Your E&O policy protects your professional judgment. It was never designed to protect your inbox, your data, or your clients’ wire transfers.
Real estate runs on email, e-signatures, cloud storage, and wire transfers. That digital workflow has made transactions faster — and made real estate one of the most attractive targets for cybercriminals in the country. Every closing involves large sums of money, tight deadlines, and a chain of people who are used to taking instructions by email. Criminals know it.
The numbers bear that out. According to the FBI’s Internet Crime Complaint Center, reported real estate fraud losses reached about $275 million in 2025, from more than 12,000 complaints — a jump of roughly 59% over the prior year. Business email compromise, the scheme behind most closing-day wire fraud, accounted for about $3 billion in reported losses across all industries.
Most real estate professionals carry errors and omissions (E&O) insurance, and many assume it will respond if a cyber incident hits their business. In most cases, it won’t — or it will respond only to a narrow slice of the problem. This article explains where E&O stops, what a cyber policy adds, and what to look for when you buy one.
What E&O Insurance Is Built to Do
Real estate E&O insurance protects you against claims that you made a professional mistake: you failed to disclose a known defect, gave a client incorrect advice, made an error in a contract, or missed a deadline. It pays for your legal defense and for settlements or judgments arising from that kind of negligence.
That’s essential coverage. But its focus is your professional judgment — not the security of your systems, your data, or the money moving through your transactions.
Where E&O Stops
Most E&O forms are explicit about leaving cyber risk to a cyber policy. A typical real estate E&O form, including the one PBI Group offers, contains provisions like these:
- A privacy and security breach exclusion. Claims arising from a breach of personal information, unauthorized access to data, transmission of malicious code, or failure to notify individuals of a breach are excluded.
- Exclusions for theft and conversion of funds. Losses from funds stolen while in your care, custody, or control — or while being transferred at your direction — are generally excluded.
- No first-party coverage at all. E&O is third-party liability insurance. It responds when someone sues you. It does not pay your own costs: forensic investigators, breach notification letters, ransomware recovery, rebuilding your systems, or the income you lose while your business is offline.
Some real estate E&O forms add a limited exception for wire fraud. PBI Group’s form, for example, provides coverage — subject to a $35,000 sublimit within the aggregate — when a client is intentionally deceived into wiring funds because of an insured’s negligence in providing real estate services. That’s a meaningful backstop for a liability claim, but it is narrow by design: it requires negligence by the insured, it’s capped, and it does nothing for your own response costs or a breach of your client files.
How a Closing Gets Hacked
To see why the gap matters, consider how a typical business email compromise unfolds.
- The break-in. An agent clicks a convincing link in an email that appears to come from a title company and enters their email password on a fake login page. The attacker now has access to the agent’s inbox.
- The surveillance. The attacker quietly reads correspondence for weeks, learning who the buyers are, when closings are scheduled, and how wiring instructions are usually sent.
- The switch. Days before a closing, the attacker sends the buyer an email — from the agent’s real account, or from a near-identical look-alike address — with “updated” wiring instructions pointing to a fraudulent account.
- The loss. The buyer wires their down payment. By the time anyone notices, the money has been moved through several accounts and is often unrecoverable.
Now count the costs. The buyer may sue the agent and the brokerage for negligence. But the brokerage also has to hire a forensic firm to find out how the inbox was compromised, determine whether client data was exposed, notify affected individuals under state breach notification laws (every state has one), possibly offer credit monitoring, restore its systems, and manage the reputational damage. Only the first item looks anything like an E&O claim — and even that may run into a security breach exclusion.
What a Cyber Policy Adds
A cyber policy is built for exactly this scenario. Coverage varies by carrier, but a well-designed policy combines first-party protection (your own losses) with third-party liability (claims against you).
First-party coverage — your own costs
- Breach response. Forensic investigation, legal counsel to guide the response, notification of affected individuals, call-center support, credit and identity monitoring, and public relations. These costs add up quickly even in a small breach, and many cyber policies give access to a pre-arranged panel of response vendors.
- Cyber extortion and ransomware. Expert negotiation, and where lawful, ransom payments, along with the cost of responding to the attack.
- Data restoration. The cost of recovering or recreating data and restoring systems that were damaged or encrypted.
- Business interruption. Lost income and extra expenses while your systems are down — a serious exposure for a brokerage that can’t access its transaction management platform during a busy closing season.
- Social engineering and funds transfer fraud. Coverage for your own funds lost when you or your staff are tricked into sending money to a criminal. This coverage is often offered as an endorsement with its own sublimit, so it’s worth asking about specifically.
Third-party coverage — claims against you
- Network security liability. Claims alleging that your failure to secure your systems allowed an attacker to harm a client — for example, a buyer whose wire was diverted after your email account was compromised.
- Privacy liability. Claims arising from the unauthorized disclosure of personal information you hold: Social Security numbers, bank details, IDs, and financial documents collected during a transaction.
- Regulatory defense and penalties. The cost of responding to an investigation by a state attorney general or other regulator after a breach, and fines and penalties where insurable by law.
- Media liability. Claims arising from content you publish online, such as listing descriptions, social media posts, or website material.
E&O and Cyber, Side by Side
| Exposure | Real Estate E&O | Cyber Policy |
|---|---|---|
| Failure to disclose a property defect | Covered | Not covered |
| Negligent advice or contract errors | Covered | Not covered |
| Client sues after a data breach of your files | Generally excluded | Covered (privacy liability) |
| Client’s wire diverted after your email is hacked | Limited, if at all (narrow wire-fraud sublimit; security breach exclusion) | Covered (network security liability) |
| Your own forensic investigation and breach notification | Not covered | Covered |
| Ransomware demand and recovery | Not covered | Covered |
| Lost income while systems are down | Not covered | Covered |
| Your own funds sent to a fraudster | Not covered | Covered, often by endorsement and sublimit |
| Regulatory investigation after a breach | Not covered | Covered, where insurable |
The two policies are designed to fit together. E&O protects your professional services; cyber protects the technology and data your services depend on.
What to Look For When You Buy
Cyber policies vary more than most lines of insurance. A few questions will tell you a lot:
- How is social engineering handled? Is funds transfer fraud covered for your own money, your clients’ money, or both? What is the sublimit, and are there conditions — such as a requirement to verify payment instructions by phone before sending funds?
- What security controls are you attesting to? Applications commonly ask about multi-factor authentication, backups, and employee training. Make sure your answers are accurate; a misstatement can jeopardize coverage when you need it.
- Who is covered? Many agents are independent contractors working under a brokerage. Confirm whether the brokerage’s cyber policy extends to affiliated agents and their email accounts, or whether agents need their own coverage.
- What does breach response include? Ask whether the policy provides a vendor panel and a breach hotline, and whether using them is required.
- Are the limits realistic? Consider the size of the transactions you touch, the volume of client data you store, and what a week offline would cost your business.
Practical Steps That Reduce Your Risk
Insurance is the backstop, not the plan. The most effective defenses are inexpensive:
- Turn on multi-factor authentication for email, transaction management, and e-signature platforms.
- Never send wiring instructions by email. Tell clients at the first meeting — in writing — that you will never change wiring instructions by email, and that they should verify any instructions by calling a known phone number.
- Train your team to recognize phishing and look-alike email addresses.
- Limit what you store. Don’t keep copies of IDs, bank statements, or tax documents longer than you need them, and store them securely.
- Keep backups that are separate from your main systems.
- Have a plan. Know who you’ll call — your carrier’s breach hotline, your bank, the title company, and law enforcement — in the first hour after an incident.
The Bottom Line
E&O insurance remains essential for every real estate professional. But it was written to protect your professional judgment, not your inbox, your client files, or the money moving through your transactions. As wire fraud and data breaches continue to climb, a separate cyber policy is what closes the gap.
PBI Group quotes cyber coverage separately from E&O so you can build the combination that fits your business. If you’d like to see how the two policies would work together for you, we’re happy to walk you through it.
This article is provided for educational purposes only and is not legal advice or a coverage determination. Coverage depends on the actual terms, conditions, and endorsements of the policy at issue. Cyber policy features described here are common in the market but vary by carrier and policy. Statistics are drawn from the FBI Internet Crime Complaint Center’s 2025 reporting.
