Walk into almost any real estate office and you'll find one inbox that never sleeps. It might be called transactions@, closings@, or info@. A transaction coordinator, an office manager, and sometimes several agents all log in to it. Contracts, disclosures, inspection reports, lender updates, and title documents flow through it all day.
That shared inbox is the operational heart of the brokerage. It's also one of the most attractive targets for criminals, because it sees every deal, every deadline, and every dollar amount.
Here are the warning signs that a shared mailbox may be at risk, and what to do about each one.
Warning Sign 1: Everyone Knows the Password
Shared inboxes are often accessed with a single password that's been passed around for years. Former agents, past assistants, and temporary staff may still know it.
What to do: Most business email platforms let you set up a shared mailbox that staff open through their own individual accounts. Each person signs in with their own credentials and multifactor authentication. When someone leaves, you remove their access without changing anything for everyone else.
Warning Sign 2: No Second Login Step
If the shared inbox can be opened with only a password, a single phishing email could hand an attacker the keys to every active transaction.
What to do: Require multifactor authentication for every account that can reach the shared mailbox. This one step blocks the large majority of password-based break-ins.
Warning Sign 3: Mysterious Missing Emails
When attackers break into a mailbox, they often create hidden rules. These rules might forward copies of messages to an outside address, or automatically move emails containing words like "wire" or "closing" into a folder nobody checks.
What to do: If staff notice replies that never arrived or emails that seem to vanish, check the mailbox rules right away. Better yet, have alerts set up so new forwarding rules are flagged automatically.
Warning Sign 4: Sign-Ins From Unexpected Places
A shared inbox used by a Northern Utah office probably shouldn't be signing in from another country at 2 a.m.
What to do: Turn on sign-in alerts and review unusual activity. Many platforms can also block sign-ins from regions where your team doesn't work.
Warning Sign 5: Out-of-Office Messages That Overshare
Auto-replies that say "I'm out until Monday; contact our closing team at..." give criminals useful timing and names for impersonation. We cover this in detail in why your vacation auto-reply might be a hacker's favorite email.
What to do: Keep auto-replies short and generic. Avoid listing direct phone numbers, deal details, or travel plans.
Warning Sign 6: Personal Devices With Full Access
Agents often check the shared inbox on personal phones and home computers. If those devices are lost, shared, or infected, the inbox goes with them.
What to do: Require a screen lock on any phone that accesses brokerage email. Consider tools that let you remove company email from a lost device without erasing personal photos and apps.
Warning Sign 7: Nobody Owns Security for the Inbox
When everyone uses a mailbox, it's easy for no one to feel responsible for it.
What to do: Assign an owner, often the office manager or managing broker, who reviews access quarterly, confirms security settings, and is the go-to contact if something looks wrong.
Why This Matters for Wire Fraud
Many real estate wire fraud schemes begin with a compromised mailbox. Once inside, criminals study deals and wait for the perfect moment to send fake wiring instructions. Securing the shared inbox is one of the most effective ways to protect clients' closing funds.
A Quick Shared Inbox Checklist
- Shared mailbox accessed through individual accounts, not one shared password.
- Multifactor authentication on every user with access.
- Alerts for new forwarding rules and unusual sign-ins.
- Generic out-of-office messages.
- Screen locks required on mobile devices.
- An assigned owner who reviews access every quarter.
Small Changes, Big Protection
None of these steps requires a major technology overhaul. Most can be done within the email platform your brokerage already uses. Our cloud services team helps offices configure Microsoft 365 and similar platforms correctly, and our cybersecurity services add monitoring for suspicious activity.
Have a question about your office's shared mailbox? Get In Touch.
Donors give because they trust you. They trust you to use their gift well, and they trust you to protect the name, address, email, and payment details they handed over.
Most nonprofits take that trust seriously. The challenge is doing it on a budget that has to cover programs, staff, rent, and a dozen other priorities. The encouraging part is that the most effective protections for donor data are often low-cost. They depend more on smart choices than on expensive tools.
What Counts as Donor Data?
It's more than a list of names. Donor data usually includes:
- Contact details and mailing addresses.
- Giving history and gift amounts.
- Payment card or bank information for recurring gifts.
- Notes about relationships, interests, and family connections.
- Event registrations and volunteer records.
Some of this is sensitive because of identity theft risk. Some is sensitive because donors simply expect privacy. A major donor's giving history, for example, isn't something they'd want shared beyond your development team.
Where Nonprofits Most Often Leave Gaps
When we review nonprofit systems, the same issues come up again and again. None of them come from carelessness. They come from growing quickly with limited staff.
Exports that never get cleaned up
Someone pulls a donor list into a spreadsheet for a mailing or a gala. The file gets emailed to a volunteer, saved to a laptop, and forgotten. Months later, there are copies everywhere.
Too many people with full access
Donor databases often give every user administrator rights because it was easier during setup. A volunteer who only enters event registrations doesn't need to see every gift amount or export the entire database.
Passwords without a second check
If the donor database login is just a password, one successful phishing email can expose everything. Multifactor authentication adds a second step, such as a code on a phone, that stops most of these attacks.
Payment details stored where they shouldn't be
Card numbers written on paper pledge forms, saved in spreadsheets, or typed into email create real risk. Payment data should go through a reputable payment processor, not live in your own files.
A Prioritized Checklist for Limited Budgets
Rather than trying to do everything, start at the top of this list and work down. The first items deliver the most protection for the least cost.
Do this month
- Turn on multifactor authentication for your donor database, email, and payment platform.
- Review who has access to the donor database, and remove anyone who no longer needs it.
- Confirm card payments are processed through a payment provider, not stored by your organization.
Do this quarter
- Set user roles so people only see the data their job requires.
- Find and delete old donor exports on shared drives, laptops, and email.
- Create a simple rule for how donor lists are shared with volunteers and vendors.
Do this year
- Confirm your donor database is backed up and test restoring it.
- Provide short security awareness training for staff and key volunteers.
- Review the security practices of vendors who handle donor data, such as mailing houses or event platforms.
Not sure where your biggest gaps are? A cybersecurity risk assessment can help you rank priorities based on your actual systems.
Free and Low-Cost Resources Worth Knowing
Many technology vendors offer nonprofit discounts or donated licenses, including business-grade email and productivity tools with built-in security features. Before buying a new security product, check whether a tool you already pay for has a protection you haven't turned on yet. That happens more often than you'd think.
Talking to Your Board About Donor Data
Boards don't need technical detail. They need to understand risk and responsibility. A helpful way to frame it is:
- What donor information do we hold?
- Who can access it?
- What would happen to donor trust if it were exposed?
- What are we doing this year to reduce that risk?
Framing security as donor stewardship, rather than an IT expense, often helps leaders see why it matters.
A Realistic Example
A regional food bank's development coordinator received an email that appeared to come from its donor database provider, asking her to "re-verify" her login. She entered her password. Because the organization had turned on multifactor authentication three months earlier, the attacker couldn't get in without the code sent to her phone. The coordinator reported the email, reset her password, and the issue was closed in under an hour.
That outcome cost almost nothing to achieve. It simply required turning on a feature that was already available.
Protect the Trust You've Earned
Donor data security doesn't require a large budget. It requires clear priorities and steady follow-through. Maise Technology supports mission-driven organizations with practical cybersecurity services sized for real nonprofit budgets. Learn more on our IT services for nonprofit organizations page.
If you'd like help putting this checklist into action, Schedule A 15 Minute Discovery Call and we'll talk through your donor systems and where to start.
