Checklist / CIS Controls v8.1

Protecting Client Funds and Closing Documents: A Checklist for Title and Escrow Firms

Harris Ejiofor, CISM – CyberShield Advisory

Title and escrow firms hold client money and some of the most sensitive documents people ever sign. This checklist covers the controls that protect both.

Why title and escrow firms are a target

A title or escrow firm moves large sums on a predictable schedule and holds documents full of personal and financial details: identification, bank account numbers, loan payoffs and signed deeds. Criminals know that one convincing email at the right moment can redirect a wire. Mark each item yes, no or not sure, and treat not sure as no.

Money movement

Every client receives a written warning at the start of the file that you will never change wiring instructions by email or text.
Any change to payment instructions is confirmed by phone using a number from the original file, never one in the message.
Outgoing wires above a set amount need a second person to approve them.
Your bank's fraud contact number is written down, and staff know to call it immediately if a wire looks wrong.

Email and accounts

Every account requires a second step to sign in, starting with anyone who handles funds or closing documents.
Alerts tell someone when a new forwarding or inbox rule appears.
Former staff and former vendors lose access on their last day.
Shared logins to title, escrow or banking systems are replaced with individual accounts.

Documents

Closing packages and identification are sent through an encrypted portal or encrypted email, not as plain attachments.
Files are shared with named people, not with links anyone can open.
Laptops and phones that hold client documents are encrypted and can be wiped if lost.
You know how long you keep closing files and who can see them.

Readiness

Staff practise spotting fake payment requests at least twice a year.
A short written plan says who to call, in what order, if a wire goes to the wrong account.
Backups of your title and escrow data are tested by actually restoring them.

What to do with your answers

Start with the money-movement items. They stop the most damaging loss and cost little: a written warning, a phone call and a second approver. Then close the email gaps, because most wire fraud begins with a compromised mailbox.

Take the next step

Our free Microsoft 365 security assessment asks five quick questions about sign-in, email, sharing, devices and backup, and shows where to start. It is a short check, not a full review of your settings.