Mortgage Companies
Microsoft 365 and Email Security Built Against Closing Wire Fraud.
Loan files, pre-approvals and closing instructions travel by email, and that is where wire fraud starts. We run your Microsoft 365 tenant and the protection around every mailbox.
For mortgage companies that work loans through Outlook and Teams and send closing details to borrowers, agents and title companies.
Microsoft 365 and Email Security for Mortgage Companies
How Does Wire Fraud at Closing Actually Happen?
An attacker gets into a mailbox, often a loan officer's, a real estate agent's or a title company's, with a phished password. They read the thread quietly, sometimes set a mailbox rule to hide replies, and on closing week send new wiring instructions from the real account or from a look-alike domain.
Picture a borrower who gets an email from what looks like their loan officer the day before closing, with a new account number for the funds. If nobody calls to check, the money is gone before anyone notices.
What Do You Put Around Each Mailbox?
Multi-factor authentication on every account, which the FTC Safeguards Rule asks for anyone accessing an information system (16 CFR 314.4(c)(5)), so a stolen password alone does not open the inbox. Email and web filtering that block known phishing and malware. Email authentication and anti-spoofing settings for your domain, so others cannot easily send mail that looks like it came from you.
Individual accounts for everyone, and no daily work from administrator accounts, so one compromised login does not hand over the tenant.
Why Does a Written Wiring Procedure Matter So Much?
Because technical controls cannot stop a fraudster who controls someone else's mailbox, such as a title company's or an agent's. A written procedure that says wiring instructions are never changed by email, and that any change is verified by phone at a number already on file, closes the gap that business email compromise depends on.
We write the procedure with you and train staff on it, so loan officers can tell borrowers exactly what to expect.
Should Borrower Documents Be Sent by Email at All?
Ideally not as plain attachments. The rule asks for encryption of customer information in transit over external networks (16 CFR 314.4(c)(3)), and a borrower portal or encrypted email is a better home for pay stubs, tax returns and bank statements than an open thread.
We configure Microsoft 365 sharing and mail settings so staff have a safer default, and set up how documents move between your mail and your other systems.
What Is Included
6 PARTSTenant Administration
Users, licenses, mailboxes, Teams and SharePoint access, handled by your managed IT team.
MFA on Every Account
Multi-factor authentication on email and business applications.
Email and Web Filtering
Known phishing and malware blocked before it reaches an inbox or a browser.
Email Authentication
Anti-spoofing settings for your domain, so your name is harder to forge in a closing email.
Least Privilege
Individual accounts for everyone, and no daily work from administrator accounts.
Wiring Change Procedure
A written process for verifying payment and bank detail changes.
Frequently Asked Questions
4 QUESTIONSCan you stop closing wire fraud completely?
No one can promise that, because part of the risk sits in other parties' mailboxes. Multi-factor authentication, filtering, anti-spoofing, monitoring, training and a phone verification procedure for wiring changes make it much harder.
Does the FTC Safeguards Rule require MFA on email?
The rule requires multi-factor authentication for any individual accessing any information system, unless your Qualified Individual approves an equivalent or more secure control in writing (16 CFR 314.4(c)(5)). Email is where most firms start.
We already pay for Microsoft 365. Is it not secure out of the box?
Microsoft provides the tools. Multi-factor authentication, sign-in rules and anti-spoofing settings still have to be turned on, configured and watched. That is the work we do.
Do you also support Google Workspace?
Ask us on the call. This page describes Microsoft 365 because that is what most of our clients run.
More for Mortgage Companies
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Mortgage Companies
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Mortgage Companies
Managed IT and security for mortgage lenders, brokers and servicers, with the FTC Safeguards Rule in view.
Talk Through Your Email and Closings.
Pick a time. Tell us how closing instructions reach your borrowers today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.