A few simple habits can help protect you and your clients from cybercriminals preying on real estate transactions.
Woman Logging in to her account with security password
© ArtistGNDphotography / E+ / Getty Images

Cybersecurity—the word itself might make you feel a little guilty because you know you’re probably not doing enough.

Maybe you’ve been banking on the idea that it won’t happen to you. But cybercrime is a real and growing threat to real estate professionals and their clients, particularly as criminals become more sophisticated in targeting transactions, impersonating sellers and intercepting wire transfers, Chris DeRosa, the National Association of REALTORS® member, information and eCommerce product leader, said during a Thursday session at NXT, “Cybersecurity Best Practices.”

DeRosa and Sebastian Drywa, NAR’s director of cybersecurity, shared how real estate professionals can better protect themselves, their brokerages and associations and their clients—and offered some reassurance that you don’t need to have a complicated security systems in place to get started.

Take a Pause

DeRosa encouraged attendees to pause before responding to unexpected requests. Criminals count on people being busy, trusting and eager to help. They use urgency to get people to act before thinking. Before clicking a link, opening an attachment or sending money, ask yourself—and encourage your clients to do the same:  

  • Would this person normally contact me with this request?
  • Does this request make sense?
  • Would my bank ever email me asking for my password?
  • Was I expecting this attachment from my manager?
  • Does this sound like someone I've been working with?

Taking two or three minutes to verify a request can save yourself the timely, costly and emotional aftermath of having to deal with fraud.

Related: The New Red Flags of Real Estate Fraud

Protect the Information You Have

Cybersecurity is about preventing someone from getting into your accounts, but also it’s about limiting how much information you expose if a breach occurs.

DeRosa encouraged businesses and associations to establish a data retention and destruction policy. Know what records you have, how long they must be kept and when they should be destroyed. Work with your attorney and accountant to understand applicable federal and state requirements.

Don’t just keep everything indefinitely, she said. The less unnecessary personal information you retain, the less you have to expose in a data breach, she added.  

She also recommended carefully reviewing the third-party vendors you use.

Know what information they store, how they protect it and how they’re allowed to use it. 

Have a legal counsel review vendor agreements and then review those relationships annually.

Also, keep track of who has access to your systems. When an employee or agent leaves your brokerage or association, remove their access to your organization’s network and email as well as any outside vendor platforms, financial systems and other third-party services, DeRosa noted.

She also cautioned agents to be mindful of the information they share personally. Social media posts about a new home, vacation or vehicle can reveal details criminals can us to build convince phishing messages. Even a visible license plate or home in a photo can provide more information than you meant to share.

Related: What’s Real, What Isn’t? How to Spot Deepfakes, AI Real Estate Scams

6 Habits to Adopt Before Your Next Transaction

Drywa outlined practical steps agents and their clients can take to reduce the risk of fraud.

  1. Call, don’t click. Never accept new wiring instructions or payment changes by email alone. Call a trusted, previously verified number to confirm.  
  2. Verify identities. Be especially cautious with absentee sellers, vacant properties and rushed sales. Remember, video and voice can now be replicated with AI.
  3. Turn on multifactor authentication. Protect email and other important accounts with MFA. Use unique passwords—or better yet passphrases—for every account and consider using a password manager.  
  4. Establish a code word. Create a verification word with your team and clients for any requests involving money. A familiar voice isn’t necessarily proof of identity. “No word, no wire,” Drywa said.  
  5. Warn clients early. Explain your communication and wire procedures at the beginning of your client relationship. Put it in writing: You will never request a change to wiring instructions by email.  
  6. Report fraud immediately. If money is sent to a fraudulent account, have a procedure in place of what to do immediately—preferably within the hour. Drywa recommended:
  • Call the bank and request an urgent wire recall.
  • Report the incident to the FBI’s Internet Crime Complaint Center at Ic3.gov.  
  • Notify everyone involved by phone (e.g. title company, lender, client, etc.).
  • Reset every password.  

For additional guidance, NAR has launched Protecting Your Clients and Your Business From Fraud, which brings real estate fraud prevention information in one scannable place to help stay ahead of the scammers.