Email security
Real estate wire fraud protection
Agents, brokerages, closing attorneys and title offices from Charleston to Savannah use email security and telephone callback rules to fight real estate wire fraud.
Closing chain risks
Hijacked mailboxes break residential closing chains
South Carolina closings run through a closing attorney's office, while wiring instructions move by email between the agent, attorney, lender and buyer. Fraudsters compromise an email account to send altered wire instructions.
- 1
Agent mailboxes
Fraudsters break into agent mailboxes to send fake wire instructions, so sign-in rules limit access while forwarding alerts flag a new forwarding rule on the mailbox.
- 2
Attorney and title mailboxes
Attackers spoof attorney and title office mailboxes using look-alike addresses, so impersonation warnings flag fake senders and DMARC rules protect the office's actual domain.
- 3
Telephone callback rules
Telephone verification using an independently obtained number covers every changed instruction before any money moves.
FBI figures from 2025 on internet crime
Three figures from the FBI 2025 internet crime report show complaints and financial losses for business email compromise and real estate fraud.
24,768
Business email compromise complaints
Reported losses totaled $3,046,598,558 across all business email compromise complaints in 2025.
$449,000
Wire in August 2025 example
Sent after an email impersonating a couple's attorneys during a home closing, though the recipient bank reported the full amount on hold after the complaint and freeze request.
12,368
Real Estate category complaints
FBI defines that category as investment, rental and timeshare fraud, while business email compromise on a closing is counted under business email compromise. Losses reported here totaled $275,110,419.
Figures published in the FBI IC3 2025 Internet Crime Report.
Email security fits local real estate offices
Most offices near the coast have fewer than five people, 1,278 of 1,387 by the 2022 Census Bureau count for the six counties from Charleston to Savannah.
Select your office type
Messages and settings that matter
Mechanics of a business email compromise
Each step shows what an attacker does, followed by what CloudCentric sets up beforehand. Screens shown here are Microsoft's own documentation screenshots containing sample data.
Set up beforehand
Details sourced from the FBI IC3 2025 report, NAR and Microsoft Learn.
Layers protecting mailboxes and closings
Technical controls and office procedures stack together, ensuring stolen passwords alone fail and changed instructions face direct verification.
Software
See also
Response steps for compromised mailboxes
Response procedures for CloudCentric clients follow Microsoft's compromised account documentation alongside ALTA's rapid response plan.
Steps sourced from Microsoft Learn and ALTA's rapid response plan.
Questions about real estate wire fraud
- What is real estate wire fraud and how does it usually start?
Business email compromise starts when fraudsters compromise email accounts through social engineering or computer intrusion, impersonating a title company, agent or closing attorney to send altered wire instructions for unauthorized transfers.
- What can an agent do today with no software at all?
NAR recommends verifying wire instructions by phone with a number obtained independently, never sending instructions by email, using a signature warning, and applying strong unique passwords and two-factor authentication where available.
- Can CloudCentric stop every single fraudulent message?
No filter or rule is perfect. Telephone callback rules come first because technical controls cannot block everything, meaning manual verification covers changed wiring instructions when a spoofed message reaches the inbox.
- Do Microsoft 365 and Google Workspace both work, and which Microsoft plans carry the advanced alerts and training?
Both platforms support multifactor authentication and sign-in rules. Forwarding alerts are listed for Microsoft E1, E3 or E5 type subscriptions. Defender for Office 365 adds impersonation protection, while attack simulation training requires Defender Plan 2 or E5.
- What does South Carolina require of closings, and are closing attorneys' and title offices covered?
South Carolina closings should be conducted only under the supervision of attorneys, as the state Supreme Court held. Information provided here is not legal advice. Offices receive impersonation protection alongside DMARC coverage for their own email domain.
- What happens when an agent's mailbox is hit?
Accounts are locked, passwords reset without email delivery, and active sessions revoked. Forwarding rules are removed, logs and sent messages checked, and transaction parties notified. Businesses then call banks and file complaints to attempt a freeze.
- How does the work start and what areas are covered?
Times and prices are not listed here, so call (844) 422-7000 or book a walkthrough. CloudCentric works from Mount Pleasant and covers Charleston to Savannah.
Sources: FBI IC3 2025 Internet Crime Report; NAR wire fraud guidance; ALTA rapid response plan for wire fraud incidents; South Carolina Supreme Court, Doe v. McMaster; Microsoft Learn, respond to a compromised email account.
Secure residential closing chains
Call (844) 422-7000 to set up email security and telephone verification rules that prepare real estate offices for wire fraud attempts.