Protect the Deal: Information Security Roundtable for Real Estate Teams
Everything needed to run a small-group roundtable on wire fraud, AI impersonation and client data protection for real estate agents and staff: facilitator plan, agenda, discussion prompts, a four-stage tabletop scenario and a one-page printable handout.
Join to save this for later.
- $275Mlost to real estate fraud in 2025
- 12,368real estate victims reported to the FBI
- 22,000+complaints citing AI-powered scams
- 58%of attempted thefts frozen when reported fast
As of 2025. Source: FBI Internet Crime Complaint Center (IC3) 2025 Annual Report
Outcomes
- Name the three points in a transaction where attackers insert themselves: the inbox, the money and client data.
- Commit to call-back verification on every wire or payment-detail change.
- Know who to call and what to do in the first hour after suspected fraud.
- Surface at least one workflow gap the brokerage can fix.
Agenda
| Time | Block | What happens |
|---|---|---|
| 0:00–0:10 | Welcome & hook | Broker opens. Facilitator shares one real closing-fraud story and the headline loss figure. Ground rules. |
| 0:10–0:25 | Story round | Each person shares a suspicious email, text or call. Capture themes on a flip chart. |
| 0:25–0:50 | Guided discussion | Work through 3–4 discussion topics chosen from what surfaced in the story round. |
| 0:50–1:10 | Tabletop scenario | Groups of 3–4 work through 'The Friday Wire', one stage at a time, then report back. |
| 1:10–1:20 | Gap check | Sticky notes: 'One thing in our process that worries me.' Group and rank. |
| 1:20–1:30 | Commitments & close | Walk the handout. Each person names one habit they'll start this week. |
Discussion topics
Wire fraud & business email compromise
Attackers spoof the title company, lender or agent and send new wire instructions near closing.
- Who in a deal can change wire instructions?
- How would a client know an email really came from us?
AI-powered impersonation
Emails, voices and video can be faked convincingly.
- Would you recognize a cloned voice of your broker?
- What's our code-word or call-back rule?
Client data protection
Agents hold IDs, bank statements and pre-approvals in email, phones and cloud drives.
- Where does client paperwork live on your phone right now?
- When do we delete it?
Mobile & public Wi-Fi
Agents work from open houses, cars and coffee shops.
- Who uses personal phones for client texts?
- Is MFA on your email and MLS login?
Seller impersonation & title fraud
Fraudsters pose as owners of vacant land or rentals to sell property they don't own.
- What's our check when a seller won't meet in person or on video?
Lockbox, showing & listing security
Listing photos and showing schedules reveal when homes are empty and what's inside.
- Do our listing photos show safes, alarm panels or valuables?
Rental & listing scams
Scammers copy listings to take deposits from renters and buyers.
- How do we spot and report a hijacked listing?
Incident response
Fast reporting is what makes frozen funds possible.
- If a client wires to the wrong account, who calls whom in the first hour?
The Friday Wire
Give each group one stage at a time, about 5 minutes apart. Groups answer each stage's question before seeing the next.
Wednesday, 3 days before closing
The buyer forwards an email from 'the title company' with updated wiring instructions and a note that the old account is being audited. The logo and signature look right.
What do you tell the buyer?
Thursday
The buyer calls the number in that email to confirm. A friendly person confirms the new account.
Is the buyer safe? What number should they have called?
Friday, 10 a.m.
The real title company calls: they haven't received the funds. The buyer wired $180,000 yesterday.
Who do you call first, second and third? What do you tell the buyer?
Friday, 2 p.m.
You find a mail rule in your own inbox forwarding anything containing 'closing' to an outside address.
What does this mean, and who else is at risk?
Reveal debrief
- Verify only with a number from an independent, known source, never from the email itself.
- First hour: buyer calls their bank for a wire recall, file at ic3.gov, notify title and the broker, contact the local FBI field office.
- The mail rule means the agent's account was compromised: reset the password, turn on MFA, check other open deals, notify IT.
Handout
Habits
- Call back before any money moves, using a number you already trust.
- Tell clients on day one: 'We will never change wire instructions by email.'
- Turn on MFA for email, MLS, e-signature and transaction software.
- Send documents through secure portals, not email attachments or texts.
- Agree a code word with your broker and team to beat cloned voices.
- Clear client files from your phone and downloads after closing.
Red flags
- Last-minute change to wire or payment details
- Urgency or secrecy: 'the account is being audited, send today'
- A sender address one letter off from the real one
- A seller who will not meet in person or on video
- Vacant land or a rental listed for a quick cash sale
- Mail rules or forwarding in your inbox you did not create
First hour
- Bank. Client calls their bank now and asks for a wire recall.
- Report. File at ic3.gov with full transaction details.
- Notify. Broker, title company, lender and the local FBI field office.
- Contain. Reset passwords, check mail rules, alert IT.
Facilitator checklist
2 weeks before
- Confirm date, room and attendee list with the broker
- Learn their email, transaction and e-signature platforms
- Send the invite with the 'bring one story' ask
Day of
- Print handouts, scenario cards (one stage per card) and sticky notes
- Set up a flip chart with three columns: Inbox · Money · Client data
- Assign a note-taker
Within 1 week after
- Send a thank-you with the handout PDF and the top 3 gaps raised
- Give the broker an action list: gap, suggested fix, owner
- Log attendance and themes
- Schedule the quarterly refresher
ISO 27001:2022
- A.5.7 Threat intelligence
- A.5.14 Information transfer
- A.5.24 Information security incident management planning and preparation
- A.5.26 Response to information security incidents
- A.5.34 Privacy and protection of PII
- A.6.3 Information security awareness, education and training
- A.6.8 Information security event reporting
- A.8.5 Secure authentication