Wire Fraud Alert
In recent months, real estate professionals in Northeast Ohio have reported an upswing in a particularly insidious wire scam. A hacker will break into a licensee’s e-mail account to obtain information about upcoming real estate transactions. After monitoring the account to determine the likely timing of a close, the hacker will send an e-mail to the buyer, posing either as the title company representative or as the licensee. The fraudulent e-mail will contain new wiring instructions or routing information, and will request that the buyer send transaction-related funds accordingly. Unfortunately, some buyers have fallen for this scheme, and have lost money.
Unlike many other e-mail-based “phishing” schemes, this particular manifestation appears to be more sophisticated and less recognizable as fraud. The communications do not contain the typical grammatical or stylistic oddities that are often present in scam e-mails. In addition, because the perpetrator has been monitoring the licensee’s e-mail account, the fraudulent communication may include detailed and accurate information pertaining to the real estate transaction, including existing wire and banking information, file numbers, and key dates, names, and addresses. Finally, the e-mails may come from what appears to be a legitimate e-mail address, either because the thief has successfully created a sham account containing a legitimate business’s name, or because he or she is sending the e-mail from a truly legitimate—albeit hacked––account.
Follow this guidance to avoid becoming a victim:
- Immediately contact all parties to all of your upcoming transactions and inform them of the possibility of this fraud. Attorneys, escrow agents, buyers, sellers, real estate agents, and title agents have all been targeted in these scams.
- If possible, do not send sensitive information via email. If you must use email to send sensitive information, use encrypted email.
- Immediately prior to wiring any money, the person sending the money must call the intended recipient to verify the wiring instructions. Only use a verified telephone number to make this call.
- Do not trust contact information in unverified emails. The hackers will recreate legitimate-looking signature blocks with their own telephone number. In addition, fraudsters will include links to fake websites to further convince victims of their legitimacy.
- Never click on any links in an unverified email. In addition to leading you to fake websites, these links can contain viruses and other malicious spyware that can make your computer – and your transactions – vulnerable to attack.
- Never conduct business over unsecured wifi.
- Trust your instincts. Tell clients that if an e-mail or a telephone call ever seems suspicious or “off,” that they should refrain from taking any action until the communication has been independently verified as legitimate.
- Clean out your e-mail account on a regular basis. Your e-mails may establish patterns in your business practice over time that hackers can use against you. In addition, a longstanding backlog of e-mails may contain sensitive information from months or years past. You can always save important e-mails in a secure location on your internal system or hard drive.
- Change your usernames and passwords on a regular basis, and make sure your employees and licensees do the same.
- Never use usernames or passwords that are easy to guess.
- Make sure to implement the most up-to-date firewall and anti-virus technologies in your business.
If you believe your e-mail or any other account has been hacked, or that you or a client has otherwise been a victim of online fraud, you should take the following steps:
- If money has been wired via false wiring instructions, immediately call all banks and financial institutions that could possibly put a stop to the wire.
- Contact your local police.
- Contact any clients or other parties who may have been exposed during the attack so that they take appropriate action. Remind them not to comply with any requests from an unverified source.
- Change all usernames and passwords associated with any account that you believe may have been compromised or otherwise made vulnerable by the attack.
- Report any fraudulent activity to the Federal Bureau of Investigations via their Internet Crime Complaint Center.
- Brokers should report any fraudulent activity to their state or local REALTOR® association so that the associations can send out alerts or take other appropriate action.
This advice is not all-inclusive, and real estate practitioners should work with Information Technology and cybersecurity professionals to ensure that their e-mail accounts, online systems, and business practices are as secure and up-to-date as possible.
Be aware that these emails are extremely convincing. Many sophisticated parties have been duped. No one should assume that they are “too savvy” to fall victim. In addition, no one should assume that they are “too small a target” to be on these criminals’ radars. This fraud is pervasive, convincing, and constantly evolving.