Cybersecurity for Real Estate and Mortgage Brokers in Quebec

Wednesday evening in Dollard-des-Ormeaux. A young couple is buying their first home, and the signing at the notary's office is set for Friday. An email arrives, signed by the notary's assistant: our banking details have changed, here are the instructions to wire your down payment before Thursday noon. The logo is right, so is the file number. They send the money.

On Friday, the notary has received nothing. The investigation will show that their real estate broker's mailbox had been compromised for three weeks: the fraudster knew the price, the signing date and the name of the notary's office.

The scenario is fictional, but the mechanics are well documented. Here's what your professional rules require in Quebec, and the measures that shut this kind of fraud down.

Why brokers are a prime target for fraudsters

A broker sits at the centre of large transactions and emails every party involved: buyer, seller, notary, lender, inspector. To a fraudster, that mailbox holds everything needed to stage a convincing scam.

Three factors make it worse:

• ID documents. A Quebec broker must verify the identity of the parties and, when they haven't met in person, keep the documents used for that verification in the file (s. 29 of the regulation). Driver's licences and passports are exactly what identity thieves want.
• Mobility. Brokers work from their phones between showings, sometimes with a personal email address and apps nobody vetted.
• Deadlines. Conditions, financing, signing: in a transaction, an urgent message looks normal.

What the OACIQ and the AMF require

Quebec real estate brokers must protect the confidentiality of personal information under the OACIQ's conduct regulation and Law 25; mortgage brokerage firms, overseen by the AMF since 2020, must put cybersecurity measures in place that fit their size and risks.

The OACIQ's guideline notes that it is the agency that legally "holds" personal information. The broker must forward what they collect to the agency and destroy their own copy, emails and text messages included, once it's no longer needed. Fewer copies, less exposure.

On the mortgage side, the AMF's guide (in French) states that registered firms must put cybersecurity measures in place based on their size, clientele and technology environment. It recommends limiting access to sensitive data and training staff, including through phishing exercises. How these rules apply depends on your situation, so check with your agency executive officer or legal advisor. Practising outside Quebec? Your provincial regulator has its own rules, but the fraud below works the same way everywhere.

The closing-day scenario, step by step

Real estate wire fraud means swapping the details of the notary's or agency's trust account for an account the fraudster controls, just before the buyer transfers a deposit or down payment. It almost always unfolds like this:

1. Phishing. The broker gets a fake document-sharing notice and types in their password. Without multi-factor authentication, the fraudster is in.
2. Silent reading. The fraudster creates a rule that hides certain messages, then reads the conversation for weeks.
3. The lookalike. They register a domain almost identical to the notary's or the agency's.
4. The message. At the right moment, they send "new" wiring instructions with the real names and the real file number.
5. The transfer. The money lands in an account they control and leaves it quickly.

The OACIQ describes how deposits by electronic transfer work: the broker obtains the trust account number from the trustee and passes it on to the buying client. That's exactly the information a fraudster wants to replace. The OACIQ stresses that the same vigilance applies to a transfer as to a cheque. It also warns about another scheme: a supposed foreign buyer hands over a forged deposit cheque, then backs out and asks for a refund. Check with your financial institution before refunding anything; clearing a cheque from outside Canada may take up to 45 or even 90 days.

The defence is the same as for vendor banking change fraud: every payment instruction gets confirmed by phone, at a number obtained independently, never the one in the email. Tell clients at the first meeting, in writing: "We will never send you banking details by email." Notaries face the same risk, as we explain in our article on cybersecurity for notaries.

Priority measures for an agency or broker

These measures cover most of the risk and can be in place within a few weeks with your IT provider:

• Multi-factor authentication on email, transaction software, e-signature, client management software and banking.
• An agency-managed email address for transactions, not a free personal account.
• SPF, DKIM and DMARC set up on your domain so it can't easily be spoofed.
• Alerts on auto-forwarding rules and unusual sign-ins.
• Phones locked, encrypted and enrolled for remote wipe.
• ID and financial documents filed in the agency's document management system, not left as attachments.
• Copies destroyed at the end of the mandate, emails and texts included.
• A line in your email signature: we never send banking details by email.
• A written call-back procedure for every transfer.
• Annual training and phishing exercises.
• All access removed on the day a broker or employee leaves.

If a client has already sent the money

Call the bank that sent the transfer right away: the sooner a recall is requested, the better the odds of stopping the funds. Then:

1. File a police report and report the fraud to the Canadian Anti-Fraud Centre.
2. Notify the notary, the agency executive officer and your insurer.
3. Keep the fraudulent emails and their headers; delete nothing.
4. Secure the compromised mailbox: new password, sessions ended, forwarding rules removed, multi-factor authentication turned on.
5. Assess the incident under Law 25. A compromised mailbox that held ID documents is a confidentiality incident: record it in your register and, if it presents a risk of serious injury, promptly notify the Commission d'accès à l'information and the people affected. Have your legal advisor validate that assessment.

Our team can review your agency's email setup, phones and payment procedures as part of a cybersecurity audit. If you're in Greater Montréal, one of our experts can also visit your office.