Is your email closing-safe? A 10-point checklist

By Ed Dupuy, Sealbridge Security · Updated October 20, 2026

The 10 questions

1. Multi-factor sign-in is on for every email account, including the owner's, assistants' and shared inboxes.

   Why it matters: A stolen password alone is the most common way into a mailbox. Multi-factor sign-in stops most of those attempts.

   How to check: In Microsoft 365 or Google Workspace, check the multi-factor status of every account, not just the ones people use daily.

2. Someone checked every mailbox for forwarding and inbox rules in the last 30 days.

   Why it matters: Attackers add rules that copy closing emails to themselves or hide replies. The rule keeps working after the password is changed.

   How to check: See how to find hidden forwarding rules in Microsoft 365.

3. Buyers and sellers are told in writing, at the start, that wiring instructions will never change by email.

   Why it matters: A buyer who knows what normal looks like is far more likely to call before wiring.

   How to check: Check your opening package and engagement letters for the notice.

4. Staff confirm wiring instructions by calling a number they looked up themselves, never one from the email.

   Why it matters: A scammer controls every phone number in a fake email.

   How to check: See the 7-step verification procedure.

5. Your email domain has a DMARC record set to quarantine or reject, so others can't send as you.

   Why it matters: Without it, anyone can send email that shows your exact address in the From line.

   How to check: Run the free spoofing check on your domain.

6. You would be alerted if someone registered a lookalike of your domain (for example, yourbrokerage-title.com).

   Why it matters: Lookalike domains are how scammers send convincing fake instructions without breaking into anything.

   How to check: The free spoofing check lists registered lookalikes of your domain.

7. Former employees' and agents' email accounts are shut off on their last day.

   Why it matters: Old accounts are rarely watched, so a takeover can go unnoticed for months.

   How to check: Compare your list of active email accounts with your current staff and agents.

8. Everyone who handles closings has had phishing or wire-fraud training in the last 12 months.

   Why it matters: Most attacks start with one convincing email to one busy person.

   How to check: Check training dates for closers, processors and front-desk staff.

9. Your team knows to call the bank's fraud line within minutes if money goes to the wrong account.

   Why it matters: Funds are much easier to freeze in the first hours than after a day or two.

   How to check: Post the bank fraud line and the steps from the guide where closers can see them.

10. You have insurance that covers funds-transfer fraud (social engineering), and you know the limit.

    Why it matters: Many errors-and-omissions policies exclude stolen wires, and social-engineering limits are often far below a typical closing.

    How to check: Ask your agent for your social-engineering or funds-transfer-fraud limit in writing.

What your score means

Checks	Rating	Next step
9–10	Closing-safe	Keep it up. Recheck every quarter.
6–8	Gaps attackers look for	One missing control is all it takes. Fix the unchecked items, starting with 1, 2 and 4.
0–5	High risk	Fix this before your next closing.

U.S. real estate fraud losses rose 58% in 2025, to $275 million. (FBI IC3 2025 report)

This guide is general information for title and real estate offices, not legal advice. Follow your underwriter's and lender's requirements where they differ.