Every small business owner and every real estate professional I talk to early on says some version of the same thing when the subject of their cyber exposure comes up: "We're too small. Nobody's coming after us specifically." They're not wrong about that part. A twelve-person brokerage or a small business isn't a priority target the way a bank or a hospital system is. The better question is this: if something happens to a business your size, how bad is it, and can you actually come back from it? Eventually, somewhere, to someone in your position, it does.
Low probability can still come with high stakes. The risk is easy to ignore right up until it isn't, and by then what hurts is the reputational damage, the legal exposure, or the disruption that becomes the start of a decline you never fully recover from. The frustrating part is that all three are avoidable, with the right policies and a bit of expert help. Daunting isn't the same as impossible, and it's no excuse for doing nothing.
When "Just an HR Issue" Isn't
This is exactly the kind of thing that feels too rare to plan for — until it's sitting in your inbox. One of my earliest clients saw the value in the cyber policy work and general advisory I'd been offering from the start — it was never a question of whether it mattered. It just never felt urgent enough to act on, something to get to once whatever else was in front of them that quarter had been dealt with, even though the work itself was mine to do as a third party, not theirs. Then they called: "That stuff you've been talking about — maybe we do need some of it after all." They'd had an incident: an employee using a company device to access content that had no place on work equipment. In this case, what turned up was legal, if embarrassing, and there was no criminal exposure for the business. But the near-miss is the point, not the outcome. If that content had crossed into genuinely illegal territory, and there was no acceptable use policy and no way to trace activity to a specific login or device, the business would have had no way to show it wasn't complicit, or at least negligent. No attribution means no line between "one employee did something terrible" and "the company enabled it" — and that's the gap that turns an HR problem into a legal one.
This is a documented category of exposure. In Doe v. XYC Corp. (2005), a New Jersey appeals court held that an employer that knew an employee was using a work computer to view pornography had a duty to investigate. That is one state's court, and it does not bind courts elsewhere. A business with no policy and no logging has a much harder time showing it exercised reasonable care if that duty is ever tested. I'm not a lawyer and this isn't legal advice; talk to one if it's a live concern for you. The practical takeaway holds regardless of the legal specifics: a business with a clear policy, a way to identify who did what, and a defined response plan is in an entirely different position than one with none of that, if anyone ever comes asking.
The Wire That Vanishes
The pattern in real estate is different, but it's the same bet: too rare to plan for, until it's your closing. One version starts with a domain registered to look almost identical to the brokerage's, a single swapped letter or an extra hyphen, easy to miss on a phone screen. From that address, a highly convincing, sometimes AI-written email goes out, timed to exactly the point in the transaction when a buyer is expecting closing documents or a wire request. It only has to get past a buyer who skips checking the sender address in the few seconds it takes to click through and send the money.
The amounts involved are not small. The FBI's Internet Crime Complaint Center logged $3.05 billion in business email compromise losses in 2025, across about 24,800 complaints, an average of roughly $123,000 per complaint. Real estate closings are a recurring target, because a wire transfer is expected, timed, and often one of the largest sums a client will ever move at once.
$3.05 billion lost to business email compromise in 2025, an average of $123,000 per complaint. (FBI Internet Crime Complaint Center)
The FBI's 2025 report describes two closings. In one, a Missouri victim closing on a property received wire instructions for over $1.3 million, sent to a fraudulent account by a compromised email that appeared to come from the title company. In the other, a couple closing on a home wired more than $449,000 after an email impersonating their attorneys. In both, the FBI asked the receiving banks to freeze the fraudulent accounts, and in the second the recipient bank reported the full amount still on hold. Those are 2025 cases, and business email compromise losses rose from $2.77 billion in 2024 to $3.05 billion in 2025.
The money is the first cost. Even when a brokerage is never found liable, a determined buyer with the resources to sue can put a business through months of legal defense before the case is decided either way, and title companies and real estate professionals are being sued over exactly this. CertifID, a wire fraud prevention company, reported in its 2024 Sued for Wire Fraud report that wire fraud lawsuits against title companies rose 127% in 2023 from the year before, and said the average settlement exceeded $450,000. Its review of more than 100 wire fraud cases describes courts letting negligence and fiduciary duty claims proceed against a title company that had sent unencrypted wire instructions despite earlier security breaches. And there is no guarantee an E&O policy pays out if it comes to that. In Helms v. Hanover Insurance (D. Ariz., 2021), a couple represented by a realtor lost nearly $120,000 in closing funds to fraudsters impersonating the title company, and the realtor's insurer declined to defend her against the couple's lawsuit. The court held that exclusions in her professional liability policy applied. There's a cost that doesn't show up in any of those numbers, too: in a business that runs on referrals, a client's story about losing their closing funds spreads faster than any lawsuit resolves, liable or not.
The fix is staff who've been trained to check the sender's actual address rather than the name displayed on it, and clients who've been told clearly, early, and more than once, exactly what a legitimate request from your office will and won't look like. The FBI's own advice is to use a second channel to verify any change to account information. If a client knows from day one that wiring instructions will never change over email, and that any request to do so gets a phone call to a known number before a dollar moves, the scam has nowhere to land, whether the closing's in Greenwich, Westchester, or midtown Manhattan.
The Expensive Kind of Nothing
Both of these are avoidable with a written policy, some staff training, and clear communication with the people relying on you, without a six-figure enterprise security budget. The businesses that get hurt by either of these have often decided the cost of doing something was higher than the cost of doing nothing, right up until doing nothing turned out to be the expensive option.
A Security Posture & Risk Review is where that stops being a good intention. We take a practical look at your current security and explain, in plain English, what's working, what isn't, and what needs attention first.
If either of these sounds close to your business, reach out to SuperSimpleCyber and we'll talk through where you stand, so you know what you're dealing with before something happens instead of after.
Robin is the founder of SuperSimpleCyber, a cybersecurity consultancy for households and small businesses in Westchester, Fairfield County, and Manhattan.