Wire Fraud, Title Companies, and the GLBA Rule You Didn't Know Applied (2026)

The most expensive cyberattack in real estate isn't a dramatic breach — it's a quietly altered wire instruction at the closing table. In 2025 the FBI's Internet Crime Complaint Center recorded $275,110,419 in reported real-estate fraud losses across 12,368 complaints (FBI IC3 2025 Annual Report). And there's a second surprise underneath it: most title and settlement firms don't realize the FTC Safeguards Rule already treats them as financial institutions, with the same security obligations as a bank.

If you run a title company, an escrow operation, or a brokerage that touches closing funds, this guide is for you: the exposure, the controls that actually stop it, and the regulation you may not know you're under.

Why real estate is the favorite target

The math is simple for an attacker. A real-estate transaction moves a very large sum on a known date, through a process that involves several parties emailing each other. The attacker doesn't need malware that encrypts your files. They need to sit in a mailbox, watch a deal progress, and send a believable email changing where the money goes.

This is business email compromise (BEC), and it's the dominant loss pattern in the vertical. The attacker rarely breaks anything — they wait for a closing and change the wire instructions. By the time anyone notices, the funds have been moved through accounts and are gone.

The regulation most settlement firms miss

Here's what catches title and escrow firms off guard: under the Gramm-Leach-Bliley Act, a "financial institution" is defined broadly and non-exclusively. The FTC's guidance notes the Rule covers 13 named kinds of businesses and that even that list is not exhaustive (FTC Safeguards Rule: What Your Business Needs to Know) — and 16 CFR 314.2(h) explicitly names "an entity that provides real estate settlement services" as a covered financial institution (eCFR).

Practically, that means a title or settlement firm carries the same obligations as an accounting firm or an auto dealer: a written information security program, a designated person to run it, a risk assessment, and named technical controls including MFA and encryption. Most firms in this space have never been told this. It's not a reason to panic — it's a reason to build the program now, because the controls it requires are the same ones that stop the wire fraud.

A breach-notification duty rides along too: covered firms must notify the FTC within 30 days of discovering a breach affecting at least 500 consumers (FTC).

The controls that actually stop wire fraud

Cyber insurers have converged on a short list for this exact risk, and they require it with no dollar floor — meaning it applies to every transaction, not just the big ones:

• Out-of-band verification on every payment and every bank-detail change. Before money moves, confirm the instructions by calling a phone number you already know to be the counterparty's — never the number printed in the email. This one habit defeats the majority of BEC wire diversions.
• Multi-factor authentication on every mailbox. Most BEC starts with a compromised email account. MFA is the cheapest control that closes the most common door.
• Identity threat detection on the mailbox. Attackers create hidden inbox rules to reroute and hide the emails they're manipulating. Managed identity threat detection on Microsoft 365 or Google Workspace catches the adversary-in-the-middle kits that bypass MFA and the inbox rules that quietly reroute closing emails.
• Dual authorization above a threshold, documented as part of the process.
• Finance-staff phishing simulation tuned to payment-redirect and closing-impersonation scenarios — not generic annual videos.

None of these are exotic. They're process and configuration, and they're the difference between a near-miss and a six-figure loss.

What to do next

The fastest path is to treat the wire-fraud controls and the Safeguards program as one project, because they overlap almost entirely. That's how Obsidian Ridge runs it for title, escrow, and brokerage firms — see the Real Estate, Title & Escrow security page for how the funds-transfer controls and managed detection line up against both the carrier's questions and the GLBA requirements.

If you'd rather start by finding the gaps, the Cyber Insurance Readiness Sprint maps your current state against the funds-transfer and Safeguards controls in a fixed-scope, seven-business-day engagement, and produces the documented process and evidence package underwriters want.

The bottom line

Closing-wire fraud is the most expensive cyber risk in real estate, the FTC Safeguards Rule likely already applies to your firm, and — usefully — the controls that satisfy the regulation are the same ones that stop the fraud. Verify every wire out-of-band, lock down the mailboxes, and document the program once for both the carrier and the regulator.

Had a near-miss on a redirected wire and want it to stay a near-miss? Book a wire-fraud and readiness assessment.