Where does trust become difficult during a transaction?
A client may hear from an agent, coordinator, lender, attorney, inspector, and settlement office. Your team controls only part of that conversation. We recommend making the communication map explicit at the start: who handles which task, which domains belong to your team, and where the client should take a question about money.
The CFPB's closing-scam guidance recommends establishing trusted contacts before closing and verifying payment instructions through those contacts. Turn that principle into a simple onboarding conversation. Do not wait for a suspicious email to be the first time the client learns your verification process.
What should the team agree with each client?
Use a short communication agreement, written in ordinary language. Identify the primary contact and a backup. Explain where sensitive documents belong and how the client should check an unexpected request. Make the instructions usable on a phone, because that may be where the client is reading them between appointments.
Avoid promises that other parties have not approved, such as claiming no participant will ever change instructions. Instead, describe the action a client should take if anything changes: pause, use the established contact route, and get the appropriate party to confirm. The agreement should reduce ambiguity rather than require the client to diagnose an attack.
- Who is the client's primary contact and backup?
- Which organization is authorized to provide payment instructions?
- Which previously established number should the client call?
- Where should documents be uploaded or delivered?
Which sending tools belong in the domain review?
Check the tools your team actually uses: employee mail, listing notifications, contact forms, appointment reminders, and marketing messages where applicable. A branding change can make several services appear to speak with one voice while their sending configurations remain separate. Name an owner for each service so an administrator can confirm its current use.
For each scoped route, request a harmless test message and a written authentication result. If an agent uses another domain or a third-party platform sends from its own address, record that distinction. Do not describe a review of the brokerage's main domain as a review of every participant in a transaction.
What does an authentication pass leave unanswered?
The FBI describes business email compromise involving deceptive identities and access to legitimate conversations. A technical check of your domain cannot establish whether a request from another party is authorized. Account access, client education, and payment verification remain separate responsibilities.
If a client reports an unexpected payment request, move the conversation to the established channel and involve the responsible organization. Preserve the original message for the people investigating it. Avoid circulating client financial details to a broad group simply because everyone is trying to help.
What should the team improve first?
Choose the weakest handoff you can describe precisely: an unclear contact number, an unowned sending tool, or a payment-change process nobody can explain. Fix that responsibility alongside any agreed domain work. A reliable client experience comes from knowing what to do next, especially when an email looks convincing.