YOUR EMAIL IS BEING WATCHED = YOUR CLIENTS VICTIMIZED : THE HACK STORY

By
Real Estate Attorney with THE ZARETSKY LAW GROUP - Board Certified Real Estate Atty and AUTOMATED LAND TITLE COMPANY
https://activerain.com/droplet/4Ph6

There are people out there that are looking for your email address but they are neither buyers nor sellers.  Their goal is for YOU to help them steal money from YOUR client. They are thieves, crooks, scoundrels, terrorists, and intentioned with the worst of motives. Why do I know about this - I just saw it happen!!

 

YOU ARE THE WEAK LINK -

Let’s say you are a real estate agent and you publish your email address on your website.  Everyone knows your email address – essentially when I say everyone, I mean anyone looking for a real estate agent could find you and your email address.  We all love for people to know our email addresses so they can email us and hopefully we snag a new buyer or seller.  After all it is the way things work.  This opens a tremendous door for you to be the accessory to a crime of major proportions.

 

HACKING IS A REAL THREAT TO YOU

The problem of email hacking of real estate agents is being well documented and the National Association of Realtors and probably your state and maybe local Realtor boards have articles published on the problem.  See an excellent article of explanation at this link – Email Wire Fraud Hack Article.   Notwithstanding, plenty of agents are still being used as the tool for theft.  Essentially you are the key to unlock a treasure trove for their crooks – and you won’t know it until it is too late.  This article gives you an example one occurring though our title company office just this week.  The weak link in security was the real estate agent’s email account.

 

HERE IS HOW IT WORKS

A title company gets an order for a real estate transaction.  The transaction needs to move through the typical processes of getting the initial contract deposit, working up the file and title for the closing, and then when it comes time to close, the balance of the funds get wired to the closing agent, which funds are then used for the transaction with the seller getting the proceeds after the closing expenses and real estate agents are paid.

 

SET-UP FOR DISASTER

Almost every real estate agent wants and needs to be part of the process.  They are kept in the loop by getting status reports and often they are provided copies of the emails sent to the buyer or seller (their client) and those include the closing documents along with the buyer instructions to send the monies to the closing agent.  This inevitably includes the wire instructions.  Often the buyer’s real estate agent acts as the liaison and receives all this information on behalf of the buyer and then sends it on to the buyer.

So now this scenario probably seems pretty familiar to all real estate agents.

 

OK - YOU HAVE BEEN HACKED - SO WHAT?

What if you were the real estate agent and unknown to you, a thief had hacked into your email account and has been monitoring it for the past two or three months.  That thief has been watching every email you send and receive - even your closest secrets.  The thief sees that you are involved in a transaction that is scheduled to close shortly and they have every document you have received and sent on this very deal – from purchase contract to inspection report.  Now you get the wire instructions and closing package as a courtesy copy from the title agent.  Here is how the fraud now begins. [Note that all names and email addresses are made up for this article].

            1.         The monitored transaction shows that the title company is sending or has sent to the buyer the closing package including the wire instructions.

             2.         The thief sets up a new email account that looks very similar to the real email account but is different. For example, closing@firstam.com would be the real email address of the closing agent at First American Title.  The thief sets up a new account – costing about $15 and taking all of 2 minutes – for closing@firstams.com.  They just added an “s” to the end – hardly noticeable especially if you are using a smartphone or iphone for your email.

             3.         The thief now has already set up a real bank account, which could be in a USA bank or overseas.  In the real life commercial transaction example it was set up at Chase Bank.  Using that email address (with an “s” on the end) the thief sends to the Buyer this email (the blanks are redactions to protect privacy) the real message from the real closing agent but with substituted wire instructions:

-----Original Message-----
From: mm@landtitles.com>
To: cH ck77@aol.com>
Cc: jy1 J1@aol.com>  (she is the seller’s agent)
Sent: Fri, Feb 19, 2016 4:16 pm
Subject: Closing at Land Title

Good afternoon Mr H and Jo

Attached please find the following documents for Mr. H to execute:

 1.            HUD Settlement Statement – initial the first two pages and sign the third page;

2.            Utility, Maintenance and Open Permit Hold Harmless Agreement – sign where noted;

3.            Privacy Notice;

4.            Closing Statement Addendum – sign where noted;

5.            Closing Affidavit – sign in the presence of a Notary;

 Please forward all signed documents by email along with a COPY OF YOUR DRIVER LICENSE  and mail the originals to my attention on my email.

 

Please wire the amount of $9x,xxx.25 to our account, I have attached wiring instructions. and please advise and send wire confirmation as soon wire has been initiated. Wire should be in our account 48hrs prior to closing.

Jo – I will need Addendum signed by Mr. H reducing the purchase price to $1xx,000.00

Thank you

Mary

Title Processor/Closer

 Land Title  

THE INFORMATION CONTAINED IN THIS TRANSMISSION IS CONFIDENTIAL INFORMATION INTENDED FOR THE USE OF THE INDIVIDUAL OR ENTITY NAMED ABOVE.  IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION OR COPYING OF THIS COMMUNICATION IS STRICTLY PROHIBITED.  IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE IMMEDIATELY NOTIFY ME BY TELEPHONE AND PERMANENTLY DELETE THE ORIGINAL AND ANY COPY OF THIS E-MAIL AND DESTROY ANY PRINTOUT THEREOF.

 

            4.         The thief now is in possession of the closing document package and wire instructions from the closing agent.  But the Buyer is also in possession of the correct information from the closing agent.  Here is where it gets creative.  The thief now sends out an email to the Buyer and maybe the real estate agent from the phony but real new email address and it looks like this:

-----Original Message-----
From: Marymm@landtitles. com>
To:Patricia p@sl.com>  (she is the buyer’s agent)
Cc: CHck77@AOL.COM>
Sent: Thu, Feb 25, 2016 10:36 am
Subject: Re: FW: Wire to Chase Bank

Hi Patricia & H

 We have just been informed by our accounts department that all our escrow accounts are currently undergoing taxation audit. Here is our wiring instruction.

Please advise as soon as wire has been initiated.

Thanks

Mary 

Title Processor/Closer

Title Company HOURS ARE 7:00 TO 3:30.

 THE INFORMATION CONTAINED IN THIS TRANSMISSION IS CONFIDENTIAL INFORMATION INTENDED FOR THE USE OF THE INDIVIDUAL OR ENTITY NAMED ABOVE.  IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION OR COPYING OF THIS COMMUNICATION IS STRICTLY PROHIBITED.  IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE IMMEDIATELY NOTIFY ME BY TELEPHONE AND PERMANENTLY DELETE THE ORIGINAL AND ANY COPY OF THIS E-MAIL AND DESTROY ANY PRINTOUT THEREOF.

 

            5.         Now everyone is confused but it makes sense except if all the accounts were in audit, then what account is this new one?  Isn’t it part of “all”?  The buyer and the real estate agent now also probably “reply” using the phony email address so they are communicating directly with the thief – and by-passing the real closing agent.  And in fact that is what occurred, leaving the real closing agent out of the loop and the fraud now going on directly between the Buyer and the thief and usually the real estate agent as well.

It looks like this:

-----Original Message-----
From: Mary mm@landtitles.com
To: CH ck77@aol.com>
Sent: Fri, Feb 26, 2016 9:07 am
Subject: Re: Wire to Chase Bank

On Fri, Feb 26, 2016 at 3:16 PM, C H > ck77@aol.com wrote:

We have been given three different wiring instructions and hope the last one is right. As it costs $20 each time we send plus the additional taxes accruing perhaps closing statement needs to be revised to reflect. I have never had this kind of trouble to close a deal 

Sent from my iPhone

CH 

Where is the Wire?

            6.         The real closing agent is looking for the wire and it does not show up.  The buyer insists the wire was sent.  A day later the buyer sends to the closing agent – the real one at the real email address because finally the Buyer picked up a telephone – where the wire was sent and the fraud is now discovered.  In the meantime the wired funds, which were received by the thief’s bank, have been forwarded to an overseas account and are no longer recallable by the buyer’s bank.

The implications are huge.  In some cases the buyer is only liable for $50 for the fraud and the buyer’s bank takes the loss – which can be staggering.  But getting reimbursed could take longer than the seller is willing to wait – putting the buyer in breach of contract.

 

Best Practices-

“Best Practices” is a phrase that is bantered about in the real estate closing business.  Sounds to me it’s more like “Lazy Practices”.   This experience is an example of how even Best Practices can be compromised.

A solution – and one that we have implemented in our title company – is that wire instructions are only given by telephone or fax.  And our introduction letter gives specific instruction as to our email address and that we will never change any instruction regarding our bank.  We also use the most reasonably secure method of transmitting wire instructions to the person sending the wire.

But Best Practices?  Our great technology seems to periodically turn into our worst nightmare.  To protect our clients we are doing what our bank does – USE THE TELEPHONE!  Emails make us lazy.  In every one of the emails where the Buyer was questioning the wire instructions from the thief and communicating directly with the thief, never once was there a phone call made to the real closing agent – whose signature block in each of the thief’s emails was indeed correct as to the real telephone number!  Thus the thieves are playing the odds that we and our clients are lazy.  And the thieves are successful because they are right – WE ARE LAZY!

Real estate agents and closing agents should consider regularly changing their email password so if they have been hacked, the hacker needs to start again or abandon the “watch” once there is an interruption in access to the agent’s email account.  Diligence by all the professionals involved should be the highest priority.  AND REDISCOVER THE TELEPHONE!

-----------------------------------------

Copyright 2016 Richard P. Zaretsky

Be sure to contact your own attorney for your state laws, and always consult your own attorney on any legal decision you need to make.  This article is for information purposes and is not specific advice to any one reader.

Richard Zaretsky, Esq., RICHARD P. ZARETSKY P.A. ATTORNEYS AT LAW, 1615 FORUM PLACE, WEST PALM BEACH, FLORIDA 33401, PHONE 561 689 6660  RPZ@ZARETSKYLAW.COM - FLORIDA BAR BOARD CERTIFIED IN REAL ESTATE LAW -  www.ZARETSKYLAW.com

See our easy to find articles at

TABLE OF CONTENTS - SHORT SALE AND LOAN MODIFICATION ARTICLES.

close

Re-Blogged 3 times:

Re-Blogged By Re-Blogged At
  1. Jeff Dowler, CRS 02/29/2016 09:55 AM
  2. Joe Jackson 02/29/2016 10:13 PM
  3. Winston Heverly 05/11/2016 10:13 PM
Topic:
Real Estate Best Practices
Groups:
Realtors®
Prudential Network
Coldwell Banker Group
Florida Realtor® Network
PALM BEACH COUNTY SHORT SALES
Tags:
florida real estate closings
florida real estate attorney
florida real estate lawyer
florida board certified real estate attorney
palm beach real estate attorney
palm beach real estate lawyer
boca raton real estate attorney
palm beach real estate closings

Post a Comment
Spam prevention
Spam prevention
Show All Comments
Rainer
228,857
Jill Winchel
Royal Shell Real Estate - Koffman & Associates - Cape Coral, FL
We make it easy. You make it home.

Great information. Yes, our local board has been advising us of this exact problem. Using a fax would be much more safe than an email.

Mar 01, 2016 01:48 AM #48
Rainer
28,484
Matt Keough, New Castle County, DE
Patterson-Schwartz Real Estate - Wilmington, DE
Matt Keough Agent New Castle County Delaware

Excellent post!  We have to protect our clients & stay ahead of these tactics. 

If only these thieves put their efforts to productive and honest means???!!!...

Thanks!!

Mar 01, 2016 02:24 AM #49
Rainmaker
255,463
Susan McCall, Independent Listing and Buyer Agent
Compass Realty Solutions - Portland, OR
Bringing buyers and sellers together!

I read this yesterday and it was horrifying.  After thinking about it, the one thing that I took away was actually looking at the email address you are using.  So looking at the email and making phone calls.  Many of the title people prefer email but I love to make voice contact, and now it is perhaps the right thing to do.

Mar 01, 2016 02:25 AM #50
Rainmaker
514,643
Elva Branson-Lee
Solid Source Realty GA - Atlanta, GA
CDPE - Atlanta Real Estate & Short Sale Agent

Wow. Thanks for posting this, Richard. One more thing to be careful about when using technology.

Mar 01, 2016 03:54 AM #51
Rainmaker
510,499
Mary Hutchison, SRES, ABR
Better Homes and Gardens Real Estate-Kansas City Homes - Kansas City, MO
Experienced Agent in Kansas City Metro area

Oh gosh this is scary.  Never heard of this scenerio or process.  Thanks for the alert.

Mar 01, 2016 04:26 AM #52
Rainmaker
372,887
M.C. Dwyer
Century 21 Showcase REALTORs - Felton, CA
Santa Cruz Mountains Property Specialist

Our local title/escrow companies alerted us to this kind of fraud some months back.    I'm really glad you wrote about it because I see in the comments that not everyone is aware.   We can never be too cautious!     If you feel something might be wrong, trust your gut and make the call.

Mar 01, 2016 07:30 AM #53
Anonymous
Rich Rawdin

You just need to pay attention to the details and make sure that you know who you are dealing with. I agree this is a huge problem if you are not in the llop. Stay in the loop and there are no poop holes.

Mar 01, 2016 08:54 PM #54
Rainmaker
52,656
Richard D. Rawdin
Saunders & Associates Real Estate - Southampton, NY
Hamptons Real Estate

You just need to pay attention to the details and make sure that you know who you are dealing with. I agree this is a huge problem if you are not in the loop. Stay in the loop and there are no loop holes.

Mar 01, 2016 08:56 PM #55
Rainer
145,448
Theresa Akin
CORPUS CHRISTI REALTY GROUP - Corpus Christi, TX

The title companies I have worked with know I want nothing to do with money wire instructions. That is between them and the buyer(s). One of the title companies has a page you can access the progress of the paperwork. One buyer had a difficult time with a lender and to besure they got the information, she copied me. talk about TMI, I was flabbergasted to say the least. I put it into a vault along with her file but not sure that helps. So far nothing has happened and hopefully won't. I sent her a text informing her. She non-chalantly blew it off as nothing.  SSN you name it. Total history and every dime she made and sources of income. Still makes me nervous. Just goes to show just because you're highly educated in IQ can mean very lacking in common sense.

Mar 01, 2016 11:12 PM #56
Rainmaker
2,494,472
Rebecca Gaujot, Realtor®
Vision Quest Realty - Lewisburg, WV
Lewisburg WV, the go to agent for all real estate

WOW what a nightmare. I I never  receive wiring instructions from the closing agent.  The settlement attorney's take care of the monie/instructions, and Realtors are not included in these emails. I also know that some actually call the buyers.

Mar 02, 2016 12:06 AM #57
Rainer
9,076
Larry Hales
Vancouver, WA
Larry the Title Guy

It happened here in Oregon as well. Our Escrow agent was able to sniff it out though. The agent had a GMAIL account that was hacked. The hacker monitored all of the email up to closing, then sent a request for a change of wire instructions to the Escrow Officer. The hacker took the situation one step further though. They created a FILTER on the GMAIL account to automatically forward all email from any email address from @firstam.com to Deleted Items. What that FILTER did was make it so NONE of the emails sent to the agent would arrive in the INBOX, but instead go to Deleted Items. That Deleted Items folder became the hackers INBOX. 
Very Scary! If you must use GMAIL or Google Apps for your business, use 2-step verification. This will insure no unauthorized computers can access your account.

Mar 02, 2016 12:47 AM #58
Rainmaker
809,051
Diana Zaccaro
Tropical Beachside brokered by eXp - Cocoa Beach, FL
"The Accidental Blogger" Cocoa Beach, Florida

Most agents here add a warning to the client emails to the effect that

Due to recent incidents of fraud, DO NOT WIRE ANY FUNDS without out first calling your REALTOR® and title company for confirmation and to verify the request

or something to that effect and it seems to work for them.

 

Mar 02, 2016 12:50 AM #59
Rainmaker
121,959
Wendy Smith
Wendy Smith Real Estate - Clearwater, FL
Real Estate Advisor

great article.  thanks Richard.

Mar 03, 2016 02:43 AM #60
Rainmaker
704,351
Richard Bazinet /MBA, CRS, ABR
West USA Realty - Scottsdale, AZ
Phoenix Scottsdale. Sellers, Buyers & Relocations

Wow that was quite a read - great warning. And great advice, Thank you for sharing. I can see this happening.

Mar 03, 2016 12:32 PM #61
Rainmaker
1,200,908
Sheri Sperry - MCNE®
Coldwell Banker Residential Brokerage - Sedona, AZ
(928) 274-7355 ~ YOUR Solutions REALTOR®

Richard Zaretsky - Most of us have received the email scams that are out there but if your account gets hacked that is a whole different story.  I personally would never send over confidential info through any unsecured means. For the sake of education, I will make sure I relay this info to present and future clients. Another good reason to have a secure email not a yahoo or gmail account!  Thanks for sharing this.

Mar 03, 2016 07:31 PM #62
Rainmaker
672,370
John Juarez
The Medford Real Estate Team - Fremont, CA
ePRO, SRES, GRI, PMN

Very interesting, Richard. The truth is that any of us can be victimized by hackers. They are getting more sophisticated in their means or deception as time goes by. A little skepticism on our part combined with curiosity that causes us to PICK UP THE PHONE and verify questionable information could save a deal, lots of money and our reputations.

Mar 05, 2016 10:28 AM #63
Rainmaker
335,338
Dana Basiliere
Rossi & Riina Real Estate - Williston, VT
Making deals "Happen"

Many of our local attorneys will still only use fax as it is a more secure transmission. The other option is phone with a verified party giving the instructions. The Internet has turned into the wild west for criminal minds.

Mar 08, 2016 01:25 AM #64
Rainmaker
645,497
Bill Reddington
Re/max Southern Realty - Destin, FL
Destin Florida Real Estate

Lots of ways to scam. Think there will always be new ways to rip people off. Guess thats why the jails are full.

Mar 21, 2016 04:47 AM #65
Rainmaker
281,226
Richard Zaretsky
THE ZARETSKY LAW GROUP - Board Certified Real Estate Atty and AUTOMATED LAND TITLE COMPANY - West Palm Beach, FL
Florida Real Estate Attorney

And here it is again - to the tune of $2,000,000.  Article on 4/18/2016 in NY Post

http://nyp.st/1Sotdzt

Apr 18, 2016 10:23 AM #66
Rainmaker
1,059,537
Sharon Parisi
United Real Estate Dallas - Dallas, TX
Dallas Homes

My account was recently hacked.  Although, I do not share confidential by email or store confidential information on my computer, the ongoing saga has been a nightmare.

May 14, 2016 05:21 PM #67
Post a Comment
Spam prevention
Show All Comments

What's the reason you're reporting this blog entry?

Are you sure you want to report this blog entry as spam?

Rainmaker
281,226

Richard Zaretsky

Florida Real Estate Attorney
Ask me a question
*
*
*
*
Spam prevention

Additional Information