Real Estate Office IT Checklist: Wire Fraud and Records

A real estate office’s IT has three jobs that matter more than the rest: keep criminals out of the email accounts they use to redirect closing funds, control logins on devices the brokerage usually does not own, and keep transaction records retrievable for the three years California law requires. Nearly everything else is ordinary small-office IT. This checklist covers the tools involved, the rules, the specific risks, and what to ask an IT provider.

The tools a real estate office runs

Tool	Examples	IT question to settle
MLS access	California Regional MLS (CRMLS), which covers Orange County and reports more than 93,000 users	Does each agent sign in as themselves, with no shared logins?
Forms and transaction management	Lone Wolf Transactions (zipForm Edition), which C.A.R. provides to members, plus SkySlope, dotloop and similar	Who is the broker-level administrator, and how do you export files?
E-signature	DocuSign and the signing tools built into transaction platforms	Are completed documents saved to the brokerage file, or left in an agent’s personal account?
CRM and marketing	Many, often chosen by each agent	Whose data is it when the agent leaves?
Email and documents	Microsoft 365 or Google Workspace	Is every mailbox on the brokerage domain, with multi-factor authentication?
Devices	Agent-owned phones and laptops, office computers, a printer and scanner	What is the minimum standard for a device that opens client files?

How wire fraud actually reaches a transaction

The pattern is called business email compromise (BEC). A criminal gains access to a mailbox belonging to an agent, a transaction coordinator, or an escrow contact, or registers a look-alike address. They read along quietly until a closing approaches, then send the buyer “updated” wiring instructions that look right in every detail. The money goes to an account the criminal controls and is moved again within hours.

The FBI’s 2025 Internet Crime Report recorded 24,768 BEC complaints with about $3.05 billion in reported losses across all industries, and 12,368 complaints in its separate real estate category with about $275 million in reported losses.

The California Department of Real Estate’s consumer alert on wire fraud in real estate transactions advises the parties to collect phone numbers at the start of the transaction, to never act on changed wiring instructions received by email, to verify any change by phone using the number obtained at the start, and to avoid sending financial details by ordinary email. The Consumer Financial Protection Bureau gives buyers similar advice on closing scams.

What IT can and cannot do about it

IT controls make it much harder to take over or imitate your mailboxes:

1. Multi-factor authentication (MFA) on every mailbox. MFA asks for a second proof of identity beyond the password. Prefer an authenticator app or passkey over SMS codes. The MFA guide explains the options.
2. Email on the brokerage domain, not personal Gmail or Yahoo accounts. You cannot enforce MFA, review sign-ins, or recover an account you do not administer.
3. SPF, DKIM, and DMARC records on your domain. These DNS settings help receiving mail systems reject messages that fake your address.
4. Alerts and reviews for mailbox rules. A common sign of a hijacked mailbox is a new rule that forwards mail outside the company or hides messages containing words like “wire.”
5. A password manager, so MLS, transaction platform, and email passwords are unique. See the password manager guide.

What IT cannot do is stop a buyer from trusting a fake email sent from someone else’s compromised account. That takes a process: tell every client in writing at the start that wiring instructions will not change by email, put a short wire fraud notice in your email signature, and send anything sensitive through the transaction platform or encrypted email. The business email compromise guide covers the scam in more detail.

What does California require brokers to keep, and for how long?

Business and Professions Code section 10148 requires a licensed broker to retain for three years copies of all listings, deposit receipts, canceled checks, trust records, and other documents executed or obtained by the broker in connection with transactions that need a license. The three years run from the closing date, or from the listing date if the transaction does not close. The records must be available to the Department of Real Estate for inspection and copying. The section also says it does not require keeping electronic messages of an ephemeral nature, as described in Civil Code section 1624(d).

Your broker, attorney, or errors and omissions insurer may set a longer period. This is IT guidance, not legal advice.

What that means for your systems:

• The brokerage needs its own copy. If the only complete file sits in an agent’s personal transaction account or laptop, it leaves when the agent does. Use broker-level accounts, or export closed files to brokerage storage.
• Know your platform’s export. Find out how to download a complete closed file, and what happens to stored files if you cancel the subscription.
• Set retention deliberately in Microsoft 365 or Google Workspace. A departing agent’s mailbox and files are deleted after the license is removed unless you preserve them first. The email archiving guide explains the choices.
• Back it up. Cloud storage keeps files in sync, which includes syncing deletions. A separate backup is what lets you produce a file from two and a half years ago.

Agent-owned devices: setting a minimum standard

Many agents are independent contractors who buy their own phones and laptops. You cannot manage those devices the way you would an employee’s, but you can set conditions for opening brokerage data on them:

• A screen lock and an operating system that still receives security updates. Windows 10 support ended on October 14, 2025, so a Windows 10 laptop now fails this test unless it is enrolled in extended updates. See the Windows 10 guide.
• Device encryption turned on.
• Work email and files kept inside managed apps, so the brokerage can remove its data without touching personal content.
• A written acknowledgment, part of the agent’s onboarding paperwork, that brokerage data will be removed at separation.

The BYOD policy guide has a fuller template. On the way out, remove the agent from email, the transaction platform, shared drives, and any office door or alarm codes on the same day, and notify the MLS as your association requires.

Does California privacy law apply to a brokerage?

Two layers. The California Consumer Privacy Act (CCPA) applies to for-profit businesses that meet a threshold. According to the California Privacy Protection Agency, those are gross annual revenue of $26.625 million or more, buying, selling, or sharing the personal information of 100,000 or more California residents or households, or earning half or more of revenue from selling or sharing personal information. Many small offices fall under those lines. The CCPA guide explains how to check.

The second layer applies regardless of size. Civil Code section 1798.81.5 requires a business that owns, licenses, or maintains personal information about a California resident to maintain reasonable security procedures. Transaction files contain exactly the data that section lists: names with Social Security numbers, driver’s license numbers, and account numbers.

The risks specific to real estate offices

• Mailbox takeover leading to redirected closing funds.
• Shared or reused passwords for MLS and transaction platforms.
• Client documents scattered across personal email, phone photo rolls, and home printers.
• Departed agents who still have access.
• Open houses and coffee shops: public Wi-Fi and unattended laptops.

Checklist you can copy

1. Every agent and staff member has a mailbox on the brokerage domain with MFA turned on.
2. SPF, DKIM, and DMARC are published for the domain.
3. Mailbox forwarding to outside addresses is blocked or reviewed.
4. Clients receive a written wire fraud notice at the start of every transaction.
5. Any change to wiring details is verified by phone using a number collected at the start.
6. Sensitive documents travel through the transaction platform or encrypted email.
7. No shared logins for the MLS or transaction platforms. Passwords live in a password manager.
8. The brokerage holds a complete copy of every closed file for at least three years.
9. Brokerage email and files are backed up separately from the cloud service that hosts them.
10. Agent-owned devices meet a written minimum standard before they open client files.
11. A same-day departure checklist exists and is used.
12. Office Wi-Fi has a separate guest network, and the printer and scanner are not on it.

Questions to ask any IT provider

• How will you protect our mailboxes from takeover, and how would we find out if one were compromised?
• How do you handle devices owned by independent contractor agents?
• How will closed transaction files be retained and retrieved for three years or longer?
• What is backed up, how far back can you restore, and when was a restore last tested?
• What happens on the day an agent leaves?
• Who holds administrator access to our domain, email, and platforms, and is that documented for us?

When you do not need much

A solo broker working from home mostly needs MFA on email, a password manager, an encrypted laptop, a backup, and the wire fraud notice. The structure described here earns its cost once there are several agents, a transaction coordinator, or a shared office.

Common questions

Who is responsible when a client wires money to a criminal?

That is a legal question that depends on the facts, so ask your attorney and your errors and omissions carrier. From the IT side, the useful preparation is evidence: sign-in records showing your mailboxes were protected by MFA, and a copy of the written wire fraud notice the client received at the start of the transaction.

Can agents keep using personal Gmail accounts?

It is a business decision, but it carries costs. The brokerage cannot enforce MFA, cannot see whether the account was accessed by someone else, and cannot retain transaction correspondence when the agent leaves. A mailbox on the brokerage domain solves all three and looks more credible to clients.

How long do we have to keep transaction files?

Business and Professions Code section 10148 sets three years from the closing date, or from the listing date if the transaction did not close. Your broker’s policy, insurer, or attorney may require longer. Store the files where the brokerage, not only the agent, can retrieve them.

Is an email disclaimer enough to stop wire fraud?

No. A notice in your signature helps set expectations, but the working defenses are MFA on every mailbox, domain authentication records, and a firm habit of verifying any wiring change by phone using a number collected at the start of the transaction.

How Coastal Growth Co. can help

We can secure brokerage email, set up retention and backup for transaction records, and write a workable device standard for agents. Work is on site or remote, as a one-time project or ongoing support, and scope and price are agreed before any paid work. The real estate IT page summarizes the service and cloud, email and AI covers the email work. Start on the contact page.