my code" cases is that access credentials live in a human's chat history instead of in a controlled, auditable system. SPEEDHOME reduces that exposure by listing through verified channels, confirming the negotiator's REN status against the BOVAEP register, and keeping viewing and access coordination on the platform rather than on unverified social-media listing channels. That does not make any single rental risk-free, but it removes the most common vector for an uncontrolled credential to be passed around. Per SPEEDHOME's published tenancy workflow, every viewing on a SPEEDHOME-managed listing is logged with a tenant consent timestamp and a named attendee, with the access credential issued by the platform rather than texted by the agent — so the "stranger has my PIN" failure mode is structurally avoided.
If you are starting from scratch and want a rental where access is coordinated properly from day one, browse SPEEDHOME rentals or see the verify a real estate agent REN number guide before you sign — it walks through the same BOVAEP register used to escalate after a breach.
FAQ
Is it legal for an agent to give my smart-lock password to other people?
No, not without your clear consent. Your access credential is the key to a home you hold under a tenancy, and sharing it with strangers is a breach of your right to exclusive possession. Section 24 of the Valuers, Appraisers and Estate Agents Act 1981 sets out the duties of a registered estate agent and the basis on which BOVAEP can discipline a licensed negotiator for misconduct — an unauthorised disclosure of an access credential is the kind of conduct that route is built for.
What if the agent says they only shared it for viewings?
"It was for a viewing" is not a defence on its own. Each viewing needs your consent for that specific entry: the agreed date, the named person, and reasonable notice. If you did not agree to that viewing, did not agree to that person, or were not given notice, the agent had no authority to share the credential. Reset the code and require all future viewings to go through you in writing.
Should I change the smart-lock code myself if the lock was landlord-supplied?
Yes — your right to secure the home does not depend on who owns the lock. If the tenancy agreement lists the smart lock as a landlord-supplied inventory item, also email the landlord the same day to confirm the code was changed and why. The notice protects you against any later "tampered with inventory" claim at move-out and is part of the written record if the dispute escalates.
Can I report the agent to BOVAEP, and how?
Yes, if the agent is a licensed real estate negotiator (REN). Write to the agent's registered estate agency first with your evidence and a 7-day reply window. If the agency does not resolve it, file a written complaint with BOVAEP via its official complaints channel at https://covemm.bovaep.gov.my/, attaching your access log, message history, and a dated incident summary. BOVAEP regulates licensed negotiators under the Valuers, Appraisers and Estate Agents Act 1981 and can investigate the agent's conduct.
Does the landlord have responsibility for what their agent did?
Yes. The agent acts for the landlord as their principal. Putting the landlord on notice in writing means the principal is responsible for how their unit — and the credentials to it — are handled, and it stops the agent later claiming the landlord approved the sharing. In Malaysian agency law, a principal is generally liable for the acts of an agent acting within the scope of their authority, so the landlord cannot wash their hands of the disclosure just because the agent did the texting.
What if the shared code was used to pressure me to move out?
That compounds the breach. The same rule that stops a landlord from locking you out or cutting utilities to force a move-out stops anyone handling access from using the credential as leverage. Document every instance with dates and messages, and raise it in both the agency complaint and the BOVAEP complaint so the conduct record reflects the pressure, not just the disclosure.
How long does a BOVAEP complaint usually take?
BOVAEP complaint timelines vary with case complexity and the agency's response, but a clean evidence file (incident summary + access log + dated correspondence) typically moves through initial triage within a few weeks, with the full investigation running longer. Use the waiting period to keep your 90-day evidence file updated and to decide whether to also file a civil claim in the Magistrate's Court (Subordinate Courts Rules 1980) or Sessions Court (Courts of Judicature Act 1964) for any out-of-pocket losses.