Agents get impersonated. Tenants’ data gets emailed. Both are fixable.
Fraudsters impersonate agents to redirect earnest money and closing funds; property managers email leases, applications and bank details with tenant SSNs every day. PXCMail flags impersonation inbound, encrypts applications and payment details outbound, and keeps the archive your broker and E&O carrier want.
Overview
Brokerages
Earnest-money and closing communications get the verify-by-phone notice; lookalike agent domains flagged; broker sees exceptions.
Property management
Rental applications, leases, ACH forms and owner statements detected and encrypted; per-property archive.
Teams and ICs
Independent contractors on their own Gmail can route through the brokerage policy without changing addresses.
Moments that matter
- Applicant emails a rental application with SSN and pay stubs — reply encrypted automatically.
- “The title company changed its account” from a lookalike domain — banner, verify by phone.
- Owner asks for every message about a tenant dispute — archive search, export.
Works beside
AppFolio, Buildium, Yardi Breeze, Rent Manager; kvCORE, Follow Up Boss, dotloop, Dotloop/Skyslope transaction rooms. Overview →
Pricing
Gateway $6 · Gateway + archive & legal hold $9 per seat.
The answer for a brokerage
Real estate wire fraud is an email problem before it is a banking problem. The fraudster reads a deal thread, registers a lookalike of the title company or the agent, and sends “updated wiring instructions” the week of closing. The fix has three parts: flag inbound messages that change payment details or come from a lookalike domain, encrypt outbound messages that carry applications, SSNs or bank details, and keep an archive so that when a buyer says “your agent told me to wire there”, you can show what your agent actually sent. PXCMail does all three on the brokerage’s Google or Microsoft account, including for independent contractors on their own Gmail. It does not verify bank accounts and it does not replace the phone call to the title office; it makes sure the banner says to make that call.
A week at a brokerage that closes with Harbor Title
Fifteen agents and a transaction coordinator on Google Workspace, with dotloop for the file. Most closings go through Harbor Title, a 14-person escrow company where Maria is the escrow officer.
- Monday. Jen, an agent, gets “Closing funds, new instructions” from
[email protected]. The domain was registered six days ago and is a lookalike of harbortitle.com. The message gets a red banner: do not forward to the buyer, call the title office. Jen calls Maria. Maria has sent nothing. - Tuesday. The transaction coordinator sends the buyer’s pre-approval letter and a copy of the earnest-money check to Harbor Title. Account and routing numbers are in the image; policy: encrypt. Maria opens with a code; the open is logged.
- Wednesday. The property-management side receives a rental application with an SSN and pay stubs. The reply, with the lease, goes back encrypted without anyone pressing a button.
- Thursday. An agent forwards a client list to his personal account before leaving for a competitor. Policy: block, broker notified, attempt logged.
- Friday. The E&O renewal questionnaire asks whether the brokerage has controls against business email compromise. The broker attaches the quarterly report: lookalike detections, encrypted messages, blocked forwards.
By the numbers
- $2.77 billion in losses from 21,442 business email compromise complaints in 2024, out of 859,532 complaints and $16.6 billion in total reported losses. (FBI IC3 2024 Internet Crime Report) The cumulative figure is $55.5 billion in exposed losses from October 2013 to December 2023. (FBI IC3 PSA, September 2024)
- 58% of cyber insurance claims in Coalition’s 2026 report were BEC or funds-transfer fraud; 52% of funds-transfer-fraud claims began as BEC; the average BEC loss was about $27,000 and the average claim about $116,000. (Coalition 2026 Cyber Claims Report)
- 98% of claims in the NetDiligence 2025 study came from small and mid-sized businesses. (NetDiligence Cyber Claims Study 2025)
What the carrier asks
“Do you enforce MFA and have controls against business email compromise?” MFA is on your Google or Microsoft account. The BEC control is the inbound banner on lookalike domains and payment-detail changes, plus the audit record of each detection. The quarterly report is the attachment.
“Is client financial data encrypted in transit?” TLS is required to every recipient and messages carrying account numbers, SSNs or wire instructions go by locked delivery. The message record shows the method.
“Can you produce the email trail for a disputed transaction?” Archive search by address, date range and property, export with a sha256 manifest and chain-of-custody statement, legal hold on the matter.
“What happens when an agent leaves?” Access ends the same day; the mailbox stays under retention; the block on forwarding to personal accounts was already in force.
“Which title companies do you work with and how do you confirm instructions?” Your answer is procedural: call the known number. Harbor Title sends its instructions by locked delivery; PXCMail shows the warning on anything that claims to change them.
Going live
- Start the trial with the legal and title profile
14 days, $0 charged. The Data Processing and Safeguards Addendum is signed in signup. - Connect the brokerage account and the ICs
Agents on their own Gmail route through the brokerage policy without changing their address. - Add your title companies’ and lenders’ domains to your custom list
Lookalikes of those domains get the strongest banner. Add the wire-instructions detector and the SSN and account-number identifiers. - Test mode through one closing cycle
See what would have been flagged and encrypted; then enforce.
What the 15-agent brokerage pays
- Gateway, 15 seats
- $90 per month, billed yearly
- Gateway + 6-year archive and legal hold
- $135 per month ($9 per seat)
- Hosted, 15 seats
- $180 per month with shared mailboxes and device policies
Property-management teams with per-property archives usually take the archive tier. Organization minimum $49.
Questions brokers ask
Will PXCMail stop a buyer from wiring to the wrong account?
Not by itself. It flags the message that tries to redirect the wire and tells the agent to call the title office. The phone call is the control; the banner makes sure it happens.
Our agents are independent contractors on Gmail. Does it work?
Yes. Their mail routes through the brokerage policy without changing addresses; the broker sees exceptions, not their inbox.
How do buyers and sellers open encrypted messages?
With a one-time code by SMS or email, no account, no app. They can reply securely. Links expire at 30 days by default and can be revoked.
Does it work with dotloop, Skyslope or Follow Up Boss?
If they send through your Google or Microsoft account, yes, with no integration work. If they send from their own servers, those messages are outside the policy.
What is on the roadmap?
URL detonation, the Outlook and Gmail add-ins and SOC 2 Type I are ROADMAP. The lookalike-domain banner, encryption and archive are live.