Business Email Compromise Prevention for Real Estate Transactions

How BEC fraud plays out in a real estate transaction

The pattern is consistent across most reported cases. An attacker gains access to an email account somewhere in the transaction chain, often the buyer's, the agent's, or the real estate lawyer's, usually through a phished password with no MFA protecting it. From there, the attacker monitors the conversation quietly for days or weeks, waiting for the moment closing funds or a deposit are about to move.

At the right moment, the attacker sends an email that looks identical to a legitimate message in the existing thread, often from a nearly identical spoofed domain, providing 'updated' wire instructions for a deposit or closing balance. Because the email arrives in the middle of an existing, trusted conversation and references real transaction details, it is convincing enough that funds have been wired directly to fraudulent accounts in real cases across Canada.

Why real estate transactions are especially exposed

Several factors specific to real estate make this fraud pattern effective. Transactions involve parties, buyers, sellers, agents, brokerages, and lawyers, who typically have no prior relationship and no established pattern for verifying each other's identity by phone. Large sums move on fixed closing dates that create urgency. And much of the coordination happens entirely over email, with no in-person or verified voice contact for key financial details.

The single most effective defence: verbal verification

No technical control fully eliminates BEC risk on its own, which is why the most effective defence is procedural: any wire instructions, or any change to previously provided wire instructions, must be verified by phone using a number obtained independently, not a number provided in the email itself. This single habit defeats the vast majority of real estate wire fraud attempts, because the attacker cannot intercept a phone call placed to a number the buyer already had on file.

• Call the lawyer's office using the number on their official website or a prior invoice, never a number in the email
• Treat any changed or 'updated' wire instruction as suspicious by default
• Confirm verbally before sending any deposit or closing fund transfer, without exception

Technical controls that reduce the underlying risk

Verbal verification protects the transaction even if an account is compromised, but reducing the odds of compromise in the first place still matters. Multi-factor authentication (MFA) on every email account involved in a transaction chain, agent, brokerage staff, and ideally encouraged for the buyer and seller as well, blocks the credential theft that BEC attacks depend on.

• MFA enforced on all brokerage and agent email accounts
• Email filtering that flags look-alike domains and unusual sending patterns
• DMARC, DKIM, and SPF configured on the brokerage's domain to make spoofing harder
• Staff training that specifically covers real estate BEC patterns, not generic phishing awareness

What brokerages should tell clients directly

Buyers and sellers are frequently the weakest link in this chain because they are unfamiliar with real estate fraud patterns and eager to complete a major life purchase quickly. Brokerages that proactively warn clients, in writing, at the start of a transaction, that wire instructions will never change by email and must always be verified by phone, reduce their own liability exposure and genuinely protect their clients' money.

If a fraudulent transfer has already happened

Speed matters enormously if a fraudulent wire has already been sent. The receiving bank and the sending bank should both be contacted immediately, since funds can sometimes be recalled or frozen within a narrow window, and the incident should be reported to local police and the Canadian Anti-Fraud Centre. An IT provider can help identify how an account was compromised and secure it against further access, but recovering already-transferred funds depends primarily on banking institutions acting quickly.

Building this into brokerage-wide practice

This kind of fraud prevention works best as a documented brokerage policy, not an individual agent's personal habit. Combining verbal verification procedures with the Microsoft 365 security configuration covered in our guide to Microsoft 365 for real estate brokerages and general cybersecurity practices gives a brokerage a consistent defence across every transaction, not just the ones handled by its most security-conscious agents. This same wire fraud pattern shows up in other industries too, as covered in our article on wire fraud prevention in construction transactions.

Sources and further reading

• Canadian Anti-Fraud Centre, business email compromise
• Canadian Centre for Cyber Security, phishing guidance

Frequently asked questions