Wire fraud is the defining risk in real estate. Everything else is secondary.
Real estate transactions combine three things attackers want: large sums moving on a known date, many parties emailing each other across organisational boundaries, and a closing deadline that punishes anyone who slows down to verify.
The attack is rarely technical. Someone gains access to a mailbox — often at the smallest, least defended party in the chain — monitors quietly, then sends revised wire instructions from a lookalike domain at exactly the moment everyone expects them. The buyer wires their entire down payment to the attacker. The funds are typically moved offshore within hours.
What makes this uniquely damaging is who absorbs the loss. It is frequently a family’s entire savings, the transaction collapses, and every party in the chain faces questions about which of them was compromised.
Any wire instruction, or change to one, is verified by calling a number already on file — never a number in the email. This single rule stops the overwhelming majority of attempts.
DMARC, DKIM and SPF configured to enforcement so your domain cannot be trivially spoofed, plus lookalike-domain detection in Defender for Office 365.
Phishing-resistant MFA and alerting on forwarding rules, which is how attackers quietly monitor a transaction for weeks without detection.
Explicit written notice at the start of every transaction that wire instructions never change by email. It shifts the client from trusting to verifying.
The callback rule fails in one predictable way: someone calls the number in the email because it is right there and they are busy. The rule has to specify a number already on file, obtained before the transaction began, or it provides false comfort.
Property managers hold tenant records — identity documents, bank details, employment verification, and often background and credit information. That is a data-protection obligation under California law entirely separate from the wire-fraud risk, and it usually lives in systems chosen for convenience.
The practical questions are how long you keep records for applicants you declined, and who can still reach them. Both are answerable in an afternoon and neither usually has been.
Title companies and escrow officers hold the instructions everyone else relies on, which makes them the highest-value target in the transaction and the party most often impersonated.
If you operate in this part of the chain, the asymmetry matters: your compromise damages every party in the deal, and your verification discipline protects people who have no visibility into your controls. Treating email authentication and callback verification as table stakes rather than best practice is the appropriate posture.
Most brokerages and property managers evaluate providers on price and response time. Those are the two things every provider claims and neither predicts the outcome. The questions below are harder to answer well, which is exactly why they are worth asking.
Ask for the answers in writing. A provider who will commit to them in an email is a different proposition from one who will only say them on a call.
For the security layer, see cybersecurity services. Wire fraud is defeated by trained people more than by tools — see security awareness training. For day-to-day support, see managed IT. If a fraudulent wire has already gone, act within hours: see incident response.
Adopt one non-negotiable rule: wire instructions are never accepted or changed based on an email. Every instruction is verified by calling a number already on file — obtained before the transaction began, never one supplied in the request — using a passphrase agreed at the start. Support it with DMARC at enforcement, phishing-resistant MFA on all mailboxes, and an explicit written warning to clients.
Act within hours. Contact the sending bank immediately and request a recall, file with the FBI's IC3 which can trigger the Financial Fraud Kill Chain, notify your carrier and counsel, and preserve the mailbox evidence rather than deleting the fraudulent emails. Recovery odds fall sharply after the first day and approach zero after the funds are moved offshore.
Attackers select by transaction value, not firm size. A four-agent brokerage closing a $900,000 sale is a more attractive target than a large firm with mature controls, and smaller firms are usually the least defended party in the chain — which is precisely why they get compromised first. The core control, verified callbacks, costs nothing but discipline.
Applicant and tenant records typically contain personal information within scope of California's breach notification statutes, and CCPA obligations may apply depending on your thresholds. The practical questions are how long you retain records for applicants who never became tenants, whether scanned identity documents are sitting in email, and who still has access.
DMARC tells receiving mail servers what to do with email claiming to be from your domain that fails authentication. Without it at enforcement, anyone can send email appearing to come from your brokerage. Most firms configure it in monitoring mode and never advance to enforcement, which provides reporting but no protection — the staged rollout is the work worth paying for.
Yes, at the start of every transaction and again before closing. It changes client behaviour from trusting instructions to verifying them, and it demonstrates that you took reasonable steps — which matters if a loss occurs and responsibility is examined afterwards.
Schedule a free consultation today.