You know phishing is a threat. You probably have some version of email protection in place. But you’re not sure if what you have is actually enough, or which specific gaps are leaving you exposed.
That’s the conversation we have with almost every property management firm we work with. They’re not starting from zero. They have Microsoft 365, maybe MFA, and a general sense that something more should be in place. What they’re missing is a clear picture of what a complete email security stack looks like, what each layer actually does, and why the order matters.
This guide covers all of it. We cover why PM firms are specifically targeted, how modern phishing actually works in 2025 and 2026, and how to build a layered defense where every piece has a purpose. By the end, you’ll know exactly what you have, what you’re missing, and what to do about it.
1. Property Managers Are Getting Targeted. Not by Accident.
The attacker wasn’t in the system for five minutes.
They were in the email thread for two weeks. Watching. Learning the names, the tone, the cadence of the conversation. Learning when payments were due and who authorized them. Then, the day the wire transfer came up, they made their move. One email. One set of fraudulent instructions. One $180,000 mistake.
This is the pattern behind the average BEC incident in real estate, where losses run between $150,000 and $200,000 per incident. It happens specifically because property management firms are high-value, high-trust, high-volume email environments.
Wire transfer instructions. ACH payment confirmations. Owner distribution notices. Vendor invoices. Lease financials. Tenant SSNs. All of it moves through the inbox, every day, at volume. Attackers don’t need to breach a bank. They need to get into the right email thread at the right time.
There’s a second reason PM firms are attractive targets. Property management teams are trained to be responsive. Fast replies. Quick turnarounds. Accommodating requests without friction. That’s good operations. It’s also what social engineering is designed to exploit. Urgency is one of the primary levers in a phishing attack, and a team conditioned to move fast on tenant and owner requests is exactly the kind of team that clicks before verifying.
According to Check Point’s 2025 State of Cybersecurity Report, 68% of all cyberattacks start with a malicious email. Most PM firms running Microsoft 365 are on default settings. That’s not a configuration built to stop what’s being deployed against this industry today.
2. The Phishing Email You’ll Never See Coming
Forget everything you think you know about what a phishing email looks like.
The broken English, the suspicious links, the generic “Dear Customer” opening. That era is largely over. Modern phishing is precise, contextual, and indistinguishable from a real email from a real person you work with.
According to KnowBe4’s 2025 Phishing Threat Trends Report, 82.6% of phishing emails now contain AI-generated elements. Generative AI has eliminated every traditional signal people relied on to spot a fake. Perfect grammar. Accurate names. Correct context. Details pulled from LinkedIn, company websites, and prior data breaches. An attacker can produce a highly personalized spear-phishing email in under five minutes. That same level of research and polish used to take a skilled human operator most of a workday.
The most financially damaging variant targeting PM firms isn’t generic phishing. It’s business email compromise.
BEC works like this. An attacker compromises or spoofs a known contact’s email account. They get into an active conversation. Not a new one. An existing thread with real history, real names, real context. They watch. They learn when a payment is coming. They understand the approval chain. And when the wire transfer comes up, they insert themselves with instructions that look completely legitimate, because everything surrounding them is real.
The Washington couple who lost $272,000 on a home purchase didn’t receive an obvious scam. They received what looked like updated wire instructions from their title company, arriving exactly when they expected payment details. The Manhattan real estate brokerage that lost over $1 million had an agent’s account compromised weeks before the fraudulent wire request arrived. The attacker had been watching the closing unfold in real time.
Property management firms run dozens of these transactions simultaneously. Vendor payments. Owner distributions. Security deposits. Maintenance invoices. Every active payment thread is a target if an account has been compromised.
Modern BEC contains no malicious links and no suspicious attachments. There’s nothing for a spam filter to flag. The attack is the message itself, arriving from a trusted context at the right moment.
A filter built for yesterday’s attacks doesn’t see today’s coming.
3. Why One Layer Is Never Enough
Most IT leads in property management point at Microsoft 365 and call it covered. Defender is on. MFA is configured. That should be enough.
It’s not. Here’s the specific problem.
Microsoft’s native protection catches what it was built to catch: bulk spam, known malware signatures, commodity phishing. It does that well. But Defender is a single detection engine drawing from a single threat intelligence feed. A campaign that hasn’t appeared in Microsoft’s telemetry yet doesn’t get caught. Targeted spear phishing, zero-day URLs, and BEC attacks with no malicious payload consistently slip through. Microsoft’s own security team acknowledged this in late 2025, noting that secondary filtering solutions catch what Defender misses.
MFA has the same gap. It stops credential theft from becoming account takeover in most scenarios. But adversary-in-the-middle attacks, which surged 146% in 2024, bypass standard MFA entirely. They intercept session cookies in real time after authentication completes. The attacker never needs your password. They just need to sit between you and the login flow.
DMARC, DKIM, and SPF protect your domain’s outbound reputation. They don’t filter what’s coming in.
Phishing awareness training reduces click rates. It doesn’t eliminate them.
Each of these controls addresses a specific attack surface. None of them address all attack surfaces. A PM firm with MFA but no secure email gateway is protected against credential theft but wide open to inbox-level BEC. A firm with a gateway but no training still has staff who will click the right message on the wrong day. A firm with training but no DLP has no visibility into what leaves the environment after a compromise.
That’s the logic of a layered defense. Each layer does one job. Each one covers the gap the previous one leaves open. Pull a layer out and the gap doesn’t get filled by something else. It just stays open.
The sections below break down each layer, what it actually does, and what you’re exposed to without it.
4. Understanding the Layers of Email Security
A complete email security stack works as a system. Each layer has a defined job. Each one assumes the others will have gaps, and covers those gaps as best it can. The goal isn’t perfection. It’s making every stage of an attack harder than the attacker is willing to work.
Here’s what that looks like in a property management environment.
4.1 MFA: The First Line That Isn’t Enough on Its Own
Start here. Without MFA, a stolen password gives an attacker full inbox access immediately. No further steps required. They’re in, reading your email, monitoring your threads, and waiting for the right moment.
MFA fixes that specific problem extremely well. Microsoft’s internal data shows account compromise risk drops by over 99% for standard credential theft scenarios when MFA is enforced.
The word “enforced” matters. One account without MFA is the account that gets compromised. Full coverage, all users, no gaps.
The caveat is adversary-in-the-middle attacks. AiTM phishing kits don’t steal passwords. They proxy the entire authentication session including the MFA step and capture the session cookie on the other side. The user completes MFA normally. The attacker receives a valid, authenticated session token. Standard push notification MFA doesn’t stop this.
Phishing-resistant MFA does. Hardware security keys and passkeys bind authentication to a specific device and domain. A stolen session token is useless without the physical device. For accounts with authority over wire transfers and owner financial communications, phishing-resistant MFA is the right call. The threat model justifies it.
4.2 DMARC, DKIM, and SPF: Stopping Attackers From Becoming You
These three protocols don’t protect what comes into your inbox. They protect what goes out and they prevent attackers from sending emails that appear to come from your domain.
This matters more than most PM firms realize. If an attacker can spoof your domain, they can send emails to your vendors, your owners, your tenants, and your bank that look like they came from you. Wire fraud frequently exploits exactly this gap.
SPF is a DNS record that tells receiving mail servers which IP addresses are authorized to send email on your domain’s behalf. A spoofed message sent from an unauthorized server fails SPF.
DKIM attaches a cryptographic signature to every outbound message. Receiving servers verify the signature against your published public key. A forged message can’t replicate the signature.
DMARC ties SPF and DKIM together. It tells receiving servers what to do when a message fails authentication reject it, quarantine it, or allow it and sends you reporting on what’s happening with your domain across the internet.
The three work as a system. SPF alone can be bypassed. DKIM alone doesn’t enforce a policy. DMARC without properly configured SPF and DKIM records has nothing valid to act on. Missing one creates a gap the others can’t close.
One more thing: DMARC deployed in monitoring mode isn’t protecting you. It’s only watching. Getting to enforcement mode where failing messages are actually rejected or quarantined is the step most PM firms stop short of.
Microsoft flagged misconfigured email routing as an active attack vector as recently as January 2026. This is not a theoretical exposure.
4.3 Secure Email Gateway: The Layer Most PM Firms Are Missing
This is where the conversation usually gets uncomfortable.
Most mid-market property management firms haven’t deployed a secure email gateway. They have Microsoft 365. They have Defender. They figure that’s the email security layer. It’s not. The gap between what Defender catches and what a gateway adds is exactly where the $150,000 to $200,000 BEC incidents are living.
Here’s the difference. Defender analyzes email against known threat signatures and Microsoft’s own threat intelligence. A brand-new phishing campaign, a freshly registered lookalike domain, a BEC message with no links and no attachments. None of these are signature matches. A gateway adds independent detection engines pulling from separate threat intelligence feeds. What one engine misses, another may catch. For targeted attacks where a fresh campaign hasn’t yet appeared in any single vendor’s database, that redundancy is what the catch depends on.
Beyond detection breadth, a gateway provides capabilities Defender doesn’t offer:
- AI-powered behavioral analysis flags sender anomalies, display name spoofing, and domain impersonation even when the sending domain looks legitimate at a glance. A domain that swaps one character in a vendor’s name passes a visual check. It doesn’t pass behavioral analysis.
- Safe link scanning rewrites every URL in an inbound message and re-checks it at the moment a user clicks, not at the time of delivery. This matters because attackers routinely send clean links that only become malicious after the email clears filters. A link safe at 9am may point to a credential harvesting page by noon. Time-of-click scanning closes that window.
- Attachment sandboxing opens suspicious files in an isolated environment before they reach any user’s device. If a file attempts to call back to an external server, drop a payload, or execute unusual behavior, the sandbox catches it. The user never sees it.
If your firm is running Microsoft 365 without a gateway layered on top, the coverage gap is real and documented. This is the most common gap we see in PM firms coming to us after an incident.
4.4 DLP and Encryption: What Leaves Matters as Much as What Comes In
The previous three layers focus on keeping threats out. These two focus on what happens to sensitive data once something gets through anyway, or once an account is compromised despite everything else.
Data loss prevention policies scan outbound email against defined data patterns. Tenant SSNs. Routing numbers. ACH account details. Lease financials. Any of these appearing in an outbound message trigger a policy action: block the message, quarantine it, or flag it for review. The response is configurable. The protection is automatic once policies are in place.
This matters specifically in PM environments because data exfiltration after a compromise doesn’t look like a breach. A compromised account sending owner financial data to an external address looks like a normal outbound email. The credentials are legitimate. The sending behavior looks routine. Without DLP, the data leaves silently. With it, the pattern is flagged before it clears the environment.
DLP also matters for compliance exposure. PM firms handling tenant PII are operating inside an expanding set of state-level data privacy requirements. Documented, automated controls that prevent sensitive data from leaving via email are part of demonstrating reasonable security practices, both to regulators and to institutional clients who increasingly make it a vendor requirement.
Email encryption protects outbound financial communications in transit. Wire transfer instructions, owner distribution details, sensitive financial correspondence. An encrypted message intercepted anywhere in the delivery chain is unreadable to anyone without the recipient’s credentials. This is the control that makes the wire transfer conversation itself safe to have over email, assuming everything else is in place.
Neither control requires user action once configured. They run in the background on every message that matches the defined criteria.
4.5 Phishing Awareness Training: The Last Line and Why It Actually Matters
No technical stack stops everything. Training is the control that catches what gets through.
The honest problem in IT support for property management is that this is the easiest layer to let slide. PM teams have high turnover. Leasing staff, maintenance coordinators, and property administrators cycle through regularly. Security awareness training, when it exists at all, usually lives in an onboarding folder that never gets revisited. A team member hired eight months ago may have never seen a simulated phishing exercise.
Simulated phishing campaigns expose real behavior. Not what staff say they’d do. What they actually do. An employee who would never click a suspicious link will sometimes click a well-crafted one. That’s not a failure of character. That’s what AI-generated, context-aware phishing is specifically designed to produce. The simulation surfaces the real exposure.
Employees who click on a simulated phishing message receive immediate, specific feedback. Not a policy reminder. A breakdown of exactly what they missed: the sender anomaly, the urgency framing, the slightly-off domain, and why each signal matters.
Organizations running active simulation and training programs see phishing simulation click rates drop 32% to 38% over time, according to Verizon’s Data Breach Investigations Report. In a PM environment where a single click can kick off a fraudulent wire transfer, that reduction is a direct, measurable risk outcome.
The goal is not catching people doing something wrong. It’s building a team that slows down when something feels slightly off, even when it looks almost exactly right.
5. How Far Out Solutions Keeps Email Secure For Property Management Clients
The property management firms we work with don’t think about their email security stack. Not because the risk isn’t real. We’ve just outlined exactly how real it is. They don’t think about it because we’ve built and manage the full stack on their behalf. That’s the arrangement.
What our clients don’t carry is the question of whether their default Microsoft 365 configuration is enough to protect a wire transfer conversation. It isn’t, and we’ve handled that.
MFA enforced across every account with no gaps. DMARC, DKIM, and SPF deployed, tested, and set to enforcement, not monitoring. A secure email gateway active on every domain. AI-powered threat detection, safe link scanning, and attachment sandboxing layered on top of native filtering. Phishing awareness training and simulations running on a regular cadence for every team, not just at onboarding.
Every client has a vCIO on their account. Not a help desk ticket queue. A person who reviews email security posture as part of ongoing strategic oversight and flags exposure before it becomes an incident.
We support over 2,500 properties across multifamily and commercial real estate. Clients like Cushman and Wakefield, Greystar, and Watercrest Senior Living aren’t wondering whether their email stack is complete. That’s not their job. It’s ours.
6. Start With A Security Assessment. Find the Gaps Before the Attacker Does.
Here’s where most mid-market PM firms actually stand: MFA is probably on. A secure email gateway probably isn’t. DMARC may be deployed but sitting in monitoring mode. Training happened once at onboarding and hasn’t run since.
Those aren’t catastrophic gaps. They’re fixable gaps. But you need to know exactly where they are before you can close them.
Far Out Solutions offers a 72-point security assessment that covers your full email security posture: authentication configuration, filtering layers, DLP policies, encryption, and training coverage. It tells you where the exposure is and what needs to close first.
One point of contact. No gap between your email platform, your security tools, and your staff.
The next phishing attempt targeting your firm isn’t waiting for you to get ready. Request your assessment and find what’s open before they do.
