Real estate professionals are being warned about a growing phishing scam targeting listing inquiries sent through popular real estate platforms, according to alerts circulating across the industry and advisories from the California Department of Real Estate.

Agents report receiving messages that appear to reference legitimate property listings and often include friendly follow-up requests to schedule a Zoom call. According to reports from multiple markets, the Zoom links are malicious and designed to install malware on a device. Once installed, the software can monitor email conversations involving title companies, lenders, and clients in an attempt to intercept wiring instructions and redirect funds.

Industry professionals report seeing multiple suspicious inquiries each day. Common warning signs include repeated inquiries from the same individual across multiple listings in a short period of time, vague or generic messages, and unsolicited requests to move conversations to video calls before any direct phone contact or in-person showing.

The DRE also warned consumers and licensees about scammers impersonating licensed real estate professionals through fake social media accounts, online listings, websites, and email addresses. According to the advisory, scammers may use legitimate agents’ names, license numbers, photos, and other publicly available information to appear credible while engaging in fraudulent real estate activity, including home buying and property management scams.

The DRE advises consumers and licensees to verify identities carefully and remain cautious when communicating online. The agency noted that scammers can easily create fraudulent websites, email addresses, and business profiles designed to mimic legitimate real estate professionals and companies.

C.A.R.’s IT team has provided the following recommendations and best practices to avoid falling for a scam:

Recommended Protections

• Keep computers, phones, and tablets updated with the latest operating system and security patches
• Use reputable antivirus or endpoint security software, such as: Microsoft Defender, Malwarebytes, Bitdefender, Sophos Home, CrowdStrike Falcon or SentinelOne (for small businesses)

• Enable multi factor authentication (MFA) on email, banking, and cloud accounts
• Never approve unexpected or unsolicited MFA prompts
• Avoid clicking Zoom or Teams links from unknown contacts or unsolicited inquiries
• Never give remote access to your computer, phone, or tablet to someone you do not know
• Do not install remote access or “screen sharing/support” software unless you personally initiated the request with a trusted provider
• Always verify financial requests or wiring instructions by phone using a known, trusted number not one provided in an email or message
• Use a password manager and avoid reusing passwords across accounts
• Enable MFA and biometric authentication whenever available
• Be cautious during video calls if audio, facial expressions, timing, or movements appear unnatural, delayed, overly smooth, or simply “off” as deepfake technology continues to improve

If You Clicked a Suspicious Link or Think Your Device or Email Was Compromised

• Disconnect the device from Wi Fi or the internet immediately if it behaves suspiciously
• Run a full antivirus and malware scan
• Change passwords for email, banking, and business systems from a separate, trusted device
• Review email settings for suspicious inbox rules or forwarding addresses
• Check sent mail and recent login activity for anything unfamiliar
• Remove browser extensions, apps, or software you do not recognize
• Uninstall any remote access or screen sharing tools you did not intentionally install
• Notify anyone involved in active transactions if email access may have been compromised
• Contact your bank immediately if financial or payment information may have been exposed

Signs You May Have Been Compromised

• Emails are disappearing or marked as read without your action
• Contacts report receiving messages you did not send
• Strange login alerts or unexpected MFA notifications
• New inbox rules or forwarding addresses you did not create
• Browser redirects, pop ups, or unusual device slowness
• New browser extensions, apps, or software appearing without your knowledge
• Webcam light turning on unexpectedly
• Mouse movement or applications opening without your interaction
• Security software becoming disabled unexpectedly
• Password reset notices you did not request
• Clients questioning sudden changes to wiring or payment instructions

The DRE recommends reporting suspected fraud to the Internet Crime Complaint Center (IC3), as well as to the DRE complaint portal, local law enforcement, the California Attorney General, the Federal Trade Commission, the Federal Bureau of Investigation, and the Consumer Financial Protection Bureau.

C.A.R. is also offering a Cybercrime & Transaction Fraud Certification course designed to help members identify scams, prevent fraud, and better protect clients during transactions. The four-hour certification course is available free to C.A.R. members using discount code FREECERT through C.A.R. Education.