Initialize Your Cyber Safe Transaction Diagnostic.

Used only for session scheduling.

To ensure your Readiness Report is accurate for your specific liability level, which best describes your role?

How many real estate professionals operate under your direct supervision or within your team?

Approximately how many transactions does your office/team close annually?

A. Under 25

B. 26 – 100

C. 100+

When your office receives new or changed wiring instructions (especially for closing funds or large deposits), what is the mandatory protocol?

A. We rely on the written or emailed instructions, perhaps after reviewing the PDF.

B. We ask the client/lawyer to confirm via email reply, or we call the number listed in the email.

C. We mandate "out-of-band verification"—calling a pre-agreed, known, independently sourced phone number to confirm the details before sending.

How does your office send or receive final wire details (account numbers, void cheques) with clients or escrow?

A. Standard, unencrypted email attachments.

B. We use password-protected documents via email.

C. We mandate a secure transaction portal, a secure document vault, or an encrypted system for all fund-related data.

Does your office policy require that a minimum of two separate, non-related staff members review and approve the wire instructions before a large deposit or disbursement is made? (This is known as dual-control)

A. No. One person is responsible for handling the wire.

B. Yes, we require dual sign-off for all transfers above a set threshold (e.g., $10,000).

At what point does your office first issue a clear, written warning to clients that wiring instructions will never change via email only and that they must call to verify?

A. We tell them verbally at closing, or rely on the lawyer/title company to do it.

B. We provide a pre-built, branded "Cyber-Safe Client Kit" checklist at the start of the relationship (onboarding) and repeat the warning before closing.

When you take on a seller client, especially for vacant land or when they are based out-of-province/remote, how do you verify their identity?

A. We accept a scanned ID (passport/driver's license) via email.

B. We use a digital ID verification tool, but no live interaction is required.

C. We mandate a live video call where the client holds up their ID, or an in-person meeting, to confirm liveness and deter deepfakes.

How do staff verify documents critical to the deal (e.g., income statements, divorce decrees, bank void cheques, Powers of Attorney) for signs of forgery?

A. We assume documents from the lawyer/lender are authentic.

B. Staff are trained to look for digital manipulation red flags (pixelation, odd formatting, round numbers, grammar errors)

C. We submit suspicious documents to a third-party document forensic or verification tool.

When taking on a new buyer or seller, do you cross-verify their known details (like address or a previous transaction detail) using an independently sourced database?

A. No, we rely solely on the ID provided.

B. Yes, we perform basic checks against public records or request a past document (e.g., utility bill mailed to the address) to verify ownership knowledge.

Is Two-Factor Authentication (2FA) required for all agents and staff to access their primary business email and cloud accounts (like CRM or document storage)?

A. It is optional, or only recommended

B. Yes, 2FA/MFA is mandatory for all accounts containing client or transaction data.

Does your office require agents to use a company-owned email domain (e.g., Jane@YourBrokerage.com) for all client communication, rather than free accounts (Gmail, Hotmail)?

A. No, agents can use personal free email for client deals.

B. Yes, company domain email is mandatory, and we use protective configurations B. Yes, company domain email is mandatory, and we use protective configurations (DMARC/SPF) to make domain spoofing harder. to make domain spoofing harder.

C. What is DMARC/SPF?

When agents work from cafes, airports, or client homes, are they required to use a Virtual Private Network (VPN) or secure connection to handle sensitive client data or transaction documents?

A. No, they use public Wi-Fi freely.

B. Yes, a VPN or other secure connectivity protocol is required when handling client data outside the office.

How often is your brokerage required to provide specific training or simulation focused on real estate wire fraud, deepfakes, and transaction security?

A. Only during initial licensing, or never.

B. Annually or when a new scam is reported.

C. Quarterly training, and we conduct non-announced phishing/simulation drills regularly.

Do you give every new client (buyer and seller) a simple, branded, physical or digital handout that explains the specific risks of wire fraud, title fraud, and how your office protects them?

A. No, we expect the lawyer/title company to do this.

B. Yes, we provide a "Cyber-Safe Client Kit" at the start of the relationship (Week 1 of engagement).

If a staff member or agent receives a suspicious request (e.g., a last-minute wire change, or a client who avoids video calls), is there a required, standardized call/email script they must use to pause the transaction and verify the request?

A. No, staff handle it case-by-case based on gut feeling.

B. Yes, we have pre-approved scripts and protocols that mandate a verification pause, use firm language, and explain why we are pausing.

Do you advise homeowner clients (especially sellers or landlords) about free local services (like County Recorder alerts) that notify them immediately if a deed or lien is filed against their property?

A. No, that's not our role.

B. Yes, we inform all sellers about title theft risks and advise they use monitoring services where available.

If an agent discovered $150,000 of a client's money was miswired 30 minutes ago, do you have a written, easily accessible "First Hour Incident Playbook" that tells them exactly who to call internally and what information to gather?

A. No, we rely on the managing broker's memory or the IT provider.

B. Yes, we have a tested, written plan (a Quick-Card or Playbook) with all emergency contacts and required steps for the first 60 minutes.

Has your brokerage conducted a live, timed scenario simulation (a “tabletop exercise”) in the last 12 months where staff had to practice responding to a wire fraud or fake seller incident?

A. No, we have only watched training videos.

B. Yes, we have run at least one live drill to test our staff's speed and adherence to the verification protocol.