Real estate is one of the highest-value, lowest-security industries we work with, and it’s not close.
The typical setup: a brokerage with independent contractor agents, each using personal phones and laptops, coordinating multi-million dollar transactions over email and text, often without multi-factor authentication or any centralized security standard. Wire instructions — the single most fraud-targeted document in the entire transaction — get sent over the same unsecured channels agents use for everything else, from scheduling showings to texting clients photos of a listing.
This is exactly the environment business email compromise fraud is built for. An attacker doesn’t need to breach the brokerage’s systems — they need to compromise one agent’s personal email, watch a transaction develop, and send a spoofed wire instruction at the exact right moment, often mimicking the title company’s or the agent’s own writing style closely enough that nothing about the message itself raises suspicion. It works because nothing about the agent’s day-to-day technology use would tip them off that anything was different.
The fix isn’t complicated, but it does require standardization across a workforce that’s used to operating independently. At minimum, that means: enforced multi-factor authentication on every account touching a transaction, a centralized password manager instead of reused or shared credentials, endpoint protection extended to personal devices used for business communication, and a documented device policy that agents actually follow rather than one that exists in a handbook nobody’s read.
The single highest-leverage control in this entire scenario is a verified callback protocol for any wire instruction — no exceptions, regardless of how legitimate the email looks. That means calling a known, previously verified phone number (never one provided in the email containing the instructions) to confirm any change to wiring details before funds move. This one habit, consistently enforced, stops the overwhelming majority of business email compromise wire fraud attempts, because the fraud depends entirely on the recipient acting on the email without an independent verification step.
Our team has walked into brokerages after a near-miss wire fraud incident and walked out having standardized device security across the entire agent roster in a matter of days. The brokerages that make this move before an incident, rather than after one, are the ones that never have this story to tell in the first place. The technical work is usually straightforward; the harder part is getting buy-in from a workforce of independent contractors who don’t think of themselves as part of a centralized IT environment — which is exactly why this needs to be driven from brokerage leadership, not left to individual agent discretion.