Cyber Insurance for Real Estate Firms: Wire Fraud in Closings

Why Real Estate Closings Keep Losing Money to a Single Spoofed Email

A real estate closing moves a large sum of money on a tight deadline between people who often have never met in person, which makes it one of the most attractive targets criminals have found in financial crime. A buyer gets an email that looks exactly like it came from their title company, with new wiring instructions, and the down payment is gone within minutes of hitting the wrong account. Cyber insurance for real estate firms has increasingly had to center on this exact scenario, because it happens far more often than a headline-grabbing ransomware attack against a brokerage's own systems.

How does wire fraud actually happen during a closing?

It almost always starts with a compromised email account, not a compromised bank account.

A criminal gains access to a title company's, real estate agent's, or attorney's email inbox, often through a simple phishing email, and then quietly watches for an active transaction. At the right moment, right before funds are due, they send wiring instructions from the real, compromised account or a nearly identical spoofed domain. Because the message appears to come from a trusted source in an ongoing conversation, buyers rarely question it before sending six figures to a criminal's account.

Does cyber insurance actually cover this kind of loss?

Coverage exists, but usually only if the policy includes a specific social engineering fraud or funds transfer fraud endorsement.

A standard cyber policy built around data breach response and network security liability often does not automatically extend to money voluntarily wired by an employee who was tricked, since no system was technically "hacked" in the traditional sense. This is why understanding Cyber Insurance First-Party vs Third-Party Coverage matters so much for real estate firms specifically, since wire fraud losses fall into a first-party crime category that needs to be affirmatively added, not assumed.

What is a social engineering sublimit, and why does it matter?

It is a cap on payout for this specific type of fraud that is often far lower than the policy's overall limit.

A firm might carry a $1 million cyber policy but discover, only after a claim, that social engineering fraud is capped at $100,000 or $250,000 within that limit. On a closing involving a $600,000 down payment, that gap between the policy's headline number and its actual sublimit becomes the firm's problem to absorb.

Which party in a transaction carries the most underwriting risk?

Title companies and escrow agents typically carry the highest exposure, since they handle the largest volume of wire instructions across many simultaneous deals.

A single brokerage might close a handful of transactions a month, but a title company processes dozens, each one a fresh opportunity for a criminal watching for the right moment to insert fraudulent instructions. Underwriters reviewing submissions from title and escrow operations tend to scrutinize email security controls more closely than they would for a smaller residential brokerage, following much of the same logic covered in a Cyber Insurance Underwriting Checklist.

Party in Transaction	Typical Wire Fraud Exposure	Common Underwriting Focus
Title company / escrow agent	High, handles most wire instructions	Email security, verification process, staff training
Real estate brokerage	Moderate, fewer transactions in flight	MFA on email, agent training
Buyer's attorney (where used)	Moderate to high	Client communication protocols
Individual buyer	High personal loss exposure	Limited insurer control, relies on counterparty controls

What controls actually reduce the chance of a successful attack?

Verbal confirmation of any wire instructions, using a phone number obtained independently rather than one listed in the email, stops the overwhelming majority of these schemes.

Multi-Factor Authentication: The New Baseline for Cyber Insurance closes the entry point criminals use most often to compromise the email accounts in the first place. Firms that pair MFA on every email account handling closing communications with a strict verbal-verification policy for any change in wiring instructions see a meaningfully lower rate of successful fraud, and underwriters increasingly ask about both during the application process.

How should a real estate firm think about the right coverage limit?

The right limit should reflect the largest single transaction the firm regularly handles, not an average deal size.

A firm that closes mostly $300,000 homes but occasionally handles a $2 million luxury sale needs a social engineering sublimit that can absorb that outlier transaction, not just the typical one. Underwriters and brokers both tend to recommend sizing this specific sublimit around the largest realistic wire amount rather than letting it default to whatever number a generic cyber policy template includes.

Wire fraud during closing has become one of the most financially damaging and preventable losses in real estate, and the firms that treat it as a distinct, named risk rather than an afterthought inside a broader cyber policy tend to be the ones that either avoid the loss entirely or recover from it without it becoming an existential problem for the business.

Sources

• Business Email Compromise: The $50 Billion Scam, FBI Internet Crime Complaint Center (IC3)
• Turn On MFA, Cybersecurity and Infrastructure Security Agency