Email security for mortgage brokers: protect borrower files and closing funds

A mortgage broker's inbox holds everything a fraudster wants: borrowers' tax returns, pay stubs, bank statements and Social Security numbers, plus a seat in the conversation where closing funds are arranged. This guide covers the email attacks that target brokers and loan officers, what the FTC Safeguards Rule means for your mailboxes, and a checklist your shop can work through this week.

It complements two other guides. For the full rule, read the FTC Safeguards Rule and email security. For the buyer's side of closing fraud, read real estate wire fraud and fake closing instructions.

Why are mortgage brokers targeted by email attacks?

Mortgage brokers are targeted because one loan officer's mailbox can expose dozens of complete borrower files and the timing of every upcoming closing. A criminal who signs in as a loan officer can steal identities, send convincing messages to borrowers who trust that address, and learn when large wires will move.

The FBI's June 2023 public service announcement says business email compromise (BEC) "targets all participants in real estate transactions." Business email compromise is fraud where a criminal impersonates or takes over a trusted email account to redirect money. The same announcement reported a 27% increase in victim reports of BEC with a real estate nexus from 2020 to 2022 and a 72% increase in losses. Across all industries, the FBI's 2025 IC3 Annual Report recorded 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025.

Brokers also sit between many parties: borrowers, lenders, appraisers, title and escrow offices, real estate agents and credit vendors. Each party is a sender your staff expects to hear from, which makes impersonation easy.

What email threats do mortgage brokers and loan officers face?

Mortgage brokers face six main email threats. The table shows what arrives and what stops it.

Mailbox takeover and stolen borrower files

The most damaging attack is the quiet one. A loan officer clicks a fake "secure document" or "shared file" link, enters a password, and the criminal now reads every loan file in that mailbox. Attackers often add rules that forward mail containing words like "wire," "closing" or "statement" to an outside address and hide replies. Our guides to file-sharing notification phishing, malicious inbox rules and signs an email account is compromised show how to spot it. Some kits capture the MFA session too; see adversary-in-the-middle phishing.

Fake NMLS and regulator emails at renewal time

Licensing deadlines make a reliable lure. The NMLS says it "provides a renewal window each year from November 1 to December 31" (NMLS Resource Center), so at the time of writing (November 2026) every loan officer expects renewal email. An NMLS advisory, last updated in 2017, says real NMLS notices "will never contain sensitive information, ask for your personal information, or include links to any site other than NMLS," and warns that phishing emails "often threaten to close your account if you do not respond." Here's an example of what to delete:

Example: "NMLS Renewal Notice: your MLO license will be deactivated on December 31 due to an incomplete attestation. Sign in within 48 hours to avoid suspension: nmls-renewal-center.example/login"

The advisory asks you to report suspected phishing to your own IT security team, or forward it to security@csbs.org with the word PHISHING at the start of the subject, then delete it. Whatever the email says, open NMLS by typing the address yourself.

Closing wire and payoff redirection

Borrowers often trust their loan officer more than anyone else in the deal, so criminals use the broker's name. The CFPB says scammers target real estate professionals to monitor their email and spot upcoming transactions, then send spoofed emails with false wiring instructions. On the business side, payoffs and vendor payments can be redirected with a fake statement. ALTA's Outgoing Wire Preparation Checklist, written for title offices, sets the standard: verify by calling "at a phone number obtained independently" and "never use the phone number included in an email."

Forged documents sent by email

Applicants can email altered bank statements, pay stubs or employer letters, sometimes from a lookalike employer domain. A PDF that looks perfect proves nothing. Verify income, employment and assets through the source, such as a phone number for the employer that you found yourself or your lender's approved verification service, rather than a contact named in the email.

Does the FTC Safeguards Rule apply to mortgage brokers' email?

Yes, in most cases. The FTC's Safeguards Rule guidance lists "mortgage lenders, payday lenders, finance companies, mortgage brokers" among the financial institutions the rule covers. The rule, 16 CFR Part 314, requires a written information security program, and several of its elements land directly on email:

Brokers with information on fewer than 5,000 consumers are exempt from some requirements, but not from MFA, encryption, training or breach notice. The FTC's own exemption language covers institutions that "maintain customer information concerning fewer than five thousand consumers," and our Safeguards Rule guide lists exactly which sections it removes.

This is general information, not legal advice. State licensing rules and your lenders' contracts can add requirements, so confirm your obligations with qualified counsel.

How should borrowers send documents to a mortgage broker?

Borrowers should upload documents through an encrypted portal or secure link that you control, not attach them to ordinary email. A portal keeps tax returns and statements out of mailboxes, where a single stolen password exposes them, and it gives you one place to delete files when the loan closes.

If you must accept email:

1. Use encrypted email for anything containing customer information. Both major platforms support it; see Microsoft Purview Message Encryption, Google Workspace S/MIME and confidential mode and our overview of email encryption types.
2. Check transport encryption. Mail between providers should use TLS; STARTTLS and MTA-STS explain what that protects and what it doesn't.
3. Move files out of the mailbox into your loan file system, then delete the email copy according to your retention policy.
4. Tell borrowers in writing at application how you'll ask for documents and that you'll never ask for passwords or bank logins by email.

How do you protect borrowers from closing-day wire fraud?

Tell every borrower, at application and again before closing, that you will never send or change wiring instructions by email, and that they must confirm instructions with the title or escrow office by phone on a number they found themselves. The CFPB's advice to buyers is to agree on trusted contacts early, avoid using phone numbers or links from emails, and "Never follow instructions contained in an email."

1. Add a wire fraud notice to your application package and email signature.
2. Give borrowers the title or escrow office's main number from its official website.
3. Call borrowers a few days before closing to remind them of the rule.
4. If a borrower reports a suspicious email, check your own mailbox for compromise at once; the leak may be yours.
5. If money has been sent, tell the borrower to call their bank for a wire recall and file at ic3.gov. Our BEC wire recovery guide covers what happens next.

How do you stop criminals impersonating your brokerage?

Publish SPF, DKIM and DMARC and move DMARC to enforcement, so mail faking your exact domain is rejected by borrowers' mail providers. Include every system that emails borrowers as you, such as your loan origination system, point-of-sale application portal, CRM and e-signature tool, or their notices will fail too. Our guide to authenticating third-party senders covers the setup. An enforcing record looks like this example:

_dmarc.example-mortgage.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-mortgage.com"

DMARC doesn't stop lookalike domains. Check which near-copies of your domain exist with the Lookalike Domain Generator, and see what to do when customers are phished by a fake version of your company.

Inbound protection matters as much as outbound. Microsoft 365 or Google Workspace configured properly is a reasonable baseline for a small shop. An MX-level filter, where your MX records point to a filtering service that checks mail before your platform delivers it, adds another layer and lets each loan officer release held mail from a quarantine digest. iBlockSpam prices per domain with unlimited mailboxes; see email security for real estate and mortgage teams.

What should a loan officer do after clicking a phishing link?

Act within minutes, because the mailbox holds borrower files.

1. Change the password from a different, trusted device and sign out all sessions.
2. Check MFA is on, and remove any MFA method you don't recognize.
3. Look for new inbox rules and forwarding and delete any you didn't create.
4. Tell your compliance contact or Qualified Individual so they can review sign-in logs and decide whether customer information was accessed.
5. Warn active borrowers by phone if there's any sign the attacker sent mail from your account.
6. Keep the evidence: the phishing email with full headers, sign-in logs and any rules found.

Our guide to what to do after clicking a phishing link covers each step in more detail.

Mortgage broker email security checklist

1. Turn on MFA for every mailbox, your loan origination system, NMLS and lender portals.
2. Collect borrower documents through an encrypted portal, not plain email.
3. Give each person their own login; no shared processing mailbox passwords.
4. Send a "we never change wiring instructions by email" notice at application and before closing.
5. Verify every payoff and vendor bank change by calling a number you already had.
6. Open NMLS, lender and credit vendor portals only from bookmarks or typed addresses, especially from November 1 to December 31.
7. Publish SPF, DKIM and DMARC, including your loan software and CRM senders.
8. Audit mailboxes each quarter for forwarding and inbox rules.
9. Train loan officers and processors on phishing, BEC and forged documents at least once a year.
10. Write down your incident contacts: IT, compliance, counsel, your bank and ic3.gov.

Next steps

• Run the free Email Health Check on your company domain.
• Add a wire fraud notice to your application package before your next file opens.
• Read the FTC Safeguards Rule and email security with whoever is your Qualified Individual, and share email security for title and escrow companies with your settlement partners.
• If you want inbound filtering that each loan officer can manage from a digest email, see email security for real estate and mortgage teams. Pricing is per domain, not per mailbox.

More threat guides are in our phishing and threats topic.