Real Estate Cybersecurity: The Overlooked Target for Fraud

A real estate agency is coordinating the closing of a property sale. The buyer receives, apparently from the same email thread they've been using to coordinate the entire process, instructions to transfer the down payment to a new bank account due to "internal administrative changes." The buyer transfers the money — sometimes amounts representing a lifetime's savings — without suspecting anything, because the email arrived exactly at the expected point in the process, with the usual tone and format. The money disappears, and neither the agency nor the buyer realizes it until someone asks why the payment never arrived in the real account.

Real estate transactions combine three factors that make them extraordinarily attractive for fraud: very high dollar amounts compared to typical business transactions, processes involving multiple parties over email (buyer, seller, agency, notary, financial institution), and an industry that, compared to sectors like finance, has historically invested far less in cybersecurity — precisely because it doesn't always see itself as a technology target.

This combination is exactly the same pattern we describe in our guide on CEO fraud / BEC, but applied to a context where the ultimate victim is usually an individual, without the legal resources or insurance a large company would have available to mitigate the loss.

Compromise of the agency's or notary's email, where the attacker gains access to the real account through phishing or leaked credentials, then monitors active sale conversations waiting for the exact moment to insert fraudulent payment instructions.

Look-alike domain impersonation, creating an email address nearly identical to the real agency's or notary's (with a swapped letter, for example), and joining the email thread at a critical point in the process.

Monitoring public property listings, where the attacker identifies ongoing transactions through public real estate portals and directly contacts potential buyers, posing as the agent or agency.

Unlike a generic phishing email arriving without context, these attacks are deliberately timed to the exact moment the victim expects to receive payment instructions — right before closing, when time pressure and the natural anxiety of a high-value transaction reduce the likelihood the victim will stop to carefully verify.

Mandatory phone verification for any bank detail change, using an already-known, previously verified number, never the one appearing in the email with the new instructions — the same out-of-band verification principle that applies against any BEC variant.

Multi-factor authentication on all email accounts of staff involved in coordinating transactions, significantly reducing the risk of a legitimate account being directly compromised.

Proactively communicating to buyers and sellers that the agency will never change bank details by email without additional phone verification, setting that expectation from the start of the process.

Monitoring for look-alike domains, to catch early if someone has registered a domain designed to impersonate the agency in a targeted attack.

**Specific training on recognizing phishing and spear phishing** for all staff handling communication related to high-value transactions.

Always confirm any payment instruction or bank detail change with a phone call to the number you already knew before the transaction began, never the one appearing in the email with the new instructions. Be wary of any sudden change in payment details, especially arriving with urgent language near the closing date.