Zero-trust access and BEC-proof email for a Los Angeles real-estate group

Real-estate transactions combine large sums, tight deadlines and many outside parties, which is exactly what business email compromise exploits. A single closing involves buyers, sellers, brokers, lenders, title agents and attorneys, most of them outside the group's control and some of them strangers until the deal begins. Wire instructions travel between them by email, and a fraudster needs to be believed by only one person at one moment. The group's own people were also spread across offices, sales centers and job sites, so the question was less how to build a stronger perimeter than how to make every sign-in and every payment instruction prove itself, wherever it came from.

The defences are a mix of technology and procedure. On the technology side, we moved the group's domain to enforced DMARC (p=reject), with SPF and DKIM aligned for every legitimate sender, so mail pretending to be from the company is rejected. MTA-STS forces encrypted delivery between mail servers, and TLS reporting shows where it fails. For access, we replaced the broad VPN with identity-aware zero-trust access: each application checks who the user is and the health of their device on every connection. Staff who approve payments use phishing-resistant passkeys or hardware security keys, which cannot be tricked by a fake login page. The few systems that cannot sit behind the proxy are reached through WireGuard with per-user keys.

The rollout took ten weeks and ran in the order of risk. DMARC moved from monitoring to quarantine to reject over six weeks, after reports showed every legitimate sender, including a forgotten marketing platform, was aligned. Passkeys came next, starting with the finance team and executives. Applications moved behind the access proxy one at a time, the VPN was narrowed to named systems, and finally closed. Laptops and phones were enrolled in device management with disk encryption before they received access.

We tested the way an attacker works. A controlled phishing exercise sent look-alike-domain mail and fake payment-change requests to staff; the mail gateway caught most, and the rest were reported by the staff who saw them. A fake login page was shown to users with passkeys to confirm it could not capture a usable credential. The wire-change procedure, a call to a number already on file, was rehearsed with a mock closing so that staff knew they were allowed to delay a payment to verify it.

Inbound mail is analyzed for look-alike domains, first-time senders and reply-to tricks, and the managed service watches mail and sign-in logs around the clock.