Mortgage brokerages and private lenders
IT and security for firms that collect ID, income and credit documents from borrowers and move large sums on closing day, when a single spoofed email can redirect the funds.
The data you hold: ID, income, credit
A typical mortgage file holds government ID, notices of assessment, T4s, pay stubs, bank statements, credit reports, and sometimes separation agreements or medical information explaining a gap in income. Under PIPEDA's Schedule 1 principles, that information needs safeguards proportionate to its sensitivity, and this is about as sensitive as personal information gets.
The risk is not just the loan origination system. It is the documents emailed in by borrowers, saved to desktops, attached to lender submissions and forwarded between agents and assistants.
Closing-funds and wire fraud
Closing day is a fraudster's best opportunity: large amounts, deadlines, and many parties (borrower, lender, lawyer, realtor) exchanging emails. Attackers who compromise any one mailbox in that chain can send altered trust-account or payout instructions that look exactly like the real thing.
If money has gone to the wrong account, call your bank's fraud department immediately to request a recall, report to local police and the Canadian Anti-Fraud Centre, and preserve the emails with full headers. Speed with the bank matters more than anything else.
Confirm instructions by phone
Call the lawyer or lender on a number from their website or your file, never from the email.
Treat changes as red flags
Any change to payout instructions near closing gets a second person and a callback.
Tell borrowers in writing
Your firm will never send changed wiring instructions by email.
Watch your own mailboxes
Alerts for new inbox rules, forwarding and foreign sign-ins.
Secure document intake from clients
Email attachments are the default way borrowers send documents, and they sit in mailboxes indefinitely. A secure upload portal or encrypted file request link keeps documents out of email, gives you one place to manage them, and lets you remove access when the file closes.
Whichever tool you use, restrict who can see each file, disable anonymous 'anyone with the link' sharing, and stop staff from downloading full files to personal devices.
Records and retention
Keeping everything forever multiplies the damage of a breach. Keeping too little creates problems with regulators, lenders and tax authorities. The Canada Revenue Agency generally requires business records and supporting documents to be kept for six years from the end of the last tax year they relate to. Mortgage regulators, lenders and anti-money-laundering rules may set their own periods for client files.
A written retention schedule, enforced with retention settings in Microsoft 365 or your document system, lets you keep what you must and delete what you no longer need. See our records retention schedule guide.
Email and identity hardening
- Multi-factor authentication on every mailbox, including assistants and shared inboxes
- Block legacy authentication and sign-ins from countries you do not work in
- DMARC at quarantine or reject so your domain cannot be spoofed to borrowers
- Separate admin accounts for whoever manages Microsoft 365
- Encrypted laptops and managed phones, with remote wipe
Common questions
Deleting from the inbox rarely deletes everywhere: sent items, the recipient's copy, backups, synced phones and archives all keep copies. A portal or secure file request is easier to manage and easier to defend if something goes wrong.
More than you might expect. You can require MFA and compliant devices to reach firm email and systems, protect firm data in apps on personal devices, and remove that data when an agent leaves, without managing their whole computer.
Preserve the evidence, find out what the attacker accessed, and take advice on whether the breach creates a real risk of significant harm. Government ID combined with financial information is highly sensitive, so assume reporting may be required and get counsel involved early.
Incident readiness
Know before closing day who you call if a payout is diverted or a mailbox is hijacked: your bank's fraud line, your cyber insurer, counsel and an incident responder. Keep that list on paper. If a borrower's personal information is exposed, you will also need to assess whether the breach creates a real risk of significant harm and must be reported to the Privacy Commissioner. Our 24/7 incident line is (289) 582-9930.
Related work.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
Related pages.
- IndustryManaged IT Services for Real Estate & Property ManagementIT for real estate brokerages and teams: deposits held in trust, agents working from their own phones, and closing-day wire fraud.
- IndustryManaged IT Services for Financial Services FirmsIT support for financial services firms means running the systems an advisory, wealth, insurance or lending practice depends on, and securing the client financial data…
- GuideWhat to do if you sent a payment to a fraudsterIf a wire, EFT or cheque went to an account controlled by a fraudster, the first hour matters most. Call your bank before you do anything else.
- GuideBuilding a records retention scheduleKeeping everything forever feels safe until a breach exposes ten years of client files, or a litigation hold has to search all of it.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.