A client gets an email that looks like it's from your office: "Our banking details have changed, please send the deposit to this account." The money is gone within hours. This is business email compromise, and real estate closings and law firm trust transactions are prime targets.
How it happens
Attackers either break into a real mailbox, often through a phishing link or a reused password, or register a look-alike domain such as yourflrm.ca instead of yourfirm.ca. They watch the conversation, wait for a deal to close, then send convincing payment instructions at exactly the right moment.
Five steps that stop it
- Tell clients up front that you will never change payment details by email, and put it in your email signature.
- Verify by phone using a number you already have on file, never one from the email asking for payment.
- Turn on multi-factor authentication for every mailbox, so a stolen password isn't enough.
- Set up SPF, DKIM and DMARC on your domain, so attackers can't send email that appears to come from you.
- Watch for forwarding rules. Attackers often add hidden rules that copy or hide emails; your IT provider can alert on these.
If it happens
Call your bank immediately and ask them to recall the transfer; speed matters. Then report it to police and the Canadian Anti-Fraud Centre, and have the mailbox investigated.
We set up these protections for brokerages and firms every week. See our real estate page or book a consultation.