Buying or selling a home generates a stack of the most sensitive paperwork most people ever handle: loan applications, bank statements, tax returns, identity documents, deeds and wiring instructions. In 2019, a security researcher reported that a major title insurer, First American Financial, had a website flaw that allowed anyone to view such documents by changing a number in a web address. Reports described hundreds of millions of records. This article reviews what is publicly known, what regulators later did, why real estate data is such an attractive target and how buyers, sellers and homeowners can protect themselves. It complements our guide on how scammers target homeowners.
1. What was reported
According to reporting at the time, documents related to real estate transactions were accessible through links that followed a predictable pattern. By altering a sequence number, a person could move from one record to the next without logging in. The flaw was described as the kind of weakness that automated tools can exploit at scale. Public accounts put the number of exposed records at roughly 885 million, although how many were actually viewed by unauthorized people was not fully known publicly. The company said it took steps to fix the issue after it was reported.
In later years, regulators announced actions. The U.S. Securities and Exchange Commission announced a settlement in 2021 concerning the company’s disclosure controls related to the vulnerability, and New York’s financial regulator announced a penalty in 2023. For authoritative details, consult the agencies’ own releases, including the SEC site. This article summarizes high-level public reporting rather than adding specifics beyond it.
2. Why real estate data is so sensitive
A typical file can include:
| Document | Information |
|---|---|
| Loan application | Income, employment, assets, debts |
| Bank and tax statements | Account numbers, balances, tax details |
| Identification | Government ID numbers, driver’s license images |
| Deeds and title records | Names, addresses, legal descriptions |
| Wire instructions | Account and routing numbers |
| Insurance and escrow documents | Policy numbers, payment details |
This is a complete identity kit. It also includes the financial details needed to commit closing fraud, in which criminals impersonate a title company or agent and redirect funds. Our article on the risks of old documents and old friends explores why paperwork lingers long after a transaction.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
3. The wider lesson: documents live in many places
A real estate transaction involves many parties: agents, lenders, title and escrow companies, appraisers, inspectors, attorneys and sometimes document-sharing platforms. Each holds copies. Even if your own practices are careful, the weakest link determines the exposure. The same pattern applies to health care, employment and education records. The incident also illustrates a recurring vendor-risk problem, discussed in our piece on the InfoTrax case.
4. How closing fraud works
Closing or wire fraud typically unfolds in a few steps.
- A criminal obtains details about an upcoming transaction through a breach, an email compromise or public information.
- They impersonate an agent, lender or title company, often with a lookalike email address.
- They send new wiring instructions shortly before closing.
- The buyer wires funds to the fraudster’s account.
- The money is moved quickly, making recovery difficult.
The FBI’s Internet Crime Complaint Center logs business email compromise and real estate fraud among the major categories of reported losses (ic3.gov). If you suspect a fraudulent wire, contact your bank immediately and report to the FBI.
5. How to protect yourself in a transaction
Verify every wiring instruction by phone
Call the title or escrow company using a number you found independently, not in the email that contains the instructions. Confirm account details aloud before sending funds. Treat any last-minute change as suspicious.
Use secure channels for documents
Ask how your documents will be shared and stored. Prefer secure portals over email attachments, and avoid sending images of identification over unsecured messages.
Share only what is required
Provide what lenders and title companies need, and ask about retention. Request deletion of copies when the transaction ends, where practicable.
Freeze your credit
A freeze limits new-account fraud if your identity data is exposed. When a lender needs to check your credit, lift the freeze temporarily. See what a credit freeze is and the FTC’s guidance.
Secure your email
Closing fraud often begins with email compromise. Use unique passwords and two-factor authentication on your accounts, and encourage your agent and attorney to do the same.
Monitor property records
Sign up for county alerts if available, and check for unexpected documents recorded against your property.
Watch for scams after closing
New owners attract mail and calls. Verify before paying invoices, warranties or offers.
6. If you think your data was exposed
- Freeze your credit.
- Review bank and loan statements.
- Change passwords and enable two-factor authentication.
- Monitor credit reports and tax filings.
- Report identity theft at IdentityTheft.gov and scams at ReportFraud.ftc.gov.
- Contact your lender or title company if you suspect transaction fraud.
Our guides on how to report identity theft and how long data leaks can affect you explain what to expect.
7. Reduce what criminals can learn from public sources
Real estate fraud works best when criminals can complement stolen documents with public information about owners. People-search sites publish names, addresses, phone numbers and relatives. Property records are often public by law, but the aggregated profiles on broker sites are optional. Remove them through official opt-outs such as Spokeo, PeopleConnect and That’s Them. California residents can use DROP. See our full removal guide.
8. What good practice by companies looks like
Organizations that hold sensitive documents should use authentication for every record, avoid predictable links, limit retention, monitor for unusual access, test applications for weaknesses and have clear processes for reporting flaws. Customers can ask how a company protects documents. Cost estimates for failures are discussed in what data breaches cost, and the typical corporate response is described in an inefficient cycle.
9. Timeline: protecting a home transaction
| When | Action |
|---|---|
| Before listing or offer | Secure email, freeze credit, review public listings |
| Before closing | Verify wiring instructions by phone, limit documents |
| Closing day | Confirm account details again |
| After closing | Request deletion of unnecessary copies, watch for scams |
| Quarterly | Check credit and property records |
10. What to ask your title company and lender
You can reduce the risk in a transaction by asking a few direct questions before you send any document. Ask the title or escrow company how they receive and store sensitive files, whether they use a secure portal rather than email, and who within the firm can see your documents. Ask how they confirm wiring instructions, and insist on verifying any change by phone using a number you already know. Ask how long they retain your records and how they dispose of them. A reputable firm answers these questions plainly, and a vague answer is useful information in itself.
Keep your own copies organized. Store closing documents in an encrypted folder, avoid forwarding them through personal email accounts, and shred paper copies you no longer need. For consumer guidance on wire and real estate fraud, the FBI’s Internet Crime Complaint Center takes reports and publishes warnings, and the Consumer Financial Protection Bureau explains your rights in the mortgage process.
11. A short checklist for the week of closing
In the final week, confirm the wiring instructions by phone, check that every email from the title company comes from the address you were given, avoid sending identification through ordinary email, and keep a written log of who asked for what. Anything unusual, such as a sudden change of bank details or a request to move quickly, deserves a pause and a phone call to a number you already trust.
12. Three scenarios and what to do
Scenario 1: An email changes wiring details. Call a known number and do not send funds until verified.
Scenario 2: A lender asks for documents via text. Ask for a secure portal.
Scenario 3: Your closing paperwork appears in a leak. Freeze credit and monitor accounts.
13. Myths and facts
| Myth | Fact |
|---|---|
| Title companies are immune | They hold rich targets |
| Only the buyer is at risk | Sellers and lenders are too |
| A signed contract means safe funds | Fraud can redirect them |
| Email is secure enough for IDs | Prefer secure portals |
| Leaks only matter at closing | Risk continues |
14. Common mistakes
- Trusting emailed wiring changes.
- Sending ID photos by text or email.
- Not asking about retention.
- Skipping a credit freeze.
- Leaving public listings in place.
15. Questions to ask yourself
Do I know the real phone number of my title company? Who has copies of my documents? Is my email secured? Could a stranger find my address and relatives online? Start with the weakest answer.
16. How Wiperts fits
Wiperts reduces the public details that help criminals impersonate you or your agents. It scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. Start with the free diagnosis.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
17. Key takeaways
- A 2019 website flaw exposed a huge volume of real estate documents.
- Closing paperwork is a complete identity kit.
- Verify wiring instructions by phone and share fewer documents.
- Freeze credit and reduce public listings.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
18. Frequently Asked Questions
What happened with First American?
In 2019 a security researcher reported that a website flaw at First American Financial let anyone view real estate transaction documents by altering numbers in a web address. Reports described hundreds of millions of records.
What kind of documents were involved?
Real estate closing records can include names, addresses, bank account and loan information, tax documents and government ID numbers.
Did regulators act?
Yes. The SEC announced a settlement in 2021 related to disclosure controls, and a state financial regulator announced a penalty in 2023.
How can I protect myself in a real estate transaction?
Verify wiring instructions by phone using a known number, share documents only through secure channels, freeze credit and monitor accounts.
Should I assume my closing documents are safe?
Assume that sensitive documents may be stored widely among agents, lenders and title companies, so limit what you send and ask how it is protected.
What if I think my data was exposed?
Freeze credit, watch accounts, report misuse at identitytheft.gov and be alert to closing-related scams.
Sources
- SEC
- ic3.gov
- FTC’s guidance
- IdentityTheft.gov
- ReportFraud.ftc.gov
- Spokeo
- PeopleConnect
- That’s Them
- DROP
- Consumer Financial Protection Bureau
Related Reading
- How Scammers Use Online Records to Target Homeowners
- What Data Breaches Really Cost Companies and You
- An Inefficient Cycle: How Companies Respond to Data Breaches
- How Long Can Data Leaks Affect You?
- The InfoTrax Attack: What a Vendor Breach Teaches Consumers
- Digital Clutter Is a Risk: Clean Out Old Files, Accounts and Friends
- What Is a Credit Freeze? How to Place, Lift and Use It in 2026
- How to Report Identity Theft: A Step-by-Step Guide for 2026
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing