You think about mailbox security as a password and a second factor, and you believe that changing the password after a scare ends the problem. A former FBI special agent describes what an intruder actually does once he is inside, and it lives on a settings page you have almost certainly never opened.
On a title-industry fraud podcast, a former FBI special agent is asked what he is seeing most in real estate. Business email compromise, he says, and then he describes the part nobody pictures. "I get inside your account and I set up rules." The rule does one job: "if emails coming in from Sarah are then forwarded to here and then deleted out of your inbox." You never see the message, so you never learn the thread was taken over. "So, almost instantaneously it happens. You don't even see it." In his words, "the business email takeovers with the rule changes is really what we're seeing a lot of."
He is then asked why changing your password is no longer enough. "Once a hacker gets into your account, it's all about consistency. They're going to stay there." One of the first moves after getting in, he says, is "one of the first things you do when you get a system, you put up these backdoors" — spare ways in that stay unused until the used one closes. And the lockout is timed on purpose: "they'll lock you out on a Friday afternoon and so IT's not back until Monday morning." By Monday your clients have been told you cannot get into your email and have switched to a Gmail address.
His verification advice is not a callback number pulled off the email. It is a question only the real person can answer: "Hey, that first time we met, do you remember where we met? Can you tell me where we met?"
“I get inside your account and I set up rules.”
What this costs you now is that your whole defense is aimed at the front door. You rotated the password, you turned on the second factor, and you feel covered. Meanwhile a rule sitting in your mailbox is quietly routing your lender, your escrow officer, or your buyer to somebody else, and the first evidence you will ever get is a wire that went to the wrong account.
The change is a five-minute habit and it is free. Open rules and forwarding, delete anything you did not create yourself, and then do it again for every person on your team who touches a file — an assistant or a transaction coordinator mailbox is the same door. Then move your verification off email entirely. A number you already had, and a question about something only the two of you know, beats any confirmation that arrives in a thread.