BROKER’S EDGE — Smarter Real Estate Lending

A Public Service Announcement for Realtors, Mortgage Professionals, Escrow Officers, Title Companies, and Real Estate Investors

October 2026 | Cybersecurity Awareness Month

October Is Cybersecurity Awareness Month — And Real Estate Professionals Should Be Paying Attention

Every October, Cybersecurity Awareness Month serves as a national reminder that protecting our personal information, business systems, and financial transactions requires constant vigilance.

For those of us working in real estate and mortgage financing, the stakes can be particularly high.

We routinely exchange sensitive financial documents, communicate with people we’ve never met, and participate in transactions involving hundreds of thousands — sometimes millions — of dollars.

Unfortunately, the everyday business activities can create opportunities for cybercriminals.

As we recognize Cybersecurity Awareness Month this October, I want to share two recent experiences from my own mortgage business, along with some important warnings about fraudulent Zoom invitations, suspicious PDF attachments, and other increasingly sophisticated attempts to compromise real estate professionals.

My objective isn’t to discourage anyone from conducting business electronically. It’s to encourage all of us to recognize warning signs, question unusual requests, and consult our IT professionals about protecting ourselves and our clients.

A New Kind of Real Estate Scam May Be Coming to Your Inbox — or Your Cell Phone

Imagine receiving a text message from someone interested in purchasing a property.

They sound professional. They want to discuss their financing options. Perhaps they mention a property they’re considering purchasing or ask about arranging a meeting.

Then comes the request:

“Can I send you a Zoom link so we can discuss this?”

Sounds innocent enough, doesn’t it?

After all, real estate professionals routinely conduct Zoom meetings with buyers, sellers, lenders, attorneys, and other professionals.

But what if that prospective client isn’t a client at all?

What if the person contacting you is actually attempting to gain access to your computer, your email, your clients’ financial information, or even an upcoming real estate transaction?

Unfortunately, this is not simply a hypothetical concern.

The California Association of REALTORS® has warned about phishing scams targeting real estate professionals through seemingly legitimate property inquiries followed by requests for Zoom meetings.

And recently, I’ve experienced several suspicious inquiries myself.

Two Recent Experiences That Raised My Suspicions

Experience #1: The Prospective Borrower Who Sent a Strange PDF

Several weeks ago, someone presenting themselves as a prospective borrower sent me a PDF document.

As a mortgage broker, I receive and review PDF documents constantly. Loan applications, financial statements, tax returns, property information, and other supporting documents are all part of my everyday business.

But something about this attachment wasn’t right.

The document had an unusual filename, and it wouldn’t open in the normal manner I expected.

Rather than trying to force it open or following unfamiliar links, I questioned the document and asked the supposed borrower to reformat it and resend it.

I made that request multiple times.

The individual never responded.

Upon further examination, the document contained a link directing the recipient toward a website impersonating Adobe rather than Adobe’s legitimate website.

That was a major red flag.

Was the individual attempting to steal my login credentials or install malicious software?

I cannot say with certainty what the sender intended. But the characteristics of the document were consistent with a phishing attempt, and I was not about to take that chance.

Experience #2: The Prospective Borrower Who Wanted to Send Me a Zoom Link

More recently, I’ve received unsolicited text messages from individuals presenting themselves as prospective mortgage borrowers.

One individual identified himself by name and contacted me from a telephone number with an out-of-state area code.

He wanted to arrange a Zoom meeting and send me the link.

Rather than accepting an unfamiliar Zoom invitation, I explained that I would be happy to conduct a telephone conference call.

I also asked some basic questions:

  • Where are you planning to purchase real estate?
  • Are you working with a Realtor?
  • What are your financing needs?

These are ordinary questions I ask prospective borrowers during an initial DISCOVERY conversation.

I subsequently called the number, reached voicemail, and left a message requesting a return call.

At the time of writing, I have not established whether this individual is a legitimate prospective borrower or someone with less-than-honorable intentions.

An out-of-state area code alone certainly doesn’t establish fraud. I work with borrowers and investors from many different locations.

But when an unfamiliar individual wants to control the meeting link before establishing even the most basic details of a proposed transaction, I believe some additional caution is appropriate.

The lesson from both experiences is simple: Don’t allow the urgency of obtaining a new client to override basic security precautions.

Why Real Estate Professionals Are Attractive Targets

Think about the information that passes through a typical real estate transaction.

A Realtor may have access to purchase agreements, property information, client contact details, and communications about upcoming closings.

A mortgage professional may handle tax returns, bank statements, credit reports, employment information, business financial statements, and other highly sensitive documentation.

Escrow and title professionals may possess wiring instructions, account information, and transaction details involving hundreds of thousands or millions of dollars.

Now imagine what a criminal might accomplish by gaining unauthorized access to just one of those professionals’ email accounts or computers.

The attacker may not need to steal money immediately.

Instead, the criminal could attempt to monitor communications, identify an upcoming closing, impersonate a trusted party, and send fraudulent wiring instructions at precisely the wrong moment.

The FBI has repeatedly warned about Business Email Compromise, commonly called BEC, and its connection to real estate wire fraud.

A compromised email account can potentially expose an entire real estate transaction, not just the individual whose account was breached.

How the Fake Zoom Meeting Scam Can Work

One reported version of the scheme follows a relatively simple sequence.

Step 1: Establish credibility. A criminal contacts a Realtor or mortgage professional while pretending to be a prospective buyer, seller, borrower, or investor.

Step 2: Request a video meeting. The individual suggests a Zoom meeting and offers to provide the invitation.

Step 3: Create a technical obstacle. The recipient may encounter a page claiming that Zoom needs an update, a security verification, or additional software before the meeting can begin.

Step 4: Deliver malicious software. If the recipient follows the instructions, they may unknowingly install software capable of stealing credentials or providing unauthorized remote access.

Step 5: Exploit the information. The attacker may attempt to access email accounts, financial information, client files, or communications relating to pending transactions.

Not every attack follows this exact sequence. Some use fake document-sharing websites, fraudulent login pages, or malicious attachments.

And not every suspicious Zoom invitation is necessarily fraudulent.

Nevertheless, the risk is sufficiently serious that real estate professionals should establish consistent procedures for verifying unfamiliar contacts.

An Important Distinction: Fake Zoom Links vs. Actual Zoom Security Vulnerabilities

There are two separate cybersecurity concerns worth understanding.

First, criminals can impersonate Zoom.

A fraudulent website may look like Zoom’s legitimate meeting interface while attempting to trick a user into downloading malware or revealing credentials.

This is a social-engineering attack. It relies on deception rather than necessarily exploiting a flaw in Zoom itself.

Second, legitimate conferencing software can have security vulnerabilities.

Zoom has published security advisories in 2026 involving vulnerabilities in certain versions of its software.

These technical vulnerabilities are not the same thing as fraudulent meeting invitations. Their potential impact depends on the particular vulnerability, affected software version, and circumstances.

It would be inaccurate to suggest that every Zoom meeting allows a stranger to access your computer.

However, keeping conferencing software updated is essential, and professionals should not assume that avoiding suspicious links is their only necessary precaution.

  •  

Another Emerging Threat: Could Someone Steal Your Face or Voice During a Zoom Meeting?

There’s another cybersecurity concern that deserves attention: artificial intelligence and the growing sophistication of deepfake technology.

Imagine participating in a Zoom meeting with someone you believe is a prospective buyer or borrower.

During the conversation, that individual captures video of your face and records your voice.

Could that recording later be used to impersonate you?

Unfortunately, the answer is yes.

Cybercriminals can potentially use images, video recordings, and voice samples to create AI-generated impersonations that appear or sound remarkably convincing.

The FBI has warned that criminals are using artificial intelligence to generate fraudulent videos and cloned voices to deceive individuals and businesses.

For real estate professionals, consider the possible consequences.

What if a criminal created a video appearing to show a Realtor providing instructions to a client?

What if an escrow officer received what appeared to be a legitimate video message authorizing a change in wiring instructions?

Or what if a mortgage broker’s voice were cloned and used to request confidential financial information?

These scenarios illustrate why cybersecurity now involves more than protecting passwords and avoiding suspicious attachments.

Our faces, voices, and professional identities can also be misused.

Importantly, simply appearing on a Zoom call does not automatically give someone access to your financial accounts or enable them to defeat secure facial-recognition systems.

But recorded video and audio may provide material that criminals can exploit for impersonation and social-engineering attacks.

And criminals don’t necessarily need a Zoom recording. Publicly available videos and social media content may also provide usable material.

Additional Precautions Worth Considering

  • Be cautious about appearing on video with unfamiliar individuals whose identities and intentions have not been established.
  • Consider conducting initial consultations by telephone.
  • Remember that someone may capture video or audio through external recording tools even when a meeting’s recording feature is disabled.
  • Never authorize financial transactions, wiring changes, or the release of confidential information based solely on a video or voice communication.
  • Independently verify unusual requests using trusted contact information established previously.
  • Ask your IT professional about protecting your business against AI-generated impersonation and deepfake fraud.

The bottom line: Seeing someone’s face or hearing a familiar voice is no longer conclusive proof of identity.

As artificial intelligence becomes more sophisticated, independent verification becomes increasingly important.

This is another reason Cybersecurity Awareness Month is an excellent opportunity to review the security procedures we use to protect ourselves, our businesses, and our clients.

Ten Warning Signs Every Real Estate Professional Should Recognize

One suspicious detail may have an innocent explanation. Several warning signs occurring together should prompt additional verification.

  1. Unsolicited inquiries with little meaningful information. The person claims to be interested in purchasing property but provides few details about their plans.
  2. An immediate request for a Zoom meeting. The individual wants to move directly to a video conference before discussing basic transaction information.
  3. Insistence on sending their own meeting link. They resist your offer to host the meeting or speak by telephone.
  4. Unusual document attachments. PDFs, compressed files, or other documents behave unexpectedly or direct you to unfamiliar websites.
  5. Requests to download additional software. A meeting invitation claims that you must install an update, plugin, or security application.
  6. Suspicious website addresses. A website resembles Adobe, Zoom, Microsoft, or another familiar company but uses a different domain.
  7. Avoidance of ordinary verification questions. The person refuses to discuss the property, financing purpose, or other relevant details.
  8. Unusual urgency or pressure. The supposed client insists that you act immediately, sometimes claiming an important business opportunity will otherwise disappear.
  9. Requests for passwords, verification codes, or remote access. Legitimate prospective clients should not need access to your computer or business accounts.
  10. Communication that suddenly stops when you ask for verification. A person who disappears after being asked to resend a document or participate in a telephone conversation may warrant additional suspicion.

Remember that an unfamiliar area code, unusual name, or preference for video conferencing does not independently establish that someone is a scammer.

The objective is to recognize patterns and verify identities, not to discourage legitimate business.

Ten Practical Steps to Protect Yourself and Your Clients

1. Host Your Own Zoom Meetings

For unfamiliar prospective clients, consider sending your own meeting invitations through your established business account.

This reduces your exposure to fraudulent meeting links, although it does not eliminate every conferencing-related security risk.

2. Verify New Contacts by Telephone

An initial telephone conversation can help establish whether someone has a legitimate real estate or financing inquiry.

When appropriate, independently verify their Realtor, business affiliation, or other transaction details.

3. Keep Your Software Updated

Ask your IT professional to review the security of your computers, operating systems, browsers, Zoom applications, and other software.

Install security updates through legitimate applications or verified vendor websites.

4. Never Install Software Simply Because a Meeting Invitation Tells You To

If a website claims that you need a special Zoom update or plugin, stop.

Contact your IT professional or verify the requirement directly through the software provider.

5. Use Secure Document Collection Procedures

Mortgage and real estate professionals should establish approved methods for collecting confidential client information.

In my own practice, residential mortgage applications are handled through the ARIVE system.

For commercial and hard-money financing, I also use Floify as an alternative to sending a fillable Business Purpose Loan Application.

These are established intake channels in my business. They help me maintain a consistent process rather than improvising document exchanges with unfamiliar contacts.

Of course, any technology platform must be properly configured, maintained, and secured.

6. Protect Your Email Accounts

Use multifactor authentication, preferably phishing-resistant authentication where supported.

Have your IT professional review account recovery methods, unauthorized forwarding rules, connected applications, and suspicious login activity.

7. Never Rely Solely on Emailed Wiring Instructions

Independently verify wiring information through a previously established, trusted telephone number.

If wiring instructions suddenly change, treat that as a major warning sign.

8. Limit Remote-Access Permissions

Do not grant remote control, screen-sharing control, or installation permissions to unfamiliar individuals.

Review your conferencing application’s security settings with your IT professional.

9. Train Your Entire Team

A brokerage may have excellent security practices, but one employee opening a malicious attachment or following a fraudulent link can create substantial exposure.

Agents, loan officers, processors, assistants, and administrative staff should understand these risks.

10. Establish an Incident-Response Plan Before Something Happens

Know whom to call if you suspect a computer or account has been compromised.

Have procedures for protecting client information, contacting financial institutions, preserving evidence, and reporting suspected fraud.

What If You Already Clicked a Suspicious Link?

Don’t ignore the situation simply because nothing unusual happened immediately.

Some malicious software is designed to operate quietly.

If you downloaded or executed suspicious software, entered credentials into a questionable website, or granted unexpected remote access, contact your IT professional immediately.

Depending on the circumstances, appropriate steps may include isolating the affected device, preserving evidence, securing accounts from a trusted device, and examining whether sensitive information was accessed.

If a fraudulent wire transfer is suspected, immediately contact the financial institution involved and request assistance with stopping or recalling the transfer.

The FBI’s Internet Crime Complaint Center accepts reports at www.ic3.gov.

Speed can be critically important when attempting to recover fraudulently transferred funds.

IMPORTANT CYBERSECURITY DISCLAIMER — PLEASE READ

THIS ARTICLE IS A PUBLIC SERVICE ANNOUNCEMENT, NOT PROFESSIONAL CYBERSECURITY OR INFORMATION TECHNOLOGY ADVICE.

I am a mortgage financing professional, not an IT security consultant, cybersecurity investigator, software engineer, or digital forensic specialist.

The information presented here is intended to raise awareness of reported cybersecurity threats affecting real estate and mortgage professionals. It is not intended to diagnose a security breach, determine whether a particular document or meeting invitation is malicious, or provide a comprehensive computer security program.

I strongly encourage every Realtor, mortgage broker, loan officer, escrow officer, title professional, real estate investor, and business owner to contact their qualified IT professional or cybersecurity specialist to discuss these threats.

Specifically, ask your IT professional to:

  • Review current Zoom and other video-conferencing software versions and security advisories.
  • Evaluate the security of your computers, mobile devices, and business networks.
  • Confirm that operating systems, applications, antivirus, and endpoint protection systems are properly updated.
  • Review email security, multifactor authentication, and access permissions.
  • Establish procedures for evaluating suspicious attachments, meeting invitations, and unfamiliar website links.
  • Assess how confidential client and financial information is collected, stored, transmitted, and protected.
  • Develop an incident-response and data-recovery plan appropriate for your business.
  • Determine whether any suspected incident requires notification to affected clients, regulators, insurers, or law enforcement.

Cybersecurity threats evolve rapidly. Software vulnerabilities, protective measures, and recommended responses may change after this article is published.

Do not assume that your computer or business systems are secure simply because you have not noticed suspicious activity. Conversely, receiving a suspicious message does not necessarily mean your computer has been compromised.

Only a qualified professional with access to the relevant systems and evidence can properly evaluate your particular circumstances.

This article is provided for general educational purposes and should not be relied upon as a substitute for professional cybersecurity, legal, compliance, or technical advice.

Final Thoughts: A Little Skepticism Can Protect a Lot More Than One Transaction

As mortgage and real estate professionals, we’re conditioned to respond quickly to new business opportunities.

A new buyer inquiry might become a substantial purchase transaction.

A new borrower might become a lifelong client.

A commercial investor might represent multiple financing opportunities over many years.

But criminals understand that motivation, too.

They know we want to be responsive. They know we receive unfamiliar documents. And they know we regularly communicate with people we’ve never met.

That makes our industry an attractive target.

I don’t intend to stop meeting prospective borrowers by Zoom, accepting electronic documents, or responding to new financing inquiries.

Those tools are essential to modern business.

But I will continue asking questions, verifying unfamiliar contacts, and using established communication and document-collection procedures.

A legitimate prospective client should understand reasonable security precautions.

And if someone disappears because you refuse to open their unfamiliar link?

Perhaps that was a business opportunity you were better off missing.

Cybersecurity Awareness Month: Protect Yourself, Your Clients, and Your Colleagues

Cybersecurity Awareness Month is an excellent opportunity to review how we conduct business and whether our existing security procedures are keeping pace with emerging threats.

My challenge to every real estate and mortgage professional this October is simple:

Take a few minutes to contact your IT professional. Ask whether your computers, video-conferencing applications, email accounts, and document-sharing systems are properly protected against current cybersecurity threats.

And don’t keep that conversation to yourself.

Share this warning with your fellow Realtors, mortgage professionals, escrow officers, title representatives, and administrative teams.

A single suspicious link, fraudulent document, or compromised email account can potentially affect far more than one person.

Protecting our clients’ confidential information is part of protecting the integrity of every real estate transaction.

This October, let’s make cybersecurity awareness more than an annual reminder. Let’s make it an everyday business practice.

🔎 BROKER’S EDGE – Smarter Real Estate Lending
🤝 Looking out for your Best Interest, and Helping Homeowners, Investors & Small Business Owners since 1990

📞 Steven Hook | Residential & Commercial Mortgage Broker

📱 415-260-9376 | 📠 415-449-3428

🎓 MBA | CMPS | CMA

👉 Schedule a Call
🌐 SanFranciscoLoanOptions.com
🌐 shook@Uamco.com or smhloans007@gmail.com

🆔 NMLS #303544   Ca DRE #00987187

Helping real estate professionals and their clients make smarter, better-informed decisions.

Sources and Additional Reading

Posted in blog, Tips and Tricks, Uncategorized