Cybersecurity for real estate agencies: Stopping wire fraud

A closing puts a large sum of money, a hard deadline and a chain of emails between people who have never met into the same week, and that combination is what wire fraud scammers look for. For a small agency, the most useful defenses cost little or nothing: a written verification process, a few minutes of setup on your email, and a clear warning to every client.

This guide is written for brokers and small teams. It isn't legal advice, and your state's license law and real estate commission set your actual duties to clients, so read their guidance alongside it.

How does wire fraud happen in a real estate closing?

The FBI files it under business email compromise (BEC). In a 2023 public service announcement, it says these scams target every participant in a real estate transaction, including buyers, sellers, real estate attorneys, title companies and agents.

The FBI describes a common sequence. A criminal gets into one participant's email account and watches the deal. Close to settlement, they send a request to change the payment type, often from a check to a wire, or to switch to a different bank account under their control. The money can then move on to a second account, in the U.S. or abroad.

72%

The weak point is often a forwarded email. In a 2025 case study, the North Carolina Real Estate Commission described a newly licensed agent who received wiring instructions that appeared to come from the closing attorney. The attorney's email account had been hacked. The agent forwarded the email and told the buyer to wire the funds. The buyer sent $42,000, and it could not be recovered. The Commission's view was that the agent should have sent the client to the closing attorney's own verification process.

Map who sends wire instructions in your typical deal, usually the title company, escrow office or closing attorney, and make it office policy that agents never relay them.

Why are lookalike domains so hard to spot?

A scammer doesn't always need to hack anyone. They can register a domain one letter away from a real one, like yourbusines.com instead of yourbusiness.com, or swap the ending to .co or .net. Mail from that domain can pass SPF, DKIM and DMARC, because the scammer controls it.

Phones make it worse. Many mail apps show the sender's display name and hide the full address, so "Main Street Title" looks the same whether it comes from the title company or from a stranger. The FBI's 2024 BEC announcement advises verifying the sender's address "especially when using a mobile or handheld device" and being "alert to hyperlinks that may contain misspellings of the actual domain name."

The CFPB warns buyers that "scammers can closely replicate the email address, phone number and format of an exchange from your agents." That's why no amount of squinting at addresses replaces a phone call to a number you got some other way.

A few habits help your own team:

• Tap or hover on the sender's name to see the full address before acting on anything about money.
• Turn on your email service's warning label for messages from outside your organization, if it offers one.
• Register the most obvious misspellings of your own domain so nobody else can.

Tell agents that any email about money, from anyone, gets checked by phone.

How should clients verify wire instructions?

By phone, using a number they already have. The CFPB tells buyers to "Never follow instructions contained in an email" and to verify the closing instructions, "including the account name and number," either in person or "by using the phone number you previously agreed to." It also suggests agreeing on a code phrase with your trusted contacts ahead of time. The FBI's version is shorter: use secondary channels or two-factor authentication to verify any change in account information.

A written process makes this routine instead of awkward. For most agencies, it looks like this:

1. At contract signing, hand the buyer the title or escrow company's name and main phone number, taken from its website or your files, on paper.
2. Tell the buyer that wire instructions will come only from that office and will never change by email.
3. Before wiring, the buyer calls that number and reads back the account name and number.
4. After sending, the buyer calls again to confirm the money arrived.
5. If wiring instructions ever land in an agent's inbox, the agent doesn't forward them and tells the client to call the closing office.

Brokers who supervise newer agents can add this to the office policy manual and walk through it in onboarding. The NCREC case above turned partly on a supervising broker who never reviewed the new agent's transactions.

Can DMARC stop scammers spoofing your agency's domain?

For your exact domain, yes. Three DNS records, SPF, DKIM and DMARC, let receiving providers check whether mail claiming to be from yourbusiness.com really came from you. The FTC says that without these protections, "scammers can use your domain name to send phishing emails that look like they're from your business."

DMARC is the record that tells providers what to do with mail that fails. Microsoft recommends a gradual approach: start at p=none and monitor, move to p=quarantine, and aim for p=reject. A starting record looks like this:

A real estate office can have several services sending mail for it. Your CRM, transaction management platform, e-signature service, newsletter tool and listing alert system may all send as your domain. Get each one into SPF and DKIM before you tighten the policy, or your listing alerts may start going to spam. The guide to reading DMARC reports shows how to spot those senders.

DMARC only protects a domain you own. Agents who run business through personal Gmail or Yahoo addresses get none of this, so move them onto agency mailboxes.

Check your domain with the free DMARC checker. If the record is missing, follow how to fix a missing DMARC policy.

Check your agency's email and website from the outside

Run a free scan of your domain's SPF, DKIM and DMARC records and your website, with plain-English fixes for anything missing.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

Which accounts need MFA at a real estate agency?

Any account a scammer could use to watch a deal or send instructions should have multi-factor authentication (MFA), which means a stolen password alone isn't enough to sign in.

Turn it on in this order:

1. Every agent and staff mailbox, including the broker's.
2. Transaction management and e-signature platforms, where contracts and closing dates live.
3. Your CRM and MLS logins, which show who is buying what and when.
4. The domain registrar and DNS host, since whoever controls DNS can change your email and DMARC records.
5. Bank and escrow account portals.

Use an authenticator app or security key where the service supports one. Google's Workspace guidance calls security keys "the most secure form of 2SV" and discourages text message codes, which "might be intercepted."

Many agencies work with independent contractors who bring their own phones and laptops. Make MFA a condition of getting an agency mailbox, and remove access to the transaction platform and shared drives on the day an agent leaves. While you're in each mailbox, check for forwarding rules nobody remembers creating, since a hidden rule can copy every message to an outsider.

What should you tell clients about wire fraud?

Tell them early and repeat it in the same words. A buyer who hears the warning at signing, sees it in every email and gets it again two days before closing has three chances to remember it when a "new instructions" message arrives. Adapt these three messages for your agency.

For the buyer agreement or first meeting:

Wire fraud warning: Scammers send fake emails that look like they come from agents and title companies. We will never email you wiring instructions or ask you to change where you send money. Before you wire anything, call the title company at the number on this sheet, not a number from an email, and confirm the account details.

For every agent's email signature:

We will never send or change wire instructions by email. Before wiring money, call your title company at a number you already have.

As a text two days before closing:

Reminder before closing: please call the title company at the number on your closing sheet to confirm wiring details before you send funds. If anyone emails you new instructions, don't use them. Call me or the title company first.

Add the signature line to every agent's email this week, and put the first message in your buyer packet.

What happens if a client wires money to a scammer?

Call the bank first. The FBI says that if you discover a fraudulent transfer, "time is of the essence," and advises contacting the bank immediately to "request a recall of the funds." It also asks victims to file a complaint at ic3.gov "Regardless of the amount lost."

Fast reporting can work. The FBI's 2024 Internet Crime Report describes buyers in Denver who got a spoofed email from their supposed real estate agents asking them to wire $956,342 to finalize a closing. Two days later they realized the email was fake. The FBI's Recovery Asset Team froze the receiving account, and $955,060 was returned to them.

If it happens in one of your deals:

• Have the buyer call their bank's fraud line and ask for a wire recall right away.
• File the complaint at ic3.gov with the buyer, including the fake email and wiring details.
• Call the title company or closing attorney so they can check their own accounts and warn other parties.
• Change passwords on any agent mailbox involved, then review recent sign-ins and forwarding rules.

If scammers impersonated your agency, the FTC also suggests telling customers quickly, using an email without links so your warning doesn't look like phishing.

What should you do next?

Start with the steps that protect your clients' closing funds.

1. Check your domain with the DMARC checker and fix what's missing. The guide to stopping email spoofing walks through each record.
2. Turn on MFA for every agent mailbox and your transaction platform this week.
3. Add the wire fraud signature line to every agent's email and the warning to your buyer packet.
4. Run the free website security scan to check your website and email setup in one report.