Most people don't think of their email account as particularly valuable. There probably isn't much in there that a criminal could sell, and nobody is going to fence your collection of airline confirmations and Home Depot receipts.

During a real estate transaction, though, your inbox can become a pretty useful collection of information.

It may contain conversations with your real estate broker, lender, title company and insurance agent. There may be discussions about your closing date, financing, inspection issues and how much money you're bringing to closing. Someone reading those conversations doesn't have to guess what's happening. You're giving them the script.

That's one reason protecting your email account matters when you're buying or selling a house.

A Criminal Doesn't Necessarily Need to Hack the Title Company

When people hear about real estate wire fraud, it's easy to picture someone breaking into a title company's computer system.

That's certainly one possibility, but it isn't the only one.

The FBI describes business email compromise as a scheme in which criminals use email that appears to come from a legitimate source. They may spoof an address, send targeted phishing messages or gain access to a real email account. In real estate transactions, that can be used to redirect money that was supposed to go to a legitimate party.

Your personal email account can be part of that chain.

If someone gets into it, they may be able to read existing conversations and learn the names of the people you're working with. They may know when you're closing and what stage the transaction has reached. Depending on what's in your inbox, they may also find financial documents or other personal information.

Even worse, they may be able to send messages that appear to come from you.

Start With the Email Account You Actually Use

If you're preparing to buy or sell a house, this is a good time to check the security of the email account you'll use during the transaction.

You don't need to become a cybersecurity expert. A few basic controls do most of the heavy lifting.

Use a strong password that you aren't using anywhere else. Password reuse is particularly troublesome because a password exposed by one company can be tried against accounts at other companies. If remembering a different strong password for every account sounds unrealistic, that's exactly the problem password managers are designed to solve.

Then turn on multifactor authentication, sometimes called two-factor authentication or two-step verification.

Multifactor authentication means a stolen password by itself isn't enough to get into the account. The Federal Trade Commission recommends using it for sensitive accounts, including email and financial accounts.

If your provider gives you several choices, they aren't all equally strong. The FTC notes that authenticator apps are generally safer than codes sent by text or email, and physical security keys provide still stronger protection. Passkeys are another increasingly common option and can reduce your reliance on passwords altogether.

You don't need the fanciest option available to improve your security. But relying on a reused password and nothing else is setting the bar awfully low.

Be Suspicious of the Message, Not Just the Sender

A common bit of security advice is to check who sent an email.

Do that. Just don't stop there.

A message coming from a familiar address isn't proof that the person you know actually wrote it. If their account has been compromised, a criminal may be sending messages from the legitimate account.

That means the content matters too.

Be particularly cautious when a message asks you to send money, change payment information, provide a password or verification code, open an unexpected attachment, or sign in through a link you weren't expecting.

Urgency deserves attention as well. A message telling you something terrible will happen unless you act in the next ten minutes is trying to keep you from doing something scammers generally dislike: thinking.

If the request matters, you can usually take another route to verify it. Call the person using a number you already have. Open the company's app directly. Type the website address yourself rather than using the link in the email.

The FTC specifically recommends contacting a company through a phone number, email address or website you already know is legitimate when an unexpected message may be phishing.

Never Give Someone a Verification Code Just Because They Asked

Multifactor authentication works because the second factor is supposed to prove that *you* are the person logging in.

A criminal who already has your password may therefore need one more thing: the temporary verification code sent to you.

So they ask for it.

The story can vary. Someone may claim to be helping with your account, confirming your identity or fixing a problem. The important part is that you're being asked to hand over a code that was generated to protect your login.

Don't.

The FTC specifically warns against sharing verification codes with someone when you didn't initiate the contact.

Real Estate Creates a Lot of Documents Worth Protecting

Buying a home can involve bank statements, identification, loan documents, insurance information and other records that contain considerably more personal information than your average grocery-store receipt.

That doesn't mean you should refuse to provide documents legitimately needed for a transaction. It means you should pay attention to **how** you're providing them.

If your lender or another party provides a secure document portal, use it rather than casually attaching sensitive records to ordinary email. If you unexpectedly receive a new request for financial information, verify the request before sending anything.

We'll cover sending sensitive financial and identity documents during a real estate transaction separately because that deserves more than a paragraph.

Check the Recovery Options Too

There's another piece of account security that gets less attention: how you recover the account if you get locked out.

Take a look at the recovery email address and phone number associated with your email account. Make sure they're still yours and still current.

Also review the devices and active sessions associated with the account if your provider makes that information available. An old computer you recognize isn't particularly interesting. A device or location you don't recognize deserves investigation.

If your provider allows you to create backup or recovery codes for multifactor authentication, store them somewhere secure rather than leaving your only copy inside the email account they're supposed to help you recover.

This Is Useful After Closing Too

None of these precautions become obsolete when somebody hands you the keys.

Your email account will continue to be connected to financial accounts, utilities, insurance, shopping, password resets and a remarkable amount of your digital life. Securing it for a real estate transaction is really just a convenient reason to finally do something that was worth doing anyway.

You don't need perfect security. There is no such thing.

But a unique password, multifactor authentication, some skepticism about unexpected messages and a habit of verifying unusual requests independently can make you a much less convenient target.

Sometimes inconvenient is exactly what you want to be.