# Email protection for real estate, title and escrow teams

URL: https://iblockspam.com/solutions/real-estate
Last updated: 2026-10-09

> Email filtering for real estate, title and escrow teams: cut phishing and spoofed wire instructions, add call-back checks and protect every mailbox per domain.

Closing funds attract criminals who watch inboxes and send fake wire instructions at the last minute. Filter phishing and spoofed senders before they reach agents and closers, and pair it with a call-back process email can't override.

Real estate, title and escrow businesses need email filtering that blocks phishing and spoofed senders before they reach agents and closers. They also need a fixed rule that wire instructions are confirmed by phone, never by email alone. iBlockSpam filters inbound mail at the MX level, in front of the platform you already use, and charges one price per domain.

## How closing wire fraud works

The pattern is consistent across FBI, CFPB and industry warnings. Criminals get into the email account of someone involved in a deal, often through phishing. They read along, learn the closing date and the amounts, and send a message that changes the payment instructions at the right moment.

The FBI's IC3 says this scheme targets every participant in a real estate transaction: buyers, sellers, real estate attorneys, title companies and agents. Once criminals control one participant's mailbox, they "monitor the real estate proceeding" and time a request to switch from check to wire, or to a different bank account. From 2020 to 2022, IC3 saw a 27% increase in reports of BEC with a real estate nexus and a 72% increase in losses ([IC3 PSA I-060923-PSA](https://www.ic3.gov/PSA/2023/PSA230609)).

Business email compromise as a whole led to $3,046,598,558 in reported losses across 24,768 complaints in 2025 ([IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). The report describes a buyer who received an email impersonating their attorneys and wired more than $449,000. IC3's Recovery Asset Team got the receiving bank to hold the funds, which is why speed matters.

The CFPB describes the buyer's side: days before closing, an email that seems to come from the agent announces "last-minute changes" to the wiring instructions ([CFPB: Beware of mortgage closing scams](https://files.consumerfinance.gov/f/documents/cfpb_mortgages-scams_one-pager.pdf)). Your office sees the business version of the same trick, a supplier's "new bank details"; see [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

### Lookalike domains

When criminals can't get into a real mailbox, they register a domain that looks like yours or your title partner's. They swap a letter, add a hyphen or change the ending. IC3 advises watching for links and addresses with misspelled domain names. Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) shows common patterns. Some lures hide the link in a QR code instead, in the message or an attachment; see [QR code phishing](https://iblockspam.com/blog/qr-code-phishing-quishing).

## What iBlockSpam does for your team

### Filtering in front of every mailbox

Your MX records point to our filtering servers. Mail is checked for spam, viruses, malware, phishing and spoofing, and clean mail goes on to Microsoft 365, Google Workspace, [Exchange Server](https://iblockspam.com/platforms/exchange-server) or your hosted server. IC3 describes these schemes starting with access to a participant's email account, so fewer credential-phishing messages in agents' inboxes means fewer chances to steal a password.

Advanced settings add attachment-type filters, a Microsoft Office macro filter, geographic filters and custom domain rules.

### Sender controls that resist spoofing

[Approved and blocked sender lists](https://iblockspam.com/features/allow-block-lists) can require sender verification. A spoofed message that claims to be from your approved title partner still gets checked instead of slipping through. You can add known lookalike domains to the blocked list.

### Quarantine that doesn't slow a closing

Every agent and closer gets a **personal quarantine** and a digest email hourly, daily, on a chosen weekday or on a custom schedule. Hourly digests suit closing weeks. An office manager can review the whole domain in the **shared quarantine**. See [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests).

### Records and monitoring

Search 30 days of message history to answer "did that email arrive?" Mail is held for up to 5 days if your mail server is down. Domain monitoring alerts you if your MX, SPF or DMARC records change, so an unexpected change to where your mail goes doesn't go unnoticed.

## A wire verification process to adopt

Industry and government guidance converges on the same steps. NAR advises confirming wire instructions with "a phone number independently obtained" and educating buyers about the scams ([NAR: Wire Fraud](https://www.nar.realtor/wire-fraud)). ALTA publishes an outgoing wire checklist and a rapid response plan for title and settlement teams ([ALTA: Wire Fraud](https://www.alta.org/topics/wire-fraud)).

1. **Warn clients at the first meeting** that your firm will never change wire instructions by email.
2. **Give clients two trusted contacts** and their phone numbers in writing, as the CFPB suggests.
3. **Call back on a known number** before sending or acting on any wire instructions. Never use a number from the message.
4. **Re-verify any change**, however small, with a second call.
5. **Keep wire instructions out of plain email.** Use a secure portal or transaction platform.
6. **Use multi-factor authentication** on every agent's email account.
7. **If a wire goes wrong**, call the bank to report a fraudulent transfer and ask for a recall, then file at [ic3.gov](https://www.ic3.gov) at once. The FTC gives the same first step ([FTC: What To Know Before You Wire Money](https://consumer.ftc.gov/articles/what-know-you-wire-money)).

Our [business email compromise guide](https://iblockspam.com/blog/business-email-compromise-prevention) covers the wider pattern.

## Brokerages, title companies and closing attorneys

Each party protects its own side of the deal. A brokerage can filter its agents' mail, a title or escrow company can filter its closers' mail, and a closing attorney's firm can filter its own. None of them can filter a buyer's personal Gmail account. That's why the call-back rule matters more than any single tool: it works even when the compromised mailbox belongs to someone else.

Setup is an MX change plus platform-specific steps, guided by our setup wizard with a before/after DNS comparison and rollback steps. Most domains are set up in one session. That's our aim, not a promise, because DNS and platform settings vary. Brokerages with several office domains pay per domain, and domain aliases are unlimited. Attorneys who handle closings can read our page for [law firms](https://iblockspam.com/solutions/law-firms).

## Priced per domain, not per agent

| | Protect | Protect Plus |
|---|---|---|
| Billed annually | $12 per domain/month ($144/year) | $19 per domain/month ($228/year) |
| Month-to-month | $15 per domain/month | $24 per domain/month |
| Mailboxes | Unlimited (count, not volume) | Unlimited (count, not volume) |
| Inbound messages included | 100,000 per domain/month | 100,000 per domain/month |
| Domain monitoring | Weekly | Daily |
| Human setup session | No | Yes |

Prices are beta pricing in USD, excluding tax. Adding agents doesn't change the price. Compare the models in [per-domain vs per-user pricing](https://iblockspam.com/compare/per-domain-vs-per-user-pricing).

## Honest limits

- No filter catches every fraudulent message. A fake instruction sent from a real, compromised mailbox can pass every technical check.
- A new lookalike domain with valid authentication can reach inboxes. Checking the full address and calling back are the defenses.
- iBlockSpam protects your domain's inbound mail. It can't protect a client's personal mailbox or your title partner's systems.
- iBlockSpam doesn't encrypt outgoing email and doesn't replace multi-factor authentication or staff training.

Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain, then [create your account](https://iblockspam.com/signup).

## Sources

- [FBI IC3: Business Email Compromise: The $50 Billion Scam (I-060923-PSA)](https://www.ic3.gov/PSA/2023/PSA230609)
- [FBI IC3: 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [CFPB: Buying a home? Beware of mortgage closing scams](https://files.consumerfinance.gov/f/documents/cfpb_mortgages-scams_one-pager.pdf)
- [NAR: Wire Fraud](https://www.nar.realtor/wire-fraud)
- [ALTA: Wire Fraud](https://www.alta.org/topics/wire-fraud)
- [FTC: What To Know Before You Wire Money](https://consumer.ftc.gov/articles/what-know-you-wire-money)

## Frequently asked questions

### Can email filtering stop closing wire fraud?

It helps, but it can't stop it alone. Filtering blocks much of the phishing that leads to hacked mailboxes, and it catches many spoofed messages. A fake instruction sent from a real, compromised account can still get through. A call-back to a known phone number before any wire is what stops the payment.

### Do you detect lookalike domains?

Spoofing and phishing protection catches many impersonation attempts, but a newly registered lookalike domain with valid authentication can look legitimate to any filter. You can block known lookalikes with a blocked sender list. Staff should still check the full address on any message about money.

### Our agents use their own devices. Does that matter?

Filtering happens before mail reaches any device, so phones and laptops get the same filtered mail. The FBI advises taking extra care to verify the sender's address on mobile devices. Ask agents to open payment-related messages on a computer and check the full address.

### We're a brokerage with many agents. How is it priced?

Per domain, with unlimited mailboxes. That means no limit on the number of agent mailboxes, not unlimited mail: each domain includes 100,000 inbound messages per month. Protect is $12 per domain per month billed annually (beta pricing). Larger groups managed by an IT partner can ask about partner terms, which are agreed individually.

### What should a buyer do if they already sent a wire?

Call their bank immediately and ask it to recall the wire, then file a complaint at ic3.gov. The CFPB says timing is critical, and NAR says filing within 24 hours, and no more than 72, gives the best chance of recovery. Your firm should also check its own mailboxes for signs of compromise.

---

Source: iBlockSpam, https://iblockspam.com/solutions/real-estate (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt