Who is holding your closing documents between contract and close?
Somewhere between contract and close, an email arrives. Create an account on a platform you have never heard of. Upload your driver's license. Confirm wire instructions. Sign something. You did not choose this vendor. The title company did. You cannot opt out and still close.
Some of these platforms are genuinely excellent. A few are built specifically to stop wire fraud and do it well. But the economics are worth understanding: the vendor's customer is the title company, not you. You are the data passing through.
I run a security consulting practice alongside this one, which is the only reason I know to ask these four questions. Does the vendor publish a trust page? Do they hold a SOC 2 — Type I or Type II — and will they show the report? What happens to your documents after closing: what is the retention period, and is there deletion? Who do you call at two in the morning if something goes wrong — is there a named incident response contact?
A SOC 2 report is a floor, not a ceiling. It says a firm was audited against controls it selected. It does not say those controls are the right ones for holding a stranger's driver's license and bank details.
One rule overrides everything above. No legitimate party ever sends or changes wire instructions by email. If instructions arrive or change by email, stop. Call the title company at a number you looked up yourself — not one in the email. Confirm the account verbally, digit by digit. Then send.
The scale here is not theoretical. The FBI's Internet Crime Complaint Center recorded 21,489 business email compromise complaints in 2023, with adjusted losses over $2.9 billion. In a separate advisory, the FBI reported that from 2020 to 2022, victim reports of these scams with a real estate nexus rose 27 percent and victim losses rose 72 percent. Closing wire theft lives inside that category.
Most agents have never asked a title company any of these questions. I would include myself until a few years ago. If your agent cannot tell you who is holding your data and what their security posture is, that is not a gap in the vendor's disclosure. That is information about your agent.
The vendor's customer is the title company, not you. You are the data passing through — and in that equation, your security is a cost center, not a feature.
Sources
General observations drawn from our real estate and security consulting experience. Not legal, financial, or cybersecurity advice. Vendor certifications and security postures change — verify them directly with the vendor and your title company.