Title Company IT Checklist: Wire Fraud and ALTA Pillar 3

A title or escrow office needs IT that does three jobs: keeps criminals out of the email accounts that carry wiring instructions, meets the written security requirements in ALTA Best Practices Pillar 3 and the FTC Safeguards Rule, and keeps the closing software running on supported computers. The most valuable control is not a product at all. It is a rule that no wire goes out until the instructions are confirmed by phone, using a number that did not come from the email.

This guide covers the software title offices run, the rules that apply and what they mean technically, a checklist you can copy, and questions to ask any IT provider. It is IT guidance, not legal or compliance advice. Your underwriter, attorney, or compliance assessor decides what your office is obligated to do.

How big is the wire fraud problem?

The FBI’s Internet Crime Complaint Center (IC3) publishes the most reliable public numbers. In its 2025 annual report, released in 2026, business email compromise (BEC) was the second costliest crime type in the country:

IC3 figure	2025	2024
BEC complaints	24,768	21,442
BEC reported losses	$3,046,598,558	$2,770,151,146
Real estate fraud complaints	12,368	9,359
Real estate fraud reported losses	$275,110,419	$173,586,820

A note on reading that table: IC3 defines BEC as a scam aimed at businesses or individuals who regularly send wire transfers, carried out by compromising email accounts. A diverted closing wire is usually counted there. IC3’s separate “real estate” category covers investment, rental, and timeshare fraud. Both rows include only losses that were reported.

The same report describes a buyer who received a compromised email that appeared to come from the “title company” with wiring instructions for more than $1.3 million. That is the typical pattern: a criminal gets into one mailbox in the transaction (the agent’s, the lender’s, the buyer’s, or yours), reads the thread quietly, and sends altered instructions at exactly the moment everyone expects them. Our guide to business email compromise explains the mechanics in more detail.

What software does a title office actually run?

Most of the technology decisions in a title or escrow office follow from the production system, the software that manages orders, documents, and disbursements.

• SoftPro Select, installed in your office. SoftPro’s published system requirements list Windows 11 for workstations, Windows Server 2016 or later, and Microsoft SQL Server 2017, 2019, or 2022 for the database. Microsoft Word 2016, 2019, or 365 is needed to build custom ReadyDocs. Windows 10 does not appear on the supported list, which matters because Windows 10 support ended on October 14, 2025.
• SoftPro Hosted, where SoftPro runs the servers. The hosted requirements require at least 8 Mbps of bandwidth per user and the Okta Verify app on each user’s phone to connect, so internet capacity and phone enrollment become your main IT dependencies.
• Qualia, a cloud closing platform. Qualia also owns Resware (acquired with Adeptive Software in 2020) and RamQuest and E-Closing, acquired in January 2025. If your office runs one of those products, ask the vendor about its roadmap before planning a server purchase around it.

Around that core sit email (usually Microsoft 365 or Google Workspace), scanners, e-signature and remote online notarization tools, underwriter and lender portals, county recorder e-recording, and your bank’s wire portal. Each one is a login that needs an owner, multi-factor authentication, and a removal step when someone leaves.

Which rules apply, and what do they require technically?

ALTA Best Practices, Pillar 3

The American Land Title Association’s framework is voluntary, but lenders and underwriters may ask settlement agents to show they follow it. The current version is 4.2, published August 19, 2025. Pillar 3 reads: “Adopt and maintain a written information security plan (‘WISP’) and a written privacy plan to protect NPI as required by local, state, and federal law.” NPI means non-public personal information, such as Social Security numbers and bank account details.

Here is what Pillar 3 lists, translated into IT work:

Pillar 3 item	What it means in practice
Multi-factor authentication for systems containing NPI	A second sign-in step (an app prompt or security key) on email, the production system, file storage, and portals
Password management plan	Unique logins per person, no shared passwords, screen lock after idle time, a password manager
Timely software updates	Supported operating systems, with patches applied on a schedule and someone checking that they landed
Physical security	Locked server or network closet, controlled removable media, locked storage for paper files
Network and cloud security	A business firewall, separate guest Wi-Fi, controlled access to cloud and hosted systems
Written and tested business continuity and disaster recovery plan	Backups you have restored from, and a way to keep closings moving during an outage
Written and tested incident response plan	A plan that follows ALTA’s Cybersecurity Incident Response Plan template
Training program	Regular staff training on the WISP and current threats
Secure retention and disposal	Wiped or destroyed drives, shredded paper, retention periods written down
Service provider oversight	Vendors (including your IT provider) whose security practices are consistent with your WISP

Pillar 3 also requires background checks on anyone with access to your systems, including service provider employees. Expect to ask your IT provider about this, and expect a straight answer.

ALTA Best Practices, Pillar 2 (the wire rules)

The wire controls live in Pillar 2, not Pillar 3. Version 4.2 asks for a written wire transfer procedure tested at least annually, documented steps to “verify wire transfer instructions independent of the initial communication” that include multi-factor authentication, a procedure to warn consumers about wire fraud on incoming wires, and a written wire fraud response procedure that follows ALTA’s Rapid Response Plan and is reviewed at least annually.

FTC Safeguards Rule

The Safeguards Rule applies to non-bank financial institutions, and the regulation’s own examples include “an entity that provides real estate settlement services” (16 CFR 314.2(h)(2)(x)). The FTC’s guidance lists nine program elements, including a designated Qualified Individual, a written risk assessment, safeguards such as encryption and multi-factor authentication, staff training, service provider oversight, and a written incident response plan.

Businesses that maintain information on fewer than 5,000 consumers are exempt from some of the written requirements, but not from the rule. Since May 2024, a breach of unencrypted information affecting 500 or more consumers must be reported to the FTC within 30 days of discovery. Our FTC Safeguards Rule overview walks through each element.

California breach notification

California Civil Code 1798.82 requires notice to affected California residents after a breach of their personal information. SB 446, effective January 1, 2026, set a deadline of 30 calendar days from discovery, with limited exceptions for law enforcement needs and for determining the scope of the breach. If more than 500 California residents are notified, a sample notice goes to the Attorney General within 15 calendar days of notifying them.

Independent escrow companies are also licensed and examined by the California Department of Financial Protection and Innovation under the Escrow Law.

What are the specific risks?

• A compromised mailbox. Once someone is inside one mailbox, they can read every open file, create hidden forwarding rules, and send altered instructions from a real address. Microsoft states that multi-factor authentication blocks more than 99.2% of account compromise attacks.
• Spoofing of your domain. Without SPF, DKIM, and DMARC (three DNS records that let receiving mail servers confirm a message really came from your domain), anyone can send email that appears to be from your office.
• Lookalike domains. A domain one letter off from yours or from a lender’s. DMARC does not stop this. Trained staff and phone verification do.
• Ransomware. Software that encrypts your files and demands payment. For a title office the cost is measured in closings that cannot fund on time.
• Leftover access. Former employees, shared portal passwords, and old vendor accounts that still work.

A copyable IT checklist for title and escrow offices

Email and identity

1. Multi-factor authentication is enforced for every mailbox, with no exceptions for owners. See why multi-factor authentication matters.
2. Administrator accounts are separate from everyday mailboxes.
3. Automatic forwarding to outside addresses is blocked, and inbox rules are reviewed.
4. SPF and DKIM are in place, and DMARC is set to quarantine or reject after a monitoring period.
5. Messages from outside the company are tagged as external.
6. NPI is sent through encrypted email or a secure portal, never as a plain attachment.

Wire procedures (technology supports these, people carry them out)

7. A written outgoing wire procedure modeled on ALTA’s Outgoing Wire Preparation Checklist: confirm instructions by phoning the payee at a number obtained independently, never the one in the email, and record who you spoke with.
8. Two people on every wire: one creates it, a different person authorizes it.
9. Any change to wire instructions is treated as suspect until it is verified by phone.
10. Buyers receive a wire fraud warning at opening, and your instructions reach them only through a secure channel.
11. A validated list of payoff accounts for lenders you pay often.
12. The bank’s wire portal uses its strongest sign-in option, from a managed computer.

Computers, network, and files

13. Every PC runs a supported operating system and receives patches on a schedule.
14. Managed endpoint protection on every computer, with alerts that reach a person.
15. Full-disk encryption (BitLocker on Windows) on laptops and desktops.
16. Staff do not have local administrator rights.
17. A business firewall, guest Wi-Fi kept separate from office systems, and scanners and printers updated.
18. Backups follow the 3-2-1 pattern (three copies, two kinds of storage, one offsite) with one copy that cannot be altered, and a test restore is performed and logged.

People and paperwork

19. A WISP, an incident response plan, and a continuity plan that exist in writing and have been tested.
20. A same-day offboarding checklist covering email, the production system, underwriter and lender portals, the bank portal, and bank signatory lists.
21. Security awareness training at hire and at least annually, with phishing practice.
22. A vendor list showing who can reach NPI, including your IT provider.

What should you do in the first hour after a fraudulent wire?

Speed decides the outcome. In 2025 the IC3 Recovery Asset Team, which works with banks to freeze stolen funds through a process called the Financial Fraud Kill Chain, handled 3,900 incidents and froze $679 million of $1.16 billion in attempted theft, a 58% success rate. The FBI’s guidance in the same report is blunt: “time is of the essence.”

ALTA’s Rapid Response Plan for Wire Fraud Incidents (version 2.6, March 2026) sets out the order, and asks you to work the steps simultaneously:

1. Alert management and the people named in your response plan, including your underwriter.
2. Contact the sending bank’s fraud department. Request a recall of the wire and a hold harmless letter, and ask the bank to initiate the FBI’s Financial Fraud Kill Chain. Notify the receiving bank’s fraud department and ask that the account be frozen.
3. Inform every party to the transaction using known, trusted phone numbers.
4. File a complaint at ic3.gov with full transaction details and the email headers.
5. Report to local law enforcement and your FBI field office.
6. Contact the sending bank again to confirm the recall was processed.
7. Document every action, consider notifying your insurance carrier and outside counsel, and have IT reset passwords, check mailbox rules, and review sign-in logs.

Print the plan and fill in your bank’s fraud department number now. A response plan is only useful if it can be found in the first five minutes.

When you do not need much IT

A small escrow office on a cloud production system, with Microsoft 365 or Google Workspace configured well and a handful of managed laptops, does not need a server or a large ongoing contract. It needs the email controls, the wire procedure, device management, and the written plans, reviewed on a schedule. An office running SoftPro Select on its own server has more to maintain: Windows Server and SQL Server patching, database backups, and hardware replacement planning.

Questions to ask any IT provider

1. How will you enforce multi-factor authentication for everyone, and how do you handle exceptions?
2. Will you set up SPF, DKIM, and DMARC, and move DMARC to enforcement?
3. Have you read ALTA Best Practices Pillars 2 and 3, and which items will you own, which will we own, and which are shared?
4. What is backed up, how often, where is it stored, and when was the last test restore?
5. Who at your company can access our systems, are they background checked, and how is that access logged?
6. What happens on the day an employee leaves?
7. What will you do in the first hour of a suspected email compromise?
8. Can you provide documentation for our underwriter review or Best Practices assessment?
9. What is included in the agreed scope, and what is billed separately?

Common questions

Is ALTA Best Practices certification legally required? No. The framework is voluntary and published by an industry association. In practice, lenders and underwriters often ask settlement agents to demonstrate that they follow it, either through a self-assessment or a third-party assessment. The FTC Safeguards Rule and California’s breach notification law are separate, and those are legal requirements.

Does the FTC Safeguards Rule apply to a small escrow office? The regulation names real estate settlement services as an example of a covered financial institution. Offices that hold information on fewer than 5,000 consumers are exempt from some written requirements, such as the written risk assessment and incident response plan, but still need a security program. Confirm your status with your attorney.

Will DMARC stop wire fraud? It stops one method: email that forges your exact domain. It does not stop a lookalike domain, and it does not help if a real mailbox in the transaction has been taken over. That is why phone verification of every set of wire instructions remains the core control, with email security as the layer around it.

Can stolen wire funds be recovered? Sometimes, when the report is fast. The IC3 Recovery Asset Team froze funds in 58% of the dollar value it pursued in 2025, but the FBI stresses that time is critical. Contact your bank immediately, request a recall, and file at ic3.gov with full transaction details regardless of the amount.

How Coastal Growth Co. can help

Coastal Growth Co. provides IT support for small businesses across Orange County, on-site and remote, as one-time projects or ongoing support. For a title or escrow office, we can review email security and sign-in settings, set up DMARC, test your backups, build the offboarding checklist, and map your current setup against the Pillar 3 list above so you know where the gaps are. Scope and price are agreed before any paid work. See managed IT and IT for real estate offices, or get in touch to describe what you need.