Back to news
Cybersecurity Alert
June 5, 2026 by EmailMeNow IT Consulting

Cybersecurity Audit of Major U.S. Mortgage Lenders in 2026

Independent audits of the largest U.S. mortgage lenders — Rocket Mortgage, UWM, loanDepot, and more — reveal a wide range of cybersecurity results. Weak email authentication is a direct path to closing wire fraud.

MortgageReal EstateWire FraudCFPBEmail Security
Digital audit dashboard with a United States map showing cybersecurity scores of mortgage lenders

An independent cybersecurity review across the largest mortgage lenders in the United States — national retail and wholesale mortgage originators and servicers including Rocket Mortgage, United Wholesale Mortgage, and loanDepot — reveals a surprisingly wide range of results. These organizations handle sensitive customer and financial data at national scale, yet several show the same email-authentication gaps found at much smaller regional institutions.

Using data from audit.emailmenow.com, we evaluated each lender’s primary domain across email, website, and network security — including SPF, DKIM, DMARC, MTA-STS/TLS, and security headers.

In this national audit, scores ranged from 70% to 38%9 of 18 (50%) scored below 60%.

Cybersecurity Scores of Mortgage Lenders

Overall compliance scores from audit.emailmenow.com. Re-run any domain at the link to verify.

RankMortgage LenderDomainOverall ScorePerformance Level
1United Wholesale Mortgageuwm.com70%Strong
2Better Mortgagebetter.com68%Good
3Guild Mortgageguildmortgage.com67%Good
4loanDepotloandepot.com66%Good
5Movement Mortgagemovement.com64%Above Average
5Freedom Mortgagefreedommortgage.com64%Above Average
5Chase Home Lendingchase.com64%Above Average
8Guaranteed Raterate.com62%Above Average
9Mr. Coopermrcooper.com61%Above Average
10PennyMacpennymac.com58%Average
11AmeriHome Mortgageamerihome.com55%Average
12Fairway Independentfairwaymc.com54%Below Average
12CrossCountry Mortgageccm.com54%Below Average
12Wells Fargo Home Mortgagewellsfargo.com54%Below Average
15Caliber Home Loanscaliberhomeloans.com52%Below Average
16New American Fundingnewamericafunding.com48%Weak
16Homepointhomepoint.com48%Weak
18Rocket Mortgagerocketmortgage.com38%Weak

What the Results Reveal

  • Scores range from 70% (United Wholesale Mortgage) down to 38% (Rocket Mortgage) — only one major retail brand reaches a strong (70%+) posture.
  • Rocket Mortgage (38%), the nation’s largest retail originator by volume, scores lowest in the field — well below wholesale leader UWM (70%).
  • The gap from top to bottom is 32 points — household brand recognition does not predict closing-security posture.
  • Without an enforced DMARC policy, criminals can spoof a lender’s own domain to send fraudulent wiring instructions during loan closings.

Why This Matters for Mortgage Lenders

Mortgage lenders and servicers are bound by CFPB mortgage rules, GLBA safeguards, and state licensing oversight. Email authentication (SPF, DKIM, and an enforced DMARC policy) is the single highest-impact control against closing wire fraud and business email compromise that redirect borrower funds at the last hour.

Check any lender’s posture at audit.emailmenow.com/?industry=real-estate.

See also — state audits

Recommendations

  • Enforce DMARC (p=reject), strict SPF (-all), and DKIM signing.
  • Add MTA-STS and website security headers.
  • Adopt verified call-back procedures for any change to payment or wiring instructions, and train customer-facing staff.

Protect your organization. Run a free Instant Cybersecurity Audit at audit.emailmenow.com/?industry=real-estate.

Contact EmailMeNow IT Consulting for help with wire-fraud-resistant email security hardening.


Source & methodology: Overall compliance scores from the free scan at audit.emailmenow.com — each domain checked for email authentication (SPF, DKIM, DMARC), transport security (MTA-STS/TLS), website security headers, and network security. Re-run any domain at the link to verify.