5 Audit Ready Controls to Stop Earnest Money Fraud in U.S. Brokerages

Broker verifying earnest money instructions by phone

A brokerage that prevents earnest money fraud has five controls in place: a verify-then-trust transaction workflow with dual-channel confirmation, disciplined trust accounting with monthly reconciliations, multi-factor authentication and email authentication across every system touching escrow data, a documented incident response plan, and signed client disclosures. These controls exist because brokers carry fiduciary responsibility for client funds and need auditable evidence they met it, which is where a platform like BrokerPay fits into the picture.

TL;DR:

  • Multi-factor authentication and email domain protections are essential because most earnest money fraud occurs through compromised email accounts.
  • Maintaining a detailed, transaction-specific trust ledger with monthly reconciliations helps detect discrepancies and prevent trust account shortages.
  • Implementing a verify-then-trust protocol with pre-verified contacts and dual-channel confirmation reduces reliance on email alone for wiring instructions.
  • Rapidly reporting suspicious transfers within the first hour to banks and authorities significantly improves funds recovery chances.
  • Using a platform like BrokerPay facilitates compliance by automating approval workflows and audit logs for brokerage-controlled transactions, reducing fraud risks.
Brokerpay
Keep Commission Payments Compliant
BrokerPay tracks, documents, and processes agent splits, referral fees, and co-op commissions without Venmo or Zelle workarounds.

Table of Contents

Core technical and email security controls

Business email compromise is the most common way earnest money gets diverted, which makes email security the first control worth fixing. A compromised or spoofed inbox lets a scammer insert fraudulent wiring instructions into an otherwise legitimate closing thread, and the buyer or title company often has no reason to doubt it.

The Federal Trade Commission (FTC) recommends multi-factor authentication for any system that stores sensitive financial or transaction data, along with regular offline backups to limit damage from ransomware or account compromise. Brokerages should treat this as a floor, not a ceiling.

From 2019 through 2023, many victims reported significant losses tied to real estate wire fraud, according to an FTC-cited figure. That scale is why email authentication and MFA belong in a brokerage’s baseline budget, not a future upgrade list.

Operational trust accounting and reconciliation

Technical controls stop the phishing email. Accounting controls catch the problem if funds still move somewhere they shouldn’t. Every earnest money deposit needs its own sub-ledger, tied to the specific transaction, showing the date received, the source, and the disbursement destination.

That sub-ledger reconciles to the master trust account every month, and any mismatch gets investigated before the next cycle closes. Disbursing against a deposit that hasn’t fully cleared is one of the more common ways brokerages end up with a trust account shortage. It creates a gap between what the ledger says should be there and what the bank actually holds, and that gap is exactly what an auditor looks for first.

  1. Open a dedicated sub-ledger for every transaction the moment earnest money is received.
  2. Confirm the deposit has cleared before authorizing any disbursement against it.
  3. Reconcile every sub-ledger to the master trust account on a monthly schedule, signed off by a supervising broker.
  4. Retain deposit slips, wire confirmations, disbursement authorizations, and reconciliation reports for the retention period your state requires.
  5. Flag and document any variance immediately, rather than letting it carry forward to the next reconciliation.

State-level frameworks like North Carolina’s trust accounting rules require this kind of transaction-level ledger, and a missed monthly reconciliation is a frequent trigger for audits and disciplinary action. When a broker takes physical possession of funds or takes on responsibility for delivering them to escrow, that handoff needs its own documented ledger too. Auditors will ask for it by name.

Building a verify-then-trust transaction workflow

Most earnest money fraud succeeds because someone trusted an email instead of confirming it through a second channel. The National Association of REALTORS® (NAR) recommends a “verify, then trust” protocol built around pre-verified contacts and phone callbacks, and it works because it removes email as the sole authority for moving money.

Set this up at transaction opening, not at the point instructions arrive:

Never authorize a wire change based on email alone, even when the message looks legitimate and references real transaction details. Scammers who compromise an inbox have access to that context too.

Pro Tip: Call the pre-verified number you recorded at transaction opening, never a number pulled from the email that contains the new instructions.

Incident response when a transfer looks misdirected

Speed determines whether funds are recoverable, and the first hour matters more than any other part of the response.

  1. Call your bank and the receiving bank immediately, request a wire recall or account freeze, and provide full transaction details.
  2. File a complaint with the Internet Crime Complaint Center (IC3) and notify your local Federal Bureau of Investigation (FBI) field office.
  3. Preserve every email, call log, and receipt tied to the transaction before anything gets deleted or overwritten.
  4. Notify your errors and omissions insurer and any escrow or title partners who need to activate their own recovery processes.

Rapid reporting to banks and IC3 substantially increases recovery odds while funds are still moving through domestic banking rails, according to IC3 and FBI reporting on the FFKC and Recovery Asset Team processes. Waiting even a day can move funds beyond reach.

Building an implementation checklist for compliance teams

Turning these controls into policy means assigning owners and deadlines, not just writing a memo. Start with the items that close the biggest gaps first.

Task Owner Frequency
Wire fraud disclosure signed Listing/buyer agent Every transaction
MFA enrollment audit IT/compliance Quarterly
Trust sub-ledger reconciliation Supervising broker Monthly
Phishing simulation Compliance/training lead Quarterly
Vendor security questionnaire Compliance Annually per vendor

Run phishing simulations on a quarterly cadence and document completion for every staff member, since that record is exactly what a regulator or E&O carrier asks for after an incident.

How BrokerPay supports these controls in practice

A compliant payment platform routes commission, referral, and co-op payments through brokerage-controlled accounts with built-in approval workflows and audit logs, which mirrors the segregation of duties and documentation this playbook calls for. It replaces ad hoc transfers between agents with a system that generates the paper trail auditors and regulators expect to see.

— Wes

Background checks and verification of all parties involved

Verifying who is actually on the other side of a transaction closes a gap that email authentication and reconciliation don’t cover. A buyer, seller, or their representative can be entirely fictitious, or a legitimate party’s identity can be spoofed by someone posing as their attorney or closing agent late in the process.

Brokerages should confirm the identity of principal parties against government-issued identification at or before contract signing, and independently verify any newly introduced representative, such as a power-of-attorney holder or a substitute closing agent, through a source outside the transaction thread. A phone call to a title company’s published main line, rather than a number provided in an email, is a simple way to confirm that a contact is who they claim to be.

Remote-only sellers and buyers who insist on all-digital communication with no live verification deserve extra scrutiny, particularly when combined with an unusually fast closing timeline. Neither trait alone proves fraud, but together they are a recognized pattern worth treating as a flag under the two-flag rule described earlier. Document the verification steps taken for each party in the transaction file, since that record demonstrates the brokerage exercised reasonable diligence if a dispute or claim arises later.

Background checks and verification of all parties involved — overview diagram

The role of escrow accounts and third-party custodians

Routing earnest money through a licensed escrow or title company account, rather than holding it directly in a brokerage’s own trust account, adds a layer of separation between the funds and any single point of failure. Most residential transactions already work this way, with the brokerage collecting the deposit briefly before transferring it to the closing agent or escrow holder named in the contract.

That handoff needs the same documentation discipline as everything else. The brokerage should record exactly when funds were received, when they were transferred to the third-party custodian, and confirmation that the custodian received them, and this three-point record should live in the transaction file. Regulatory guidance is consistent on one point: brokers retain fiduciary responsibility for trust funds even after a third party takes custody, so the transfer itself has to be documented, not just assumed.

Three-point earnest money custody record

Selecting a custodian is also a due diligence exercise. A brokerage should confirm that any title or escrow partner carries fidelity coverage and maintains its own wire verification procedures, since a weak link at the custodian undoes the brokerage’s own controls. Some operational service providers, such as the transaction guarantees offered by firms like BLDG Realty, illustrate how partners in the transaction chain structure protections around funds and timelines, though every brokerage should evaluate its own custodians on the specifics of their wire and verification practices rather than assuming a guarantee elsewhere in the industry.

Technology for automated fraud detection and monitoring

Manual reconciliation catches problems after the fact. Automated monitoring is what catches an anomaly while a transfer is still pending. A system that flags an unusual disbursement pattern, a mismatched account number, or a change to previously confirmed wiring details before the transfer executes gives a compliance officer a chance to intervene.

Look for transaction management or payment software that logs every change to payment instructions with a timestamp and user ID, rather than allowing silent edits. That audit trail is valuable on its own, since it lets a compliance team reconstruct exactly what happened and when if a dispute arises, and it’s a meaningfully different capability than a spreadsheet that only shows the final number.

Automated alerts for authentication failures, unusual login locations, or repeated failed access attempts on email and transaction systems extend the same principle to the technical side covered earlier. None of this replaces the human verification step of a phone callback to a pre-verified contact. It reduces the odds that a compromised system goes unnoticed long enough for a fraudulent instruction to slip through.

Setting policies for handling suspicious activity

A control only works if staff know what to do the moment something looks wrong, and that means writing the escalation path down before an incident happens rather than improvising during one. A written policy should name who gets notified first, what actions are authorized without further approval, and what requires a supervising broker’s signoff.

Define suspicious activity concretely rather than leaving it to judgment calls under pressure: a last-minute change to wiring instructions, a request to expedite a closing outside normal timelines, a party who avoids phone or video contact, or an email that doesn’t match previous correspondence in tone or formatting. Any one of these should trigger a pause on disbursement until the verification steps outlined earlier are completed.

Give every agent and staff member a single point of contact for reporting something that looks off, and make it clear that flagging a false alarm carries no penalty. A policy that quietly punishes over-caution trains people to stay quiet, which is the opposite of what a brokerage needs when minutes matter. Log every escalation, even the ones that turn out to be nothing, since that log itself becomes evidence of an active, working compliance program.

Documentation standards that hold up under audit

Every earnest money transaction should leave a paper trail detailed enough that someone who wasn’t involved can reconstruct exactly what happened, in what order, without asking anyone a question. That standard, not a vague sense of “keeping good records,” is what an auditor or regulator is actually checking against.

At minimum, the transaction file should include the signed wire fraud disclosure, the pre-verified contact record, deposit and disbursement confirmations, the monthly reconciliation report covering that transaction’s window, and a log of any escalations or flags raised under the two-flag rule. Retention periods are set at the state level, so confirm your requirement rather than assuming a national standard applies.

Index files consistently, whether by transaction number, closing date, or agent, so a compliance officer can pull a complete file on request without a manual search. When a regulator or insurer asks for evidence that a brokerage followed its own fiduciary duty on a specific file, the answer should be a folder, not a reconstruction project.

Prioritizing controls over tools

The brokerages that actually stop earnest money fraud treat “verify, then trust” as a culture, not a software feature, and hold brokers accountable for it the same way they’d hold them accountable for a missed disclosure. Start with your highest-risk transaction types, automate the audit trail wherever you can, and run a tabletop exercise before you need the real one. Keep reviewing vendor security, because the weakest link in your process is rarely the one you last audited.

— Wes

Next steps with BrokerPay

Most of the controls in this playbook come down to one thing: getting commission and transaction money out of email threads and personal payment apps and into a system that documents every step on its own. BrokerPay was built for exactly that job, routing agent splits, referral fees, and co-op commissions through brokerage-controlled accounts with approval workflows and audit logs already attached, so the paper trail your compliance team needs is a byproduct of normal operation rather than a separate task.

Brokerpay

Explore Starter, Growth, and Enterprise plans to find the fit for your brokerage’s agent count, or review how a real estate payment gateway works and eight compliant co-op payment workflow examples for a closer look at the mechanics.

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

Sources

FAQ

What controls does a brokerage need to prevent earnest money fraud?

A brokerage needs a verify-then-trust transaction workflow, monthly trust account reconciliation, multi-factor authentication on email and transaction systems, a written incident response plan, and signed client disclosures. These controls work together rather than individually, since a gap in one usually surfaces as a failure in another.

What records show we followed our fiduciary duty on a transaction?

A complete transaction file that includes the signed wire fraud disclosure, the pre-verified contact record, deposit and disbursement confirmations, and that transaction’s reconciliation report. If a dispute arises, this file is what demonstrates the brokerage exercised reasonable diligence.

How quickly should we report a suspected misdirected wire?

Immediately. Contact both the sending and receiving banks to request a recall, then file a complaint with IC3 and notify your local FBI field office, since recovery odds drop the longer funds sit in the receiving account.

Does BrokerPay replace our escrow or title company?

No. BrokerPay handles brokerage-side payments such as commission splits, referral fees, and co-op payments through brokerage-controlled accounts with approval workflows and audit logs. It does not hold or disburse client earnest money deposits, which remain with your licensed escrow or title custodian.

What is the “two-flag” rule mentioned in wire fraud guidance?

It’s a practical trigger for extra verification: when two risk indicators appear on the same file, such as a remote-only party and a last-minute change to wiring instructions, the transaction requires mandatory secondary verification before any disbursement, a pattern described in NAR’s guidance on evolving wire fraud tactics.