$350 Million Per Year — and Growing

Wire fraud in real estate is an epidemic. The FBI's Internet Crime Complaint Center (IC3) reports that real estate-related business email compromise (BEC) resulted in over $350 million in losses in 2023 alone — and that only counts reported cases. The actual number is almost certainly higher.

Here's how the scam typically works:

1. An attacker compromises a real estate agent's, title company's, or attorney's email
2. They monitor email threads, waiting for a transaction approaching closing
3. At the critical moment, they send wire instructions from what appears to be a legitimate email address
4. The buyer wires their down payment — sometimes their entire life savings — to the attacker's account
5. The money is gone within hours, usually unrecoverable

The average loss per incident is $150,000 to $400,000. For many victims, it's the largest financial transaction of their lives, stolen in an instant.

And increasingly, the attack chain starts with your website.

How Your Website Enables Wire Fraud

Most people think of wire fraud as an email problem. It is — but your website is often the weak link that makes the email attack possible.

Domain Spoofing Starts with Missing Email Authentication

If your real estate website's domain doesn't have proper email authentication (SPF, DKIM, and DMARC), attackers can send emails that appear to come from your exact domain. Not a look-alike domain — your actual domain.

Without these protections, an attacker can send an email from closing@yourcompany.com that passes every spam filter and looks completely legitimate to the recipient. The email contains "updated wire instructions" that route funds to the attacker's account.

78% of small businesses we've scanned lack proper email authentication. In our Austin study, real estate brokerages averaged a D grade (65/100) — some of the worst scores across all industries.

Website Compromise Enables Credential Theft

A hacked website gives attackers access to your email system, customer data, and transaction details. Common entry points include:

• Outdated CMS installations — WordPress with unpatched vulnerabilities
• Missing security headers — No Content-Security-Policy means attackers can inject scripts
• Weak admin credentials — Default login pages with no brute-force protection
• Exposed admin panels — 29% of businesses we scanned had exposed admin URLs

Once inside your website, attackers can:

• Access email accounts connected to the domain
• Install keyloggers that capture login credentials
• Read transaction details to identify high-value targets
• Set up email forwarding rules to intercept communications

Domain Lookalike Attacks Build on Weak Security

Even if attackers can't spoof your exact domain, they create lookalikes: yourcompany-closings.com or yourcornpany.com (with an "rn" instead of "m"). These attacks are more convincing when your legitimate domain has poor security — because clients have no baseline expectation of security indicators to compare against.

Real Cases: When Wire Fraud Hits Real Estate

Case 1: The $1.2 Million Closing

A couple in Maryland was purchasing their dream home. Three days before closing, they received wire instructions from what appeared to be their title company's email address. They wired $1.2 million. The email was spoofed — the title company's domain had no DMARC policy. The money was never recovered.

Case 2: The Compromised Brokerage

A Texas real estate brokerage's WordPress site was running a plugin with a known vulnerability. Attackers exploited it, gained admin access, and used it to access the company's email system. Over six weeks, they intercepted wire instructions for three separate transactions, stealing $487,000 before the breach was detected.

Case 3: The Forwarding Rule

A Florida real estate attorney's email was compromised through a phishing attack enabled by the firm's lack of email authentication. The attacker set up a mail forwarding rule — invisible to the attorney — that forwarded all emails containing "wire" or "closing" to an external address. The attacker used this intelligence to intercept $340,000 across multiple transactions.

What the Industry Is Doing (and Why It's Not Enough)

The real estate industry has responded with awareness campaigns: "Always verify wire instructions by phone." That's good advice, but it's a band-aid. It puts the burden on the consumer to catch a sophisticated attack, and it does nothing to prevent the attack from happening in the first place.

Some title companies now use secure closing portals. That helps — but only for firms that invest in them, and only when buyers actually use them.

The real fix starts earlier in the chain: securing the websites and domains that attackers exploit to launch these attacks.

The Website Security Checklist for Real Estate

If you're a real estate agent, broker, title company, or real estate attorney, here's what you need:

Email Authentication (Critical)

• SPF record — Specifies which mail servers can send email for your domain
• DKIM signing — Cryptographically signs outgoing emails
• DMARC policy set to reject or quarantine — Tells receiving servers to block unauthenticated emails

This is the single most impactful step you can take. It prevents attackers from sending emails as your domain. Without it, you're essentially leaving the keys in the ignition.

Security Headers (High Priority)

• Content-Security-Policy — Prevents script injection on your website
• Strict-Transport-Security — Forces secure connections
• X-Frame-Options — Prevents clickjacking
• X-Content-Type-Options — Blocks MIME-type attacks

Missing security headers are the #2 most common vulnerability we find.

SSL/TLS Configuration (High Priority)

• Valid, properly configured SSL certificate
• TLS 1.2 or higher (no legacy protocols)
• No mixed content
• HSTS enabled to prevent downgrade attacks

CMS and Software Updates (Ongoing)

• Keep WordPress, plugins, and themes updated
• Remove unused plugins
• Use a web application firewall (WAF)
• Secure your admin login (non-default URL, 2FA, login attempt limits)

Monitoring and Alerting

• Set up email forwarding rule alerts
• Monitor for unauthorized DNS changes
• Enable login notifications
• Regularly scan your security posture

Your Liability as a Real Estate Professional

Here's the uncomfortable truth: if a client loses money to wire fraud that was facilitated by your weak website security, you may be liable.

Courts have increasingly held that businesses have a duty of care to implement reasonable security measures. "Reasonable" is defined in part by industry standards — and industry standards now include email authentication and basic website security.

The National Association of Realtors (NAR) has published cybersecurity guidelines. State real estate commissions are issuing security requirements. Errors and omissions (E&O) insurance policies increasingly include cybersecurity provisions — and exclusions for negligence.

Failing to secure your domain and website isn't just a technical oversight — it's a liability exposure.

The Cost of Prevention vs. the Cost of a Breach

Let's compare:

Prevention:

• Email authentication setup: Free to $50/month
• Security header configuration: Free (server config changes)
• SSL/TLS proper configuration: Included with most hosting
• Regular security scanning: Free with TridentScan
• Total: $0-50/month

A single wire fraud incident:

• Average client loss: $150,000-$400,000
• Legal defense costs: $50,000-$200,000
• E&O insurance claim and premium increase: $10,000-$50,000/year
• Reputation damage: Incalculable
• Total: $200,000+ per incident

The math isn't complicated.

Scan Your Real Estate Website — Free

You can find out exactly where your website stands in 60 seconds. TridentScan scans your domain for email authentication, security headers, SSL configuration, and technology vulnerabilities — the exact weaknesses attackers exploit for real estate wire fraud.

No signup. No credit card. Just answers.

→ Scan your real estate website free at TridentScan.com

Don't wait until a client calls to tell you their life savings are gone. Check your site now.