Walk into almost any real estate office and you'll find one inbox that never sleeps. It might be called transactions@, closings@, or info@. A transaction coordinator, an office manager, and sometimes several agents all log in to it. Contracts, disclosures, inspection reports, lender updates, and title documents flow through it all day.
That shared inbox is the operational heart of the brokerage. It's also one of the most attractive targets for criminals, because it sees every deal, every deadline, and every dollar amount.
Here are the warning signs that a shared mailbox may be at risk, and what to do about each one.
Warning Sign 1: Everyone Knows the Password
Shared inboxes are often accessed with a single password that's been passed around for years. Former agents, past assistants, and temporary staff may still know it.
What to do: Most business email platforms let you set up a shared mailbox that staff open through their own individual accounts. Each person signs in with their own credentials and multifactor authentication. When someone leaves, you remove their access without changing anything for everyone else.
Warning Sign 2: No Second Login Step
If the shared inbox can be opened with only a password, a single phishing email could hand an attacker the keys to every active transaction.
What to do: Require multifactor authentication for every account that can reach the shared mailbox. This one step blocks the large majority of password-based break-ins.
Warning Sign 3: Mysterious Missing Emails
When attackers break into a mailbox, they often create hidden rules. These rules might forward copies of messages to an outside address, or automatically move emails containing words like "wire" or "closing" into a folder nobody checks.
What to do: If staff notice replies that never arrived or emails that seem to vanish, check the mailbox rules right away. Better yet, have alerts set up so new forwarding rules are flagged automatically.
Warning Sign 4: Sign-Ins From Unexpected Places
A shared inbox used by a Northern Utah office probably shouldn't be signing in from another country at 2 a.m.
What to do: Turn on sign-in alerts and review unusual activity. Many platforms can also block sign-ins from regions where your team doesn't work.
Warning Sign 5: Out-of-Office Messages That Overshare
Auto-replies that say "I'm out until Monday; contact our closing team at..." give criminals useful timing and names for impersonation. We cover this in detail in why your vacation auto-reply might be a hacker's favorite email.
What to do: Keep auto-replies short and generic. Avoid listing direct phone numbers, deal details, or travel plans.
Warning Sign 6: Personal Devices With Full Access
Agents often check the shared inbox on personal phones and home computers. If those devices are lost, shared, or infected, the inbox goes with them.
What to do: Require a screen lock on any phone that accesses brokerage email. Consider tools that let you remove company email from a lost device without erasing personal photos and apps.
Warning Sign 7: Nobody Owns Security for the Inbox
When everyone uses a mailbox, it's easy for no one to feel responsible for it.
What to do: Assign an owner, often the office manager or managing broker, who reviews access quarterly, confirms security settings, and is the go-to contact if something looks wrong.
Why This Matters for Wire Fraud
Many real estate wire fraud schemes begin with a compromised mailbox. Once inside, criminals study deals and wait for the perfect moment to send fake wiring instructions. Securing the shared inbox is one of the most effective ways to protect clients' closing funds.
A Quick Shared Inbox Checklist
- Shared mailbox accessed through individual accounts, not one shared password.
- Multifactor authentication on every user with access.
- Alerts for new forwarding rules and unusual sign-ins.
- Generic out-of-office messages.
- Screen locks required on mobile devices.
- An assigned owner who reviews access every quarter.
Small Changes, Big Protection
None of these steps requires a major technology overhaul. Most can be done within the email platform your brokerage already uses. Our cloud services team helps offices configure Microsoft 365 and similar platforms correctly, and our cybersecurity services add monitoring for suspicious activity.
Have a question about your office's shared mailbox? Get In Touch.
