Back to news
Cybersecurity Alert
October 11, 2026 by EmailMeNow IT Consulting

Harris County Deed Theft Lawsuits Meet a Weak Property-Alert Inbox

Harris County sued alleged deed thieves and tells homeowners to watch Clerk email alerts. The alert host scores 38%. Audits (ideal 100%): hcad.org 63%, harriscountytx.gov 52%, cclerk.hctx.net 38%, cao.harriscountytx.gov 28%.

Source: Harris County Attorney · Harris County Clerk · Click2Houston

NewsTexasPhishingReal EstateMFAYubiKeyAuthenticator AppsCybersecurity
Houston porch table with a property folder and a deed marked for review

Harris County Attorney Abbie Kamin told Houston on September 9, 2026 that her office had filed two civil suits against people accused of stealing homes on paper. Click2Houston (Oct 9) brought the warning back: check your records, and treat a deal that is too cheap or too fast as a problem. The Clerk’s free Property Alert System is the email piece — it mails you when a document is recorded under a name you registered.

This is property fraud plus a county email alert, not a reported hack of the Clerk or the County Attorney. The suits are state court. CourtListener RECAP showed no matching Southern District of Texas docket for these parties when we searched on October 11, 2026.

Official pages: County Attorney — “A Ring of Scammers” · Clerk Property Alert System

Houston porch table with a property folder and a deed marked for review

Snapshot

FieldDetail
Suits announcedSept 9, 2026 · Harris County Attorney
Local recapClick2Houston Oct 9, 2026
CaptionsHarris County v. Antia Martinez et al. · Harris County v. Mario Cavazos
CourtListener (federal)0 matching RECAP rows
Free alertClerk PAS email · 1–2 business days after recording

Kamin’s office says Martinez covers five homes stolen with forged notarized packets, and Cavazos covers five more. Investigators say some owners were already dead — one in 1992. A prior private suit had Cavazos selling a house to Martinez. Click2Houston quoted Kamin calling it “outright home theft,” including a trick that grafts a real notary signature page onto a fake deed.

A 2025 default judgment under then–County Attorney Christian Menefee returned 40 homes in a different forgery ring. The Scam Free Harris County desk still wants new complaints.

The email problem around a paper crime

Deed theft here is mostly forged filings, not a phished Clerk password. The follow-on risk is still an inbox problem:

  1. The Clerk’s PAS sends a real email with a link to a watermarked unofficial copy. The Clerk says the system matches names, not addresses, and can alert you about someone else named Smith. Notifications aim for 1–2 business days.
  2. A fake “Harris County Clerk / new deed on your house — click to review” message is cheap to send. cclerk.hctx.net Identity scored 25%. cao.harriscountytx.gov Identity scored 0%.
  3. Once a fake deed is on file, title and wire fraud get easier. That is the same BEC pattern we already score on Texas real-estate brokerages.

Register PAS at the Clerk portal. Type that host. Enter every name variant on your deed. The Clerk’s own disclaimer: PAS does not block a filing, is not legal advice, and is not a warranty.

Laptop showing a county property-alert email with a slightly off sender domain

What Houston homeowners should do

  1. Look up the legal description on hcad.org, then search that description on the Clerk site. Do this before you need a lawyer.
  2. Enroll in PAS for every name on the deed. Treat an alert as a review task, not proof the filing is yours.
  3. If the document is wrong, call a real-estate lawyer and file with the County Attorney’s Stay Scam Free complaint path. Texas Government Code 51.901 is the Clerk’s cited route for a fraudulent instrument.
  4. Keep the will and probate papers current. Kamin said deceased-owner homes are a favorite target.
  5. Buyers and renters: walk away from cash-only, same-week closings. A stolen deed can leave the “seller” and the new occupant both holding a mess.

MFA: YubiKey and Google Authenticator

A hardware key does not stop a forged notary page. It does stop a fake “Clerk portal / review your new deed” login that steals the password you use for PAS. Grades match our MFA directory.

GradeMeaning
FailSMS, voice, or email OTP — or no public path
PassSelf-serve Google Authenticator-style open TOTP
StrongFIDO2 / YubiKey-class security key for sign-in
PlatformGradeYubiKeyAuthenticator
Harris County Clerk PASFailNoNo
Harris County AttorneyFailNoNo

The Clerk PAS page documents register / log in, name matching, and email alerts. It does not name a YubiKey or Google Authenticator. The County Attorney newsroom and complaint path publish no portal MFA help either. CivicPlus-style open TOTP on some Texas city sites is not this Clerk stack. Grade Fail.

Directory: MFA support directory · Category → Business Apps.

ProductBest forGet it
YubiKey 5C NFCUSB-C laptops + NFC phonesAmazon
YubiKey 5 NFCUSB-A desktops + NFC phonesAmazon
Proton PassPasskeys + authenticator-style TOTPProton Pass

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Hardware security key and phone authenticator in front of a blurred county records login

Independent cybersecurity audits

We audited the Clerk, HCAD, the county site, and the County Attorney host on October 11, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not decide the civil suits.

OrganizationDomainOverallvs 100%
Harris County Appraisalhcad.org63%−37
Harris Countyharriscountytx.gov52%−48
County Clerkcclerk.hctx.net38%−62
County Attorneycao.harriscountytx.gov28%−72
DomainIdentityTransportWebsite
hcad.org75%45%37%
harriscountytx.gov50%15%37%
cclerk.hctx.net25%15%37%
cao.harriscountytx.gov0%15%37%

Audit links: hcad.org · harriscountytx.gov · cclerk.hctx.net · cao.harriscountytx.gov

cao.harriscountytx.gov Identity 0% is the spoofing risk: a fake “County Attorney / Stay Scam Free / your deed” message is easier to land than the 28% overall implies. The Clerk alert host at 38% / Identity 25% is the mailbox homeowners are being told to trust. Transport 15% on three of four hosts means inbound county mail can still be downgraded without MTA-STS enforce.

Printed email-security scorecard with four gauges below a 100 percent ideal

Website stack note

Passive website-tech probes on October 11, 2026:

DomainStack signal
cclerk.hctx.netASP.NET (X-Powered-By exposed); DigiCert TLS expires 2027-04-03
hcad.orgCraft CMS on Plesk; GoDaddy TLS expires 2027-02-25; Bootstrap 4.1.3 (legacy)
harriscountytx.govStack undetected; DigiCert TLS expires 2027-02-07
cao.harriscountytx.govStack undetected; Let’s Encrypt TLS expires 2026-11-26

Point-in-time only. A Clerk homepage stack is not a finding on a recorded deed.

Blacklist and lookalike domains

Email blacklist checks (public DoH, October 11, 2026): hcad.org, harriscountytx.gov, cclerk.hctx.net, and cao.harriscountytx.gov were clear on mail/domain lists we can query. cclerk.hctx.net and cao.harriscountytx.gov showed no MX in this probe — web posture only. SPFBL notes on HCAD and County Attorney web/CDN addresses are informational — not mail-reputation hits.

DNS lookalike scans (BEC profile, registered signals only):

Brand scannedTo reviewLikely ownedBEC staging
hcad.org1100
harriscountytx.gov300
cclerk.hctx.net900

High-interest registered names (investigate; not proof the suits used them):

LookalikeTechniqueNote
hcad.com / hocad.org / hacad.orgtld-swap / insertionLive DNS
harriscountytx.com / .org / .infotld-swap.info has MX
hctx.net / hctx.comdefensive-tld / tld-swapClerk lives on cclerk.hctx.net

Type cclerk.hctx.net, hcad.org, and harriscountytx.gov. Continuous monitoring: Cybersquat Domain Monitoring.


Run a free audit at audit.emailmenow.com or contact EmailMeNow for DMARC / MTA-STS and phishing response aimed at the 100% ideal.