REA Group Protects its Brands and Reputation with Social Engineering Defense

REA Group operates Australia’s leading residential and commercial property websites. What began in 1995 as a local startup operating out of a garage has evolved into a top ASX-listed company supporting every stage of the property journey.

Today, REA Group manages an expansive portfolio of brands spanning digital real estate advertising, financial services and franchise mortgage networks, and property data systems.

Operating at this scale means managing an incredibly broad digital surface area.

REA Group sits at the vital intersection of real estate customers (primarily real estate agents) and millions of Australian consumers looking for their next home. Because trust is a major currency in property transactions, an external threat to the brand can be devastating.

To defend against automated, AI-driven scams and impersonation campaigns, REA Group partnered with Doppel to move beyond legacy limitations into a proactive Social Engineering Defense (SED) model.

The rise of automated deception across the property ecosystem

As REA Group has expanded its portfolio through acquisitions, each new brand has added to the company’s public-facing attack surface. At the same time, threat actors are increasingly relying on generative AI to scale their operations.

Marc Bown, Chief Information Security Officer at REA Group, highlights this challenge:

"[Attackers] can scale much more readily with AI tooling. From a brand impersonation perspective, we expect it to get even trickier to defend ourselves against fake domains and social media. The effort involved in creating something that looks real has gone to basically zero."

These threats can exploit everyday consumers' trust. Attackers use lookalike domains, fake mobile apps, and deceptive social media setups to launch scams and phishing lures.

Joanna Dalton, Head of Cyber Defence at REA Group, notes that the impact of external social engineering goes far beyond the standard corporate perimeter:

"Being such a popular app on so many people's phones across the country, making sure it’s the real version is vital. Brand protection with Doppel means helping protect our customers and consumers from downloading something malicious."

Breaking free from legacy constraints

REA Group’s security team recognized that manual triage and legacy products simply couldn’t keep pace with machine-speed threat actors.

The organization’s brand protection solution was becoming less effective at active takedowns, and REA Group increasingly found impersonation campaigns that had not been detected. At the same time, the team was looking for something with the right API architecture to integrate brand protection into REA Group’s internal security automation workflows.

To find a technology stack built for modern, multi-surface deception, REA Group initiated a proof of concept.

"The volume of detections that Doppel was able to find versus the other systems was mind-blowing," Joanna Dalton says. "It really highlighted the size of the problem that we didn't know how big it was at that time. We can't scale to having 500 analysts sitting there looking at websites or deciding if something is significant."

In one category alone, fake apps, Doppel was impressive. During a two-week POC, Doppel found more fake apps than what the company had identified over the previous year.

From manual triage to automated remediation

REA Group deployed Doppel to centralize its digital risk operations and gain an authentic, campaign-level view of threat infrastructure. Rather than relying strictly on simple network metadata or isolated keywords, Doppel applies contextual layers that mirror human intuition. The platform scans lookalike domains, tracks typo-squatting vectors, and analyzes visual attributes like color schemes to spot exact design clones, even when an attacker avoids using the official corporate logo.

The partnership unlocked structural efficiency by automating high-confidence remediations across the entire brand portfolio. By integrating Doppel directly with tickets received from the customer-facing fraud team, REA Group removed friction from its standard incident response playbook.

"Being able to automate [takedowns] based on the tickets we're receiving from the fraud team has removed a huge amount of manual work for us...It makes it far more efficient,” notes Dalton.

Crucially, Doppel solved a persistent engineering headache: dismantling phishing sites shielded behind complex setups like Cloudflare. Where legacy scanners would halt at the reverse-proxy layer, unable to bypass sophisticated anti-bot challenges and CAPTCHA, Doppel reliably routes past the obstruction to identify the true underlying threat and execute the takedown.

Measurable posture improvement and scalable future growth

By shrinking the timeline between threat setup and infrastructure eradication, Doppel has supported REA Group’s digital boundaries. When live phishing incidents or brand abuses emerge, the security operation can now move quickly from detection to remediation.

When asked what the biggest operational win was, Dalton says, “Response times. When we have an incident where there's been a phishing compromise... the speed that [Doppel] has been able to execute the takedown has been comforting from my perspective."

The partnership has also given REA Group faster access to expert support during active investigations. The team can escalate questions, discuss threat intelligence findings, and get rapid responses from people who understand the technical details of the threat landscape. For Dalton, that combination of fast takedowns and knowledgeable partnership makes Doppel “a nice thing not to have to worry about.”

Doppel’s breadth of coverage has also been valuable. Beyond domains and phishing pages, REA Group can act across channels such as malicious Telegram accounts connected to scams, helping the team disrupt abuse wherever attackers try to exploit the brand.

For Bown, the business stakes are clear. REA Group’s brand is one of its most important assets: millions of Australians come to its marketplace because they trust it. If that trust is damaged, consumers may choose alternatives, making brand protection a “ticket to play” for the business. He remarks:

“Our brand is our biggest asset. People come to our site because of that brand, and we need to protect it. Having the ability to do it all in one place is powerful. That consolidation into one tool and one team that knows all about our brands and how we work is useful to help unlock more bandwidth.”

Looking forward, REA Group sees Doppel as a valuable part of its acquisition playbook. As new businesses join the portfolio, Doppel can help bring earlier-stage brands up to the same protection standard as the rest of the Group.

By establishing a synchronized, automated baseline of protection across every asset in its portfolio, REA Group ensures that its marketplace remains a reliable, trusted environment where millions can explore their property journeys safely.