# Security for Real Estate
Real estate security is the discipline of protecting the parties, systems, and transaction data involved in property transactions, property management, and building operations from a threat environment defined by one fundamental vulnerability: the convergence of large financial transfers, email-centric communication workflows, and an industry culture that has historically treated cybersecurity as someone else's problem.
The numbers make the exposure concrete. The median U.S. home sale price in 2023 exceeded $400,000. Commercial transactions routinely exceed $10 million. These amounts move by wire transfer, initiated based on closing instructions sent over email, between parties (buyer, seller, escrow officer, title company, lender, and sometimes a second lender) who may have never interacted before the transaction and who have no pre-established secure communication channel. The FBI's 2023 Internet Crime Report logged $446 million in losses from real estate wire fraud alone, a figure that reflects only reported incidents. The actual loss figure is materially higher.
The real estate sector encompasses four distinct operational environments, each with its own threat surface: transactional real estate (residential and commercial sales handled by agents, brokers, escrow, and title), property management (tenant PII, maintenance systems, and vendor access), commercial real estate operations (building automation systems, tenant networks, and physical access control), and real estate technology platforms (MLS systems, listing portals, and proptech SaaS). Each environment faces overlapping but distinct risks.
Within CDA's Planetary Defense Model, real estate security engages all six domains, though with unusual concentration in the identity and trust layer (IAT). Because wire fraud does not require compromising a server or bypassing a firewall, it requires compromising a belief: the buyer's belief that the wire instruction came from a legitimate source. No amount of endpoint patching addresses that attack. Defense requires a civilizational-layer control: verified identity for financial instruction issuance, supported by terrain-level (SPH) awareness of who sent what from where.
---
Wire fraud in real estate is a variant of Business Email Compromise (BEC) with an unusually high per-incident loss. The attack follows a consistent pattern. An attacker gains access to the email account of one party in a pending transaction, typically a real estate agent, title company employee, or escrow officer, through phishing or credential stuffing. The attacker observes the transaction for days or weeks, learning the timeline, the parties involved, and the expected wire amounts. Shortly before closing, the attacker sends a message (appearing to come from the title company or escrow officer) to the buyer with updated wire instructions directing the funds to an attacker-controlled account. The buyer wires the funds. By the time the fraud is discovered, the money has been further transferred or converted and is nearly impossible to recover.
The FBI's Internet Crime Complaint Center (IC3) designated real estate wire fraud as a top BEC category in 2023, with $446 million in reported adjusted losses. Average loss per incident has exceeded $70,000. The attack requires no malware, no zero-days, and no sophisticated infrastructure. It requires a compromised email account and a buyer who does not verify wire instructions through a pre-established, out-of-band channel.
This is not a theoretical risk. The National Association of Realtors (NAR) documented 13,638 real estate-related cybercrime victims in 2022. Multiple prominent cases involve buyers who lost their entire down payment, in some instances over $1 million, with no recovery.
Multiple Listing Service (MLS) systems represent high-value ransomware targets because they underpin transaction activity across entire regional markets. A successful ransomware attack against a regional MLS does not just affect one brokerage; it disrupts every transaction in the service area. The 2023 attack on the Houston Association of Realtors' MLS system, and the broader 2023 cyberattack on the Florida Association of Realtors, demonstrated the cascading operational impact when MLS infrastructure goes offline during peak transaction periods.
Property management systems hold tenant PII (SSNs on rental applications, employment verification, bank account numbers for rent payment), maintenance request histories, and access control records. Ransomware against property management firms creates dual exposure: operational disruption and regulatory liability for the tenant data that may be exfiltrated before encryption.
Commercial real estate has created a new attack surface category: building automation systems (BAS). HVAC controllers, elevator management systems, smart lighting, physical access control panels, and energy management platforms are now network-connected, often running legacy firmware with known vulnerabilities, and occasionally connected to tenant networks without adequate segmentation. The Target breach (2013) established the canonical case for HVAC vendor access enabling broader network compromise. In commercial real estate, the equivalent scenario is an HVAC contractor with remote access to a building management system that shares network segments with a law firm or financial services tenant.
The proliferation of smart building technologies in new construction has expanded this surface substantially. Smart locks, video intercoms, occupancy sensors, and parking management systems each add a network-connected endpoint with its own credential set, update cadence, and potential for exploitation.
Rental applications collect some of the most sensitive personal data outside of healthcare and financial services: full SSNs, income documentation, employment history, prior addresses, and sometimes criminal background report contents. Property management companies holding this data face exposure under state privacy laws (CCPA in California, equivalent statutes in Virginia, Colorado, Connecticut, and others) and FTC enforcement authority for deceptive data security practices. A mid-sized property management company managing 5,000 rental units holds PII on potentially 15,000 current and former tenants, creating a data liability that is rarely matched by the company's security investment.
Commercial real estate operations depend on a vendor ecosystem: cleaning services, security contractors, HVAC technicians, elevator maintenance companies, and landscaping firms. Many of these vendors hold physical access credentials (key fobs, PIN codes) and occasionally have network access for building management system support. This vendor population is large, has high turnover, and is almost never subject to the same vetting process as direct employees. A terminated cleaning contractor whose access card was never deactivated represents an ongoing physical security exposure. A building management system vendor with stale remote access credentials represents an ongoing network security exposure.
---
Email as the default transaction medium. Real estate transactions are conducted almost entirely by email, and the industry has not converged on a secure-by-default communication standard. Unlike healthcare (which has HIPAA-driven secure messaging requirements) or financial services (which has FINRA-regulated communication archiving), real estate has no federal mandate for secure transaction communication. Industry guidance from NAR recommends verification practices, but guidance is not enforcement.
Transaction velocity and closing pressure. Wire fraud attacks are timed to closing day precisely because closing is the highest-pressure moment in a transaction. Buyers and their agents are under time pressure to complete the wire; they are less likely to pause and verify instructions when a transaction is hours from completion. Attackers understand this dynamic and exploit it deliberately.
MLS fragmentation and integration sprawl. The U.S. has over 500 active MLS systems, integrated with listing portals (Zillow, Realtor.com), broker back-office platforms (Lone Wolf, Dotloop), transaction management systems (DocuSign, SkySlope), and CRM platforms. Each integration is a potential attack surface, and the MLS ecosystem lacks standardized security requirements for third-party integrations.
Small operator predominance. The majority of real estate brokerages are small businesses, often with two to twenty agents, no dedicated IT staff, and no security budget. These firms hold transaction data and client PII but lack the resources to implement controls that larger organizations take for granted.
---
DPS (Data Protection and Sovereignty): The Geological Core
The core data assets in real estate are: transaction records and wire instructions (which become targets the moment an attacker identifies a pending closing), tenant PII including SSNs and income documentation, and building access credential databases. CDA's Sovereign Data Protocol (SDP) applied to real estate requires that wire instructions never exist solely in email. Formal wire instruction change policies, documented in writing at the start of each transaction, establish an out-of-band verification requirement before any wire instruction change is honored. Tenant PII requires classification under applicable state privacy frameworks and retention limits that match the operational need, not indefinite storage in poorly secured property management databases.
VSD (Vulnerability and Surface Defense): The Oceans
The real estate attack surface includes MLS system interfaces, property management SaaS platforms, building automation and BAS endpoints, smart building IoT devices, and the email infrastructure of every party in every transaction. CDA's Continuous Surface Reduction (CSR) methodology for real estate begins with an enumeration exercise that most firms have never conducted: what systems, APIs, and network-connected devices are part of the operating environment? For commercial real estate operators, this inventory routinely surfaces BAS endpoints running unpatched firmware and IoT devices on flat networks with no segmentation from tenant or corporate systems.
SPH (Security Posture and Hygiene): The Terrain
Real estate offices run on consumer-grade infrastructure: shared workstations, personal Gmail accounts for professional communication, and cloud storage platforms (Dropbox, Google Drive) without enterprise security policies. CDA's Autonomous Posture Command (APC) for real estate establishes a minimum terrain baseline: MFA on all accounts that touch transaction data or wire instructions, email security controls (DMARC, DKIM, SPF) to prevent spoofing of company domains, and endpoint protection on all devices used for transaction work. For property management firms, APC adds a baseline for property management system access and tenant PII handling.
IAT (Identity Access and Trust): Civilization
IAT is the critical domain for real estate security, and specifically for wire fraud prevention. CDA's Zero Possession Architecture (ZPA) applied to the real estate transaction context means: no wire instruction is honored based solely on an email message. Every wire instruction, and every change to a wire instruction, requires verification through a phone number pre-established at the start of the transaction (not a number provided in the email containing the instruction change). ZPA for real estate also requires role-based access controls in property management systems so that a leasing agent cannot see the full SSN of an applicant who applied to a different property.
TID (Threat Intelligence and Defense): The Atmosphere
Detection for real estate wire fraud requires monitoring for the precursor indicators: login activity from unusual locations or devices on agent email accounts, inbox rules that forward or delete messages (a common attacker tactic to prevent victims from seeing legitimate closing communications), and access to transaction folders from new devices shortly before closing dates. CDA's Predictive Defense Intelligence (PDI) methodology for real estate focuses on these behavioral signals. No adversary successfully executes a wire fraud attack without leaving a behavioral trace in the email account access logs. Most real estate firms never look at those logs.
RGA (Risk Governance and Assurance): Outer Space
Real estate faces regulatory exposure on several vectors: state privacy laws for tenant PII (with notification obligations in the event of breach), FTC enforcement under Section 5 for deceptive data security practices affecting consumers, state licensing board requirements for real estate professionals that are beginning to include cybersecurity training, and contractual requirements from title insurance underwriters who are increasingly making coverage contingent on documented wire verification procedures. CDA's Perpetual Compliance Assurance (PCA) for real estate maps these requirements to the PDM domains and identifies the minimum control set that satisfies all applicable obligations simultaneously.
---
CDA's Foundational Risk Map (FRM) for real estate focuses on four assessment priorities in the first 30 days:
1. Wire Fraud Exposure Assessment. Document current wire instruction communication practices. Is there a documented policy requiring out-of-band verification of wire instructions? Are wire instruction change requests verified by callback to a pre-established number? Are agents and transaction coordinators trained to recognize the pattern of an in-progress wire fraud attack? The output is a gap analysis against the NAR wire fraud prevention framework and a recommended policy set for immediate implementation.
2. Email Security Configuration Audit. Review SPF, DKIM, and DMARC configuration for all company-owned email domains. Identify personal email accounts (Gmail, Yahoo) used for business transaction communication and document the associated risk. Review login audit logs for the most recent 90 days for signs of unauthorized access or suspicious forwarding rules.
3. Property Management System PII Inventory. For property management operations, identify all systems storing tenant PII. Confirm that access controls limit data visibility to roles with a business need. Identify records with SSNs or financial account data that are beyond their retention period and create a documented disposal plan.
4. Building Automation System Network Segmentation Review. For commercial real estate operators with BAS infrastructure, confirm that building automation systems are on isolated network segments with no direct connectivity to tenant networks or corporate administrative systems. Document all remote access credentials for BAS vendors and confirm that credential access is limited to active vendor relationships.
The Shield visualization from a Real Estate FRM consistently shows amber or red segments in IAT (inadequate wire verification procedures) and DPS (insufficient tenant PII controls), with secondary gaps in SPH (consumer-grade infrastructure with no enterprise security baseline).
---
---
---
FBI. Internet Crime Report 2023. Federal Bureau of Investigation, 2024. https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
National Association of Realtors. Cybersecurity Guidance for Real Estate Professionals. NAR, 2023. https://www.nar.realtor/technology/cybersecurity
Consumer Financial Protection Bureau. Wire Fraud and Real Estate Closing Scams. CFPB, 2022. https://www.consumerfinance.gov/
NIST. Special Publication 800-53 Rev 5: Security and Privacy Controls for Information Systems and Organizations. NIST, 2020. https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
CDA, LLC. Foundational Risk Map (FRM): Real Estate Variant. Internal Reference.