Security Training for
Mortgage and Real Estate
Professionals.
You handle Social Security numbers, bank statements, tax returns, and wire transfer instructions every day. GLBA says you are a financial institution. Your cyber insurance carrier asks about training at renewal. This program supports both sets of expectations, designed for independent originators and small brokerages with no dedicated IT staff.
Your regulatory requirements
If you handle client financial data, GLBA applies, whether you have one employee or fifty.
Mortgage originators, real estate brokerages handling earnest money, title companies, and appraisal firms are all financial institutions under GLBA. Multiple frameworks require your team, even a team of one, to complete annual security awareness training.
| Framework | Citation | What it requires |
|---|---|---|
| Gramm-Leach-Bliley Act (GLBA) | 15 U.S.C. §6801 et seq. | Mortgage lenders, brokers, and originators are financial institutions under GLBA. The Safeguards Rule requires security awareness training for all personnel who handle customer information. |
| FTC Safeguards Rule | §314.4(c) | Specifically requires financial institutions to provide security awareness training to personnel. The 2021 amendments made explicit that training must be updated to reflect risks identified in risk assessments. |
| NMLS Model State Law | Varies by state | Many states require mortgage licensees to maintain a written information security program. Training is a component of demonstrating compliance with the program requirement during examinations. |
| State Data Security Laws | All 50 states | Every state has a breach notification law. Real estate and mortgage professionals handling SSNs, bank account numbers, and tax returns must report breaches within state-specified deadlines, typically 30–60 days. |
This table summarizes key training-adjacent provisions. Consult qualified counsel for a complete compliance assessment specific to your business.
Why this matters
Wire fraud alone costs the real estate sector hundreds of millions every year, and small operators are the primary targets.
Attackers know that independent mortgage brokers and small real estate offices rarely have dedicated security staff. They target transaction-related email, spoof wiring instructions, and intercept sensitive documents. Training your team, or yourself, on how to recognize these attacks is the lowest-cost protection available.
Real estate wire fraud losses reported to FBI
FBI IC3 2023 Internet Crime Report, real estate/rental sector
Mortgage industry breach notification cost
IBM / Ponemon Institute, 2024 benchmark, financial services per-record cost
Business email compromise targeting real estate
FBI IC3 Public Service Announcement, 2024, BEC victim breakdown by industry
What the training covers
Every module is written for the scenarios real estate and mortgage professionals face, not generic office scenarios.
Wire fraud, email compromise mid-transaction, client data on personal phones, third-party platform access, these are not theoretical. This training uses real-world examples drawn from FBI IC3 reports and industry incident data to make the risks concrete and the solutions actionable.
Wire Fraud Prevention
The FBI estimates billions in real estate wire fraud losses. How to implement a phone-call verification step at a known number for any wire transfer instruction, the single most effective control for independent agents and small brokerages.
Email Compromise Detection
Attackers intercept and spoof emails mid-transaction, changing wiring instructions, settlement statements, or closing documents. How to recognize the subtle signs before funds are transferred.
Client PII and Financial Data Protection
Social Security numbers, bank statements, tax returns, credit reports, the data that moves through every mortgage application. What counts as NPI and the practical steps to protect it without enterprise-grade tools.
Mobile Device and Remote Work Security
Most independent mortgage originators work from home offices and personal phones. How to protect client data on devices that are not managed by a corporate IT department, practical steps that work for solo professionals.
LOS and Third-Party Platform Access
Loan origination systems, CRM platforms, document-sharing tools, each is a potential entry point. How to use multi-factor authentication, unique passwords, and session management across the tools your team uses every day.
Incident Detection and Reporting
If client data is exposed, lost phone, misdirected email, wire fraud attempt, who needs to know and how quickly. State notification deadlines, cyber insurance reporting requirements, and NMLS obligations.
Recommended for your industry
Recommended training for mortgage and real estate teams
Not every employee needs every course. Start with the foundational awareness that protects every team and client, then layer in specialized training based on whether you operate a mortgage or lending business versus an ordinary brokerage.
Cybersecurity Awareness
Recommended for: All mortgage and real estate professionals, including loan officers, processors, agents, brokers, transaction coordinators, and support staff.
The baseline for every mortgage and real estate team. Covers phishing, password safety, ransomware, safe browsing, data handling, and incident reporting. For mortgage firms, this also supports the employee security-awareness component of the FTC Safeguards Rule.
Phishing & Social Engineering
Recommended for: Loan officers, processors, agents, brokers, transaction coordinators, and anyone communicating with buyers, sellers, lenders, or closing professionals.
Real estate transactions are frequent targets for business-email compromise and fraudulent wiring instructions. NAR specifically recommends independent verification of wire instructions, and this course trains the exact staff who handle those communications.
FTC Safeguards Rule
Recommended for: Mortgage brokers, lenders, and other covered nonbank financial institutions.
Mortgage brokers are treated as financial institutions under GLBA and are subject to the FTC Safeguards Rule, which requires covered firms to maintain an information-security program that includes security awareness training for personnel. The FTC specifically identifies mortgage brokers among the businesses subject to the rule.
This course is not open for enrollment yet.
View course detailsCyber Insurance Readiness
Recommended for: Firms applying for, renewing, or currently carrying cyber insurance.
Additional training for firms applying for or renewing cyber insurance, helping employees understand the security behaviors underwriters commonly expect. This is an insurance-driven recommendation, not a regulatory requirement.
Not sure where to start? For every mortgage and real estate team, begin with Cybersecurity Awareness, then add Phishing & Social Engineering for anyone who communicates about transactions. Mortgage brokers and covered nonbank lenders should also add FTC Safeguards / GLBA training, and firms applying for or renewing cyber coverage should add Cyber Insurance Readiness.
About your recommended courses
Frequently asked questions about your course recommendations
Our recommendations are built by mapping your industry's regulatory obligations and most common risks to specific courses. We organize them into tiers (Start Here, Highly Recommended, Recommended, When Applicable, and Based on Your Needs) so you can quickly see what's essential, what's broadly useful, and what's conditional on your specific situation.
Certificates and training records
When your carrier, state regulator, or client asks for proof, you have it in thirty seconds.
Every certificate includes a public verification URL that anyone can type into a browser to confirm authenticity, no login, no account, no phone call. Hand the URL to your cyber insurance underwriter, your NMLS examiner, or a client who asks about your security practices. It works.
For teams: manager reports show completion status across all licensed professionals and support staff. Export a PDF. Attach it to your renewal application or examination response.
Also applies to your profession
See how this training applies to other regulated small businesses.
Healthcare Practices
HIPAA Security Rule training for dental, medical, and chiropractic practices, no small-practice exemption.
View healthcare guideAccounting Firms
FTC Safeguards Rule, IRS Pub 4557, SOC 2, for CPA firms and tax preparers without dedicated IT staff.
View accounting guideLegal Practices
ABA Model Rules 1.1 and 1.6, technology competence and confidentiality for small and solo firms.
View legal guideManaged Service Providers
CMMC, NIST CSF, ISO 27001, supply chain security training for small MSP teams.
View MSP guideInsurance Agencies
State regulation and NAIC model law training for independent agents and small brokerages.
View insurance guideFinancial Advisors
SEC and FINRA-aligned training for RIAs and independent advisors handling sensitive client financial data.
View financial advisor guideNonprofits
Donor data protection and grant compliance training for small charities and foundations without IT staff.
View nonprofit guide
Set up training for yourself or your entire brokerage in four minutes. No IT staff required.
Individual plan: from $45/course/year for solo originators and agents. Team plan: one flat annual rate per person for brokerages and branch offices. Same training, same certificate, same public verification, scaled to your team size.
Fixed annual pricing per person. Cancel any time. Certificates remain valid and verifiable for 12 months. Training and documentation support compliance, consult qualified counsel for framework-specific legal interpretation.