Home/Industries/Real Estate & Escrow
Escrow Offices · Title · Brokerages
One wire is the whole risk.
Everything else is secondary.
Escrow offices hold large sums for short, predictable periods and correspond constantly with parties outside their own domain. That combination makes them one of the most consistently targeted business categories in the country. We currently support three escrow offices in Orange County.
Why Escrow
The math an attacker is doing.
Understanding why escrow specifically gets targeted explains why generic IT advice does not protect it.
Large sums, short windows, known dates
An attacker does not need to maintain access for months or find something to sell. They need one transfer, and the closing calendar tells them exactly when to act. Few other businesses hand an intruder a schedule.
A conversation that spans six organizations
Buyer, seller, two agents, a lender, and title all correspond on the same transaction from different domains. Nobody finds an unfamiliar address suspicious, which is precisely what makes a lookalike domain work.
Instructions legitimately do change
Wiring details get corrected in real transactions. Staff cannot treat every amendment as an attack, so the defense has to be a procedure rather than suspicion.
Small teams, no IT staff
Most independent escrow offices run between five and thirty people with no dedicated technology staff. The obligations do not scale down with headcount, and attackers assume the controls are weaker. Usually they are right.
The Attack
How the funds actually leave.
This sequence is consistent enough to plan against. Note that the compromise usually happens weeks before anyone loses anything.
Week one
A mailbox is opened, not broken into
Usually a convincing sign-in page rather than malware. Increasingly the target is an agent or a lender rather than the escrow office itself — the attacker only needs a seat inside the conversation.
Weeks two to six
A forwarding rule, and silence
Mail is quietly copied to an outside address. Nothing breaks, so nothing is investigated. The attacker learns your file numbers, your closing calendar, your officers' names, and how your office writes.
One to two days before closing
Amended instructions, in the real thread
Sent from a domain differing by a single character, inside genuine correspondence, at the moment an amendment is entirely expected. Often timed to a Friday afternoon.
Same day
The funds move
Recovery depends almost entirely on how quickly the receiving bank is contacted. After roughly seventy-two hours the money is usually gone through layered accounts.
The Controls
Five points where the chain breaks.
Any one of these stops the sequence above. We deploy all five, because each covers a different failure.
- ✓ Multi-factor on every mailbox, no exceptions. The exception is always the officer with the most authority, which is the one the attacker wants.
- ✓ Email authentication configured properly. SPF, DKIM, and DMARC set so mail from a lookalike domain fails rather than lands.
- ✓ Alerting on mailbox forwarding rules. The single most reliable indicator that a mailbox is already compromised, and the one most offices never watch.
- ✓ Links checked at click, not at delivery. Harmony Email inspects a URL at the moment someone clicks it, which catches links sent clean and weaponized days later.
- ✓ A written verification procedure. Any change to payment instructions triggers a callback to a number already on file — never the number in the email. Written down, so it survives a busy Friday and a new hire.
And if a mailbox does fall
Our security operations center can disable the account, revoke active sessions, and remove malicious inbox rules without waiting for business hours or for anyone to call us.
Regulatory
Retention, trust records,
and examination.
Escrow sits under two different regulators in California depending on how the office is licensed, and both examine records.
DFPI-licensed independent escrows
Licensed under the California Escrow Law and examined by the Department of Financial Protection and Innovation, whose authority extends to trust account records, reconciliation practice, and internal controls. Escrow records are held to a five-year retention requirement.
DRE broker-controlled escrows
Operated incidental to a real estate brokerage and overseen by the Department of Real Estate, with a three-year retention requirement. Most offices retain to five years so a single practice satisfies either regulator.
Retention that outlasts the requirement
Our backup keeps encrypted copies of Microsoft 365 for seven years, which covers both retention periods with margin. It also means an email thread from a closing four years ago is retrievable when a claim surfaces long after the file closed.
Evidence for an examination
When an examiner asks who had access to what, or whether records were retained and protected, we export it from live systems rather than reconstructing it. Access reviews, retention configuration, and restore logs already exist because the work is scheduled.
One thing worth saying plainly
We are not your compliance counsel, and we do not advise on Escrow Law itself. What we do is make sure the technology side of an examination is not where you have a problem — records retained and retrievable, access controlled and evidenced, trust-account systems protected.
Reference
Three escrow offices,
and counting.
We currently support three escrow offices across Orange County, with most new introductions arriving by referral from existing clients and their agent networks.
Common Questions
What escrow offices ask.
Will new email security slow down our mail?
No, and this is why we run an API-based product rather than a mail gateway. A gateway sits in front of your mail flow and queues messages for inspection, which is where the delay people complain about comes from. Ours inspects mail after it has been delivered to the mailbox, so messages land immediately. Genuinely dangerous mail is pulled back rather than held up front.
Our officers are on the phone constantly. Is multi-factor going to slow closings?
Configured properly, it prompts on unusual sign-ins rather than every login on a known device. The friction is real but small, and it is the single control most likely to prevent a six-figure loss. We do not grant exceptions for senior staff, because that is exactly who gets targeted.
What if the compromise is at the agent's office, not ours?
That is increasingly the case, and it is why the verification procedure matters more than any technical control. If an agent's mailbox is compromised, no configuration on your tenant will stop the email arriving. What stops the loss is a staff member calling a number already on file before moving funds.
Can you work with our escrow production software?
Yes. We support the platform you already run, including access provisioning, integration with Microsoft 365, and escalation to the vendor when an issue is on their side rather than pushing it back to your staff.
We are a five-person office. Is that too small for you?
No. Pricing is per user, so a five-person office pays for five people. The obligations and the threat do not scale down with headcount, and small offices are targeted precisely because attackers assume the controls are weaker.
Do you also handle our cameras and door access?
Yes, under our own contractor license rather than a referral. For escrow offices this usually matters at the file room and the front counter, and access control can be tied to onboarding so a departing employee loses building access on the same day as their accounts.
Most businesses don't fail because
they're attacked. They fail because they can't recover.
A free technology assessment shows you exactly where you stand — predictable costs, one accountable partner, resilience built in. No obligation, no sales pitch.
Already managing IT in-house? Ask about co-managed support →