Real estate agent safety is always top of mind, and that extends online too. Phishing is any attempt to trick you into clicking a link, entering a password or handing over information you'd normally keep to yourself, and it's on the rise.
I've seen it from both sides, first as an agent being targeted, and now on the platform side, where we watch for it every day. Agents are an easy target because answering new enquiries quickly is part of the job, and the prize is bigger than it looks. An agent's email account gives a scammer a direct line to clients, which is how fake deposit and wire instructions get sent in the middle of a real transaction. Here's what to look out for and how to protect yourself.
Know what a fake enquiry looks like.
One pattern agents across the industry are seeing right now goes like this: a new enquiry comes in with a short, generic message like "Is this home still available?" often from a phone number far outside your market. You reply, the conversation feels normal for a few texts, and then the "buyer" asks to meet over Zoom or Teams and sends you a link. That link opens a fake Microsoft or Google sign-in page built to capture your email password, or asks you to download something before you can join.
A few red flags worth watching for:
- A first message that could apply to any listing.
- A phone number from far outside your market.
- A push to move to video before you've spoken on the phone.
- A meeting link that asks you to sign in or download a file to join.
Be wary of links you didn't ask for.
- Meeting links. With new contacts, be the one who sends the link, from your own Zoom or Teams account. If someone insists on using theirs, offer a quick phone call instead. People genuinely looking for a home will almost always take the call.
- Documents and e-signature requests. Fake "document ready to sign" emails are one of the most common lures. If you weren't expecting it, don't click. Go to DocuSign or your e-signature platform directly and log in there, where anything genuinely waiting for you will show up, or check with the sender through a number you already have.
Watch for false urgency.
Scams rely on speed: "I'm only in town today," "join now, I'm waiting," "sign this before end of day." A real buyer can wait five minutes while you check. Slow down and verify any unexpected request through a number or channel you already trust.
Protect your accounts.
- Turn on two-factor authentication for your email, your CRM and your e-signature accounts. Even if a password is stolen, it stops most break-ins.
- Give your email a password you don't use anywhere else. It's the account every other reset runs through.
- Never share a password, a verification code or remote access to your device, with anyone, for any reason.
If you think you clicked.
- Change your email password right away from a device you trust, and sign out of any other sessions.
- Check your email settings for forwarding rules you didn't create. Scammers add them so they can quietly read your mail after you've changed the password.
- Let your brokerage know, especially if your email may have been used to contact clients. If you downloaded anything, have the device checked before you use it for client work again.
- Report the enquiry to the website or portal it came from so they can block the sender, and to the Canadian Anti-Fraud Centre at 1-888-495-8501 or antifraudcentre.ca.
When in doubt, stop and think.
Online safety takes the same thought process as any other kind of safety: when something doesn't seem right, slow down, stop and think. Phishing relies on agents moving quickly and sharing information they otherwise wouldn't. CREA also has free resources built for agents, including a cybersecurity course and a webinar on AI-driven risks with the Canadian Centre for Cyber Security.
