Email Account Security During a Home Sale: Phishing, Passwords, MFA, Attachments, and Wire Instructions

A real estate email phishing seller attack usually starts with something dull: a message that looks like it came from your agent, your title company or your own bank, asking you to open a file, confirm a detail or send a document, and by the time anything feels wrong the attacker has been reading your inbox for days.

Selling a home puts an unusual amount of money, paperwork and urgency into one email account. For a few weeks you may be exchanging offers, signed addenda, payoff letters, identity documents and closing instructions with half a dozen people you only just met. Criminals know this, and they know that a seller who is busy, excited and a little anxious will move quickly when a message says a deadline is close. That combination is what makes real estate email phishing seller fraud so reliable for the people running it.

This guide is about the mailbox itself, the place where any real estate email phishing seller scheme begins: how it gets taken over, what a thief can learn from it, which settings and habits make takeover harder, and what to do in the first hours if you suspect something has gone wrong. Wire instructions get special attention because that is where the largest losses happen, but the same habits protect everything else you send during the sale.

We keep to general education. Fraud patterns change, banks and settlement companies run their own procedures, and the rules that govern a sale vary by state and by contract. Our broader hub on home sale fraud and seller safety sets the wider frame, and this article zooms in on email. If anything below conflicts with instructions from your settlement agent, bank or attorney, follow them and ask questions through a channel you trust.

How a real estate email phishing seller attack actually unfolds

Most people picture phishing as a clumsy message full of typos from a stranger. Those still exist, but the version that hurts sellers is quieter and more patient. This section looks at what a successful real estate email phishing seller attack looks like from the seller’s side, and then at what the attacker actually gets from a mailbox that has been opened up.

What the bad outcome looks like when a seller’s inbox is compromised

The worst real estate email phishing seller outcomes share one feature: the victim does not know for a while. There is no pop-up and no alarm. A criminal who has your password, or who has tricked you into approving a sign-in, can sit in the account, read your threads and wait for the moment when money is about to move. That patience is what turns a stolen password into a stolen closing check.

There are three common bad outcomes of a real estate email phishing seller attack. The first is money redirected: a message that appears to come from the settlement office tells you, or tells the settlement office on your behalf, that proceeds should go to a different account. The second is identity theft, where the documents in your inbox are enough to open accounts or impersonate you. The third is a quieter one, a hijacked conversation that scares off a buyer or derails a closing.

Evidence to gather: the small oddities that show up first

Compromised mailboxes rarely announce themselves, but a real estate email phishing seller intrusion still leaves marks. Look for sent messages you do not remember writing, replies that arrive before you have sent anything, messages that vanish from your inbox, and conversation threads that seem to have been moved to a folder you never made. Check your login history if your provider offers one. Unfamiliar locations, devices or times are worth writing down with screenshots.

Now look at the people around you. If your agent, buyer’s agent or settlement officer says they never sent a message that you received, take that seriously, and ask them to forward the original rather than describing it. Compare sender addresses character by character, because a lookalike domain can swap a single letter or add a word. Save the full message headers if you can, since a technical reviewer may need them later.

Keep a short running log with dates, times and what you saw. Honest uncertainty is fine here when you are documenting a possible real estate email phishing seller incident. You do not need to prove an attack before you raise a concern, and a note that says “seemed odd, could not explain” is far more useful to a bank or investigator than a memory reconstructed a week later.

A scenario, an exception, and your next step: the proceeds that went somewhere else

Here is an illustrative real estate email phishing seller case, with invented details. A seller named Dana is two days from closing. She gets a polite note, apparently from the settlement office, saying that the wire details she sent earlier have a typo and asking her to resend them on the attached form. She fills in the form and sends it back. What she did not know is that the attacker had already read her thread and sent the form to look like the real one.

The exception matters, though. Some settlement offices do ask sellers to submit payout details, and they have a specific method for doing so, often a secure portal, an in-person signing step or a verified phone confirmation. So the existence of a request is not itself proof of fraud. What gives it away is the channel and the pressure. Dana’s right next step is to stop, call the office using a number she already trusted, and ask how they collect payout information.

If she had already sent the form, the next step changes from “verify” to “report.” She would call her bank and the settlement office right away, and we cover that path in detail later. Neither of those calls guarantees a particular result, but delay is the one thing that reliably makes recovery harder.

What information and property sit exposed in a seller’s email account

People tend to underestimate what their inbox holds, and that blind spot is what a real estate email phishing seller criminal counts on. They think of it as a place for messages, but over a home sale it becomes an archive: contracts, signed disclosures, ID photos, mortgage statements, tax bills and the names and phone numbers of everyone involved. Taken together, those items give a criminal both the means to impersonate you and a ready-made map of who to impersonate to.

Property is exposed too, in a less obvious way. Messages about lockbox codes, vacancy, showing schedules and move-out dates tell an attacker when a house is empty. That is one reason our guides on vacant home security during a sale and on the broader home seller privacy checklist treat email habits as part of physical safety.

Evidence to gather: a quick inventory of what your inbox holds

Spend twenty minutes doing a search-based inventory so you know your real estate email phishing seller exposure. Search your own mailbox for words like “wire,” “account number,” “routing,” “closing,” “payoff,” “passport,” “license,” “social,” “deed” and “lockbox.” The point is not to read everything. It is to see how many threads contain material that you would not want a stranger to have, and how far back those threads go.

Write down three lists. The first is documents that carry identity details, such as a scan of a license or a loan statement with a full account number. The second is messages that carry payment details, like old wire instructions or payoff figures. The third is threads that reveal schedules or access, including showing times and entry codes. You do not need to share the lists with anyone. They simply tell you where to focus cleanup and how worried to be if something goes wrong.

While you are there, check what else your email account unlocks. Many online services use email for password resets, so the same inbox can open your bank portal, your mortgage servicer, your utilities and your cloud storage. That chain is why a mailbox takeover can spread well beyond the sale itself.

A scenario, an exception, and your next step: the old email nobody thought about

Another invented example of real estate email phishing seller exposure. A seller, Marcus, has been using the same email address since college. It is attached to a retail account, a streaming service and a long-closed forum where he reused his password. He never uses that forum, but a criminal who obtains the old password from a breach can try it against his main mailbox, and reused passwords are the most common way that works.

The exception is that not every old account is a real risk. If the address is protected by a unique password and app-based multi-factor sign-in, an old breach is far less dangerous. That is why the order of operations matters: secure the inbox first, then clean up the places it is used.

Marcus’s next step is concrete. He changes the mailbox password to a long unique one, turns on stronger multi-factor sign-in, reviews the forwarding and filter settings for anything unfamiliar, and then works through his financial accounts to make sure each one has its own password. It is tedious, but it is a one-afternoon job and it removes the easiest door.

Reducing real estate email phishing seller risk before the transaction step

The best time to reduce real estate email phishing seller risk, by locking down an email account, is before the first offer arrives, because the weeks after acceptance are busy and every change feels like a distraction. The steps below are not exotic. Most of them take minutes, and together they remove the routes attackers use most often.

Think of the work in two halves. The first half is technical: passwords, sign-in methods, forwarding rules and how you open attachments. The second half is behavioral: what you decide, in advance, never to send and never to assume. Technical settings fail if the habits around them are loose, and habits fail if the account itself is easy to enter.

The verification and security controls worth setting up first

You do not need a security degree to get most of the benefit against a real estate email phishing seller attempt. Four controls do the heavy lifting: a strong unique password, multi-factor sign-in that does not rely on text messages if you can avoid it, a review of hidden mailbox rules, and a careful way of handling links and attachments. Each one closes a different door, which is why they work better as a set.

The table below puts the common threats next to the check you can run, the safe response, what you must keep to yourself and who to call if the threat turns out to be real. Use it as a real estate email phishing seller reference during the sale rather than something to memorize.

To use the matrix, find the row that matches the message in front of you and work left to right. If you cannot complete the “evidence to check” step, treat that as a result in itself and move to the safe action. The last column is not a punishment for being wrong. It simply tells you who can actually do something about the problem.

Evidence to gather: what to check in your account settings

Start with the password. A long passphrase made of several unrelated words is easier to remember than a short jumble of symbols and is harder for a computer to guess, and a password manager can generate and store a different one for every account. The rule that matters most is uniqueness. If the email password is reused anywhere else, the account is only as safe as the weakest place it appears.

Next, open the security settings and look at multi-factor sign-in. Text-message codes are better than nothing, but they can be intercepted through a technique called SIM swapping, where a criminal convinces a phone carrier to move your number. Authenticator apps and physical security keys are generally stronger, and many providers now support passkeys. Choose the strongest option your account offers and keep the backup codes somewhere that is not your email.

Finally, inspect the places attackers hide. Look at forwarding settings, mailbox filters, connected apps and the list of signed-in devices. Delete anything you do not recognize, sign out of all sessions and then sign back in on your own devices. Write down the date you did this so that any later surprise has a clear before and after.

A scenario, an exception, and your next step: the shared family email

Suppose a couple, Priya and Tom, sell a home using one shared email address that three relatives also know the password to. It is convenient, and it also means that the account is only as secure as the least careful person who uses it. If one relative’s laptop picks up malware, the sale is exposed to a real estate email phishing seller attack.

The exception is that sharing is sometimes unavoidable, for example when a family is handling an estate or an elderly parent needs help. In that case the safer setup is separate accounts for each person with a clearly designated primary contact, rather than one login handed around. Our guide to estate home sale closings covers how multiple decision makers coordinate on paperwork.

Their next step is to create a dedicated email address used only for the sale, protected by a unique password and strong multi-factor sign-in, and to tell everyone in the transaction about the change through a phone call. They then watch for any message that still goes to the old address and treat it with extra suspicion.

Habits for attachments, links and the busy week before closing

Attachments deserve their own habits because they are the most common delivery vehicle for malicious software and fake sign-in pages. A signed contract does not need a password-protected zip file. A closing document does not need you to enable macros. When a message pushes you to unlock something extra, you are probably being steered toward a trap.

A good real estate email phishing seller habit is to separate receiving from acting. You can open and read a message, but you should not log in, download or reply with sensitive information until you have verified it through another channel. That one pause removes the speed that attackers rely on.

Evidence to gather: how to inspect a link or file before it can hurt you

On a computer, hover over any link before clicking and read the full address. The part that matters is the domain just before the first single slash, not the words that appear earlier. On a phone, press and hold the link to preview the address. If the destination is a login page that you did not ask for, close it and open the real service by typing the address yourself or using a bookmark.

For files, check the extension and the context. A document that arrives as a program file, a compressed archive with a password in the message or a file that asks you to enable editing or content is a warning sign. Ask the sender, by phone or in a separate message, whether they sent it and what it should contain. If the sender cannot confirm it, delete it.

Keep your devices updated, because many attacks rely on old software with known flaws. Automatic updates on your phone, computer and browser remove an entire class of risk with no effort from you, and a reputable security tool can add another layer of checking for downloads.

A scenario, an exception, and your next step: the document that wants you to sign in again

A final real estate email phishing seller example: picture a seller, Omar, who receives a message that says a document is waiting for his signature. The link opens a page that looks like a familiar signing service and asks him to enter his email password to view it. He enters it, nothing happens, and he assumes the link was broken. The page was a copy, and the password is now in someone else’s hands.

The exception is that legitimate signing platforms do send real notification emails. The difference is that the real ones do not ask you to type your email password into a page that opened from a link. If you expect a document, go to the platform directly or ask your agent how the signing process will work before the documents are sent.

Omar’s next step is to change his email password immediately from a trusted device, turn on multi-factor sign-in, check the mailbox for new rules, and tell the real sender what happened so they can warn others in the transaction. Quick honesty protects everyone else on the thread.

Information you never share and assumptions you never make

The second half of the defense is a short list of things you decide in advance not to do. Deciding ahead of time matters because pressure does strange things to judgment. A calm rule, set a week earlier, is much easier to follow than a good decision made while a message insists that the closing will fail unless you reply within the hour.

The list of items never to share in any real estate email phishing seller situation is short. Passwords, one-time codes, recovery answers, full bank login details and any request to read back a code from a text are off limits for everyone. Account numbers and identity documents are different: they sometimes have to be shared with a real settlement agent, but never through an ordinary email conversation that you started from a message you did not verify.

Evidence to gather: what a legitimate request actually looks like

Real requests share a few traits that a real estate email phishing seller impostor rarely copies well. They come from a person or office you already know, they refer to details that only the real parties would know, and they offer a method of delivery that is not just “reply to this email.” If you are unsure what your settlement office uses, ask them early, ideally at the start of the sale, and write down the answer along with the name of the person who gave it.

It helps to ask three simple questions at the start: how will you send me anything that contains money instructions, how will you want my payout details and how will I know a message is really from you? A good office will have clear answers. The Federal Trade Commission’s consumer site also publishes plain-language guidance on spotting impersonation, which makes a useful second opinion for family members who help with the sale.

Watch for assumptions that feel natural but are not safe. “It came from my agent’s name, so it is my agent.” “It is the same thread as before, so it must be real.” “The logo looks right.” Logos, names and even entire threads can be copied or hijacked. What cannot be copied easily is a live conversation with a person whose contact details you collected independently.

A scenario, an exception, and your next step: the helpful stranger who needs a code

Here is a real estate email phishing seller variation. Imagine a seller, Lena, who receives a text with a six-digit code she did not request, followed minutes later by a call from someone claiming to be the email provider’s security team. The caller says there has been suspicious activity and asks her to read the code aloud to confirm her identity. In reality the caller has just tried to sign in to her mailbox, and the code is the missing piece.

There is no real exception to this one. A legitimate provider does not call you and ask for a code that it just sent. The code is the lock. Lena’s next step is to hang up, avoid calling back any number the caller gave her, sign in to her account directly, change the password and review her security settings.

If the caller already received the code, Lena should assume the account may be compromised, change the password immediately, sign out all devices and begin the review we describe in the response section. Our article on seller identity fraud at closing explains why a stolen mailbox can turn into a stolen identity if no one checks.

Responding to a real estate email phishing seller scare without escalating the damage

Even careful people get fooled by a real estate email phishing seller message, and even well-protected accounts sometimes fail. What separates a bad week from a financial disaster is usually the first few hours. The aim of a good response is to stop further harm, reach the people who can act, and preserve the evidence, all without making hurried moves that add new problems.

Panic produces predictable errors: replying to the scammer to argue, deleting the suspicious messages, or calling a phone number printed in the very email you doubt. This section lays out a calmer sequence for real estate email phishing seller incidents. It starts with how to confirm that a message is genuine, then moves to who to contact when it is not.

Known-contact-channel verification for any real estate email phishing seller message

The core idea is simple and it works against almost every real estate email phishing seller trick: never verify a message using the message. If an email gives you a phone number, a link or a “reply here to confirm” instruction, those are all controlled by whoever wrote it. Instead, use a contact method that you collected earlier from an independent source.

Independent sources include the number on the purchase contract, a business card from your first meeting, the settlement company’s website that you typed in yourself, or a number your agent gave you in person. If you cannot find one, call the main office line and ask to be connected to the person handling your file. A few minutes of effort here is the cheapest insurance in the whole sale.

Evidence to gather: building a trusted contact sheet on day one

At the start of the sale, create a one-page contact sheet and keep it somewhere other than your email, such as a paper folder or a notes app protected by its own passcode. For each person involved, record their full name, role, company, office phone number, mobile number and the date and method you used to collect it. A note like “from the signed contract” or “handed to me at the listing appointment” is enough.

Add one more line for the settlement office: the specific method they use for sending and receiving money details. Some use a secure portal, some use encrypted email, some prefer a phone call with a callback to a number on file. Whatever the answer is, write it down, along with the date and the name of the person who told you. When a message later disagrees with the sheet, the sheet wins.

Share the sheet, or at least the key numbers, with anyone helping you make decisions, such as a spouse, adult child or attorney. In several real estate email phishing seller cases the helper is the person who spots the problem because they are not caught up in the same rush.

A scenario, an exception, and your next step: the call that goes to the wrong person

Take an invented real estate email phishing seller case. A seller, Grace, receives a message that appears to be from her agent saying that the payout wire details changed because the title company switched banks. The email lists a phone number “for quick confirmation.” Grace calls it, a friendly voice confirms everything and she relaxes. Unfortunately, the phone number was written by the same person who wrote the email.

The exception is that sometimes a business really does change banks, phone systems or processes. That is exactly why the check has to use a number from before the message arrived. If the change is real, the settlement office will have no problem confirming it by phone and may add a written confirmation through its official portal.

Grace’s next step, had she paused, was to look at her contact sheet, call the number on the contract and ask about the change. Because she called the number in the email, she should now call her bank right away and explain that she may have given information to an impostor. We cover that call in the next section.

The table below turns this thinking into a set of common transaction situations. It lists the warning sign, the verification channel to use, how a seller should respond and the record worth keeping. It is deliberately practical, so you can match your own situation quickly.

When you use this table, pay attention to the last column. A seller who keeps the original message, the time of each call and the name of the person spoken to gives the bank, the settlement office and law enforcement something to work with. A seller who deletes everything in embarrassment makes their job much harder.

If you want to see how a legitimate payout moves through the system, our explainer on when a seller gets money after closing walks through the usual order of events, and the comparison in wire versus check for seller proceeds weighs the delivery options. Knowing the normal process makes odd requests stand out, which is the best real estate email phishing seller filter you own.

When the message is real: confirming without creating a new risk

Sometimes the verification call confirms that the message was genuine. That is a good outcome, but it deserves a careful finish. Make sure that the confirmation covers the specific detail you were asked to act on, such as which account, which amount and which delivery method, and not merely “yes, we sent something.”

Take notes during the call. Write the name of the person, the time, what they confirmed and any reference they gave you. If the details involve money, ask the person to repeat the ending digits of the account so you can compare them with what is written, and ask how the office will confirm the transfer after it lands.

Evidence to gather: matching the details across two independent sources

A strong confirmation of any real estate email phishing seller concern has two legs. The first leg is the live conversation with a trusted number. The second leg is a document that you received through a separate path, for example the closing disclosure, the signed contract or a portal message. When both agree on the amount and the destination, the risk drops sharply.

If the two legs disagree, stop and escalate to the person in charge of your file. A mismatch is a finding, not a nuisance. Our guide to the seller closing statement explains how to read the figures so that you can compare them against the instructions you were given. Ask your attorney or settlement officer to explain any line you do not understand.

Keep every confirming document in a folder that is separate from the email account in question. If the mailbox is later found to be compromised, you will still have clean copies that were not touched by the intruder.

A scenario, an exception, and your next step: a legitimate change that still needs care

Here is an invented example of a real change that looks like a real estate email phishing seller trick. A seller, Hector, has a payoff arranged through one bank, but his plans shift and he asks the settlement officer to send proceeds to a different account at another institution. This is a genuine request that starts with him, and it is the type of change where criminals sometimes pose as the seller to reroute funds.

The exception to the usual rule is that the seller is the source of the request, so the settlement office will want to verify it is really him. That might involve a call to a number on file, a signed form, a notary or an in-person visit. These steps feel like friction, but they are the same steps that protect him from someone pretending to be him.

Hector’s next step is to ask the office what they require, give them plenty of time and avoid sending account details through a regular email thread. If a delay is possible, he should plan for it rather than pressuring the office to skip steps, because pressure to skip checks is exactly what a fraudster would apply.

Escalating a real estate email phishing seller incident to the bank, settlement agent, law enforcement, insurer or attorney

If a verification call fails in a real estate email phishing seller situation, or if you realize you already acted on a fake message, the job changes from checking to reporting. Several parties may be able to help, and each can do something different. Your bank can try to recall or flag a transfer, the settlement agent can stop or adjust a pending disbursement, law enforcement can open a report, and an attorney can explain your rights.

The order depends on what has happened. If money has left your account or is about to, the bank comes first because time matters most there. If no money has moved but a mailbox is compromised, the email provider and the settlement agent come first. In nearly every case, you should tell the settlement agent promptly, because they may be about to send or receive funds that depend on information the thief has touched.

Evidence to gather: the packet that makes every call faster

Before you dial about a real estate email phishing seller problem, spend ten minutes assembling a packet. Include the suspicious messages with full headers if possible, screenshots of sent items you did not write, the dates and times of any transfers, the account details involved, and a short written timeline in your own words. Add the names of anyone you have already spoken to and what they said.

Keep the packet somewhere safe that does not depend on the affected mailbox. A printed copy or a file on a device that has not been compromised works well. If you need to send documents to an investigator, ask them for a secure method rather than forwarding them through the same account an intruder may be watching.

Do not delete the fraudulent messages, even if they are embarrassing. They hold clues, including the sender address, the timing and sometimes technical details that an investigator can trace. If you have already deleted them, check the trash or spam folders and tell the investigator what you removed and when. For reporting, the FBI’s Internet Crime Complaint Center accepts reports of email-related wire fraud, and the FTC’s consumer site explains how to file a report about identity theft or impersonation scams.

A scenario, an exception, and your next step: money already sent

This invented real estate email phishing seller case is the hardest one. A seller, Nina, wired a small amount to cover a supposed last-minute fee after a message that appeared to come from the settlement office. An hour later her real agent calls and says the office never asked for that. Nina’s stomach drops, and her first instinct is to keep the problem private until she can figure out what to do.

The right move is the opposite. She should call her bank’s fraud line immediately, explain that she sent a wire that she now believes was fraudulent, and ask what the bank can do to recall or flag it. She should then call the settlement office, report the incident to the appropriate authorities and send everything she has to her bank. Speed does not guarantee a recovery, but delay can remove the possibility.

The exception is that recovery depends on factors no one can promise, such as whether the receiving account still holds the money and how quickly the banks cooperate. Nina should not rely on any person who claims they can recover funds for a fee, because follow-up scams that target victims are common. Our guide to real estate wire fraud for sellers covers the wire-specific steps in more depth.

Working with the right professionals after a real estate email phishing seller problem

Once the first calls about a real estate email phishing seller incident are made, a second layer of work begins. You may need to secure other accounts, place fraud alerts or freezes with credit bureaus, review your homeowner or other insurance policies and, in some cases, speak with an attorney. None of these steps needs to happen on the first day, but a short plan keeps you from forgetting them.

Different professionals hold different pieces. The bank handles the money trail, the settlement agent handles the closing and any funds still in escrow, law enforcement documents the crime, an insurer may or may not cover certain losses depending on the policy, and an attorney can advise on legal exposure and next steps. Our fraud and seller safety library has more on each role.

For the paperwork around a title or deed that may have been affected, see our guide to title and deed fraud for homeowners. If an identity was used, the earlier article on seller identity fraud explains what to monitor.

Evidence to gather: what to ask each professional and what to bring

For a real estate email phishing seller report to the bank, bring the transfer details, the dates and the written timeline, and ask what recall, hold or fraud investigation options exist and what documents they need. Ask for a reference number and the name of the person you spoke with, because you will probably need to call again.

For the settlement agent, bring the suspicious messages and a clear list of what you sent. Ask whether any pending disbursement should be paused, how they will verify future instructions, and whether their own systems may have been affected. Ask them to confirm in writing how they will communicate with you from now on, using only channels you have verified.

For an attorney, bring the packet and a list of questions. Policies and statutes differ by state, and an attorney can explain how local rules treat liability and timelines. For an insurer, read your policy first, then ask whether any coverage applies and what notice deadlines exist. Do not assume coverage, and do not assume there is none. Ask, and write down the answer.

If you are unsure where to start, the Consumer Financial Protection Bureau publishes general guidance on mortgage closing scams that can help you frame your questions.

A scenario, an exception, and your next step: a compromised mailbox with no money lost

One last invented real estate email phishing seller case, and a hopeful one. A seller, Sam, notices that a filter has been moving messages from his agent into a hidden folder. No money has moved, and the closing is a week away. He is tempted to quietly change his password and carry on.

The exception is that even without a loss, the incident matters, because the intruder has read the thread and may already be planning a move. Sam’s next step is to secure the account, remove the filter, sign out all devices and then call his agent and the settlement office to describe what he found. He should ask them to treat every message from his old address in the last few weeks as unverified.

He should also review the sale timeline with the office and agree on a verified method for any money instruction. Because he spoke up early, the people around him can adjust, and the intruder loses the advantage of surprise. Reporting a near miss costs very little, and it can prevent a full loss for someone else.