04/27/2026
𝐈𝐟 𝐲𝐨𝐮 𝐰𝐨𝐫𝐤 𝐢𝐧 𝐭𝐡𝐞 𝐭𝐢𝐭𝐥𝐞 𝐢𝐧𝐝𝐮𝐬𝐭𝐫𝐲 𝐨𝐫 𝐬𝐮𝐩𝐩𝐨𝐫𝐭 𝐭𝐢𝐭𝐥𝐞 𝐜𝐨𝐦𝐩𝐚𝐧𝐢𝐞𝐬, 𝐩𝐥𝐞𝐚𝐬𝐞 𝐬𝐡𝐚𝐫𝐞 𝐭𝐡𝐢𝐬!
This past week we've seen a 𝐬𝐡𝐚𝐫𝐩 𝐢𝐧𝐜𝐫𝐞𝐚𝐬𝐞 𝐢𝐧 𝐩𝐡𝐢𝐬𝐡𝐢𝐧𝐠 𝐚𝐭𝐭𝐚𝐜𝐤𝐬 𝐭𝐚𝐫𝐠𝐞𝐭𝐢𝐧𝐠 𝐭𝐢𝐭𝐥𝐞 𝐜𝐨𝐦𝐩𝐚𝐧𝐢𝐞𝐬. Not random. Not one-offs. 𝐀𝐮𝐭𝐨𝐦𝐚𝐭𝐞𝐝 systems scanning domains, finding gaps, and launching attacks 𝐰𝐢𝐭𝐡𝐢𝐧 𝐦𝐢𝐧𝐮𝐭𝐞𝐬.
Two gaps they're exploiting:
𝟏. 𝐃𝐌𝐀𝐑𝐂 𝐬𝐞𝐭 𝐭𝐨 "𝐧𝐨𝐧𝐞" 𝐨𝐧 𝐭𝐡𝐞 𝐩𝐫𝐢𝐦𝐚𝐫𝐲 𝐝𝐨𝐦𝐚𝐢𝐧.
DMARC is the policy that tells the internet what to do when someone fakes an email from your domain. A lot of title companies have it set to "none," which means "𝐥𝐞𝐭 𝐢𝐭 𝐭𝐡𝐫𝐨𝐮𝐠𝐡 𝐚𝐧𝐲𝐰𝐚𝐲." Sometimes that's intentional because title production software sends email in a way that doesn't play nice with stricter settings. But sitting at "none" means an attacker can 𝐬𝐞𝐧𝐝 𝐞𝐦𝐚𝐢𝐥𝐬 𝐭𝐡𝐚𝐭 𝐥𝐨𝐨𝐤 𝐥𝐢𝐤𝐞 𝐭𝐡𝐞𝐲 𝐜𝐚𝐦𝐞 𝐟𝐫𝐨𝐦 𝐲𝐨𝐮𝐫 𝐨𝐰𝐧 𝐩𝐞𝐨𝐩𝐥𝐞, 𝐭𝐨 𝐲𝐨𝐮𝐫 𝐨𝐰𝐧 𝐩𝐞𝐨𝐩𝐥𝐞.
That's how account compromise starts. And 𝐚𝐜𝐜𝐨𝐮𝐧𝐭 𝐜𝐨𝐦𝐩𝐫𝐨𝐦𝐢𝐬𝐞 𝐢𝐬 𝐡𝐨𝐰 𝐰𝐢𝐫𝐞 𝐟𝐫𝐚𝐮𝐝 𝐚𝐭𝐭𝐞𝐦𝐩𝐭𝐬 𝐡𝐚𝐩𝐩𝐞𝐧.
𝟐. 𝐍𝐨 𝐃𝐌𝐀𝐑𝐂 𝐫𝐞𝐜𝐨𝐫𝐝 𝐨𝐧 𝐲𝐨𝐮𝐫 .𝐨𝐧𝐦𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭.𝐜𝐨𝐦 𝐝𝐨𝐦𝐚𝐢𝐧.
Every company using Microsoft 365 has a secondary domain that ends in .onmicrosoft.com. 𝐌𝐨𝐬𝐭 𝐩𝐞𝐨𝐩𝐥𝐞 𝐝𝐨𝐧'𝐭 𝐤𝐧𝐨𝐰 𝐢𝐭 𝐞𝐱𝐢𝐬𝐭𝐬. Almost nobody has a DMARC record on it. Attackers are actively exploiting this across title agents right now.
Microsoft now lets you add a DMARC record directly to that domain in the admin center. 𝐎𝐧𝐞 𝐫𝐞𝐜𝐨𝐫𝐝, 𝐬𝐞𝐭 𝐭𝐨 "𝐫𝐞𝐣𝐞𝐜𝐭," 𝐚𝐧𝐝 𝐭𝐡𝐚𝐭 𝐝𝐨𝐨𝐫 𝐜𝐥𝐨𝐬𝐞𝐬. 𝐓𝐚𝐤𝐞𝐬 𝐦𝐢𝐧𝐮𝐭𝐞𝐬.
𝐍𝐞𝐢𝐭𝐡𝐞𝐫 𝐟𝐢𝐱 𝐜𝐨𝐬𝐭𝐬 𝐚 𝐝𝐢𝐦𝐞. Both are the kind of thing that sits on a to-do list until something bad happens.
If you handle wire instructions, escrow funds, or closing documents, 𝐭𝐡𝐢𝐬 𝐢𝐬 𝐧𝐨𝐭 𝐚 𝐬𝐨𝐦𝐞𝐝𝐚𝐲 𝐩𝐫𝐨𝐛𝐥𝐞𝐦. 𝐓𝐡𝐢𝐬 𝐢𝐬 𝐚 𝐭𝐡𝐢𝐬 𝐰𝐞𝐞𝐤 𝐩𝐫𝐨𝐛𝐥𝐞𝐦.
Happy to share the technical breakdown if you want to hand this to your IT team.
American Land Title Association
Tennessee Land Title Association Fidelity National Financial Old Republic Title CATIC Westcor Land Title Insurance Company® First American Stewart Title Alliant National Title Insurance Company WFG National Title Insurance Company Lighthouse Title Insurance Company CertifID
