Real Estate cyber attack attempts – how to spot the newest breed

By
Real Estate Broker/Owner with https://HugginsHomes.com 01234617

Phishing Cyber Attack Attempts Against Real Estate Agents, How to Spot Them

I’ve been recently getting several phishing emails that take on a new tactic.  They are looking for an agent to work with on a relocation this year or early next year.  These have many red flags that immediately sound the alarm for me, but I’ve noticed several agents not seeing the same red flags so I’m writing this article to help.   Three of the ones I’ve recently seen are below.  I’ll call them the “The Relocation”, “The daughter” and “Yellow Snow” in this article.  

The Relocation

  On the surface, this email seems like a good thing, but let’s dissect this sentence by sentence.  The “Good day” sentence, nothing wrong here.  The next sentence, “hubby” isn’t a term used often as it is usually a nickname not spoken to strangers, but that can pass.  What I like is that I showed up on a search for “good realtors in California.”  That’s a nice way to butter someone up, but still nothing that hits the red flags.  Planning to relocate to the area… this sentence I would expect the city name (or at least the county name) to be used here, especially since I cover multiple cities.  “We are also first time buyer so we were advice to…” and this is where you go from writing at an adult level to that of a robot that doesn’t understand grammar and sentence structure.  Big red flag there.  “Are u full time?” and “Also how do u get paid?”  Ok, so I’m hitting two sentences at once here.  The use of “u” instead of “you” is again not a manner in which people talk and write emails (texts yes, emails no).  Full-time is not a typical question people ask, even first time buyers.  The how do you get paid question is a good one though.   That concludes the body of the email.  Now I have my email program configured to display the full headers (the part where the “To” and “From” are listed) and this is where it gets full of red flags.  “Lynn Hamilton” sending an email but her email address is “MariaBennetabe”, that fails the sniff test right there.  With an email address based on a name, you’d expect it to say “Lynn” somewhere in there, like on the reply to line where it says “LynnSullivan36”, that makes more sense.  Of course, the fact that you have the email coming from one address with a reply-to as another address is another red flag.  The biggest red flag, where my email program tells me I was BCC’d (Blind Copied) and not put in the “To” line.  If you’re sending a legitimate business email to someone, you put their email in the “To” line.   Now for fun I replied with a basic “Hi, what area are you looking at” email and received the below response:   So now let’s dissect this one! In the header the email address I had replied to (LynnSullivan) writes back and uses the name Lynn Hamilton.  I’d expect the Lynn Hamilton part (I actually saw one that didn’t do that), but you’ll notice the reply-to address is now “LynnTon001” so their switching to yet another fake email address.  Most of these scammers stay with one email the entire time, this person must be new!  At least I’m in the “To” line this time!!! Now for the body.  “Thank u… at such short notice”  Again with the text speak of “u” and now something about short notice.  That doesn’t make sense since that phrase doesn’t apply to anything in this email chain.  Next sentence, her “husband James” instead of “hubby” from the first email and the improper capitalization of the word “I”.  That’s second first grade English class stuff.  Really, a process MIGHT seem new to you as first time buyers?  My guess is it WOULD BE new to you!  Final sentence could be worded better, but at this point I’m just glad they can string a sentence together!  Now for the last line in the email… “Aproval.pdf”  First of all… is should be spelled “Approval” not “Aproval”.  Second of all, this is a link instead of an attached document.  If you hover over the link (but don’t click on it) you will see it points to an “gajaria.in” website.  The “.in” means it is an URL registered in India.  I put the link into URLScan.io, a tool that checks websites to see where they are located, if they have any malicious code, technologies used and much more.  The key thing is on the right hand side a screenshot of the website.  This is a page made to look like the Google login screen.  The goal of the attacker is to steal your Google account credentials and to hopefully use that to gain access to your transactions.  Assuming that you send your emails through that Google address, they could then insert themselves into the transaction and send fake wiring instructions to your clients as you!  

The Daughter

This one is just fun! The header: NOTHING WRONG here!  Unlike the last one, “Jennifer Kumar” is sending from and email “JennyKumar1” and the email is only addressed to me.  All legitimate. The body: This is where it gets fun.  Who starts off a business email with “Hey there”?  Not “Hey Ryan” or “Hey Mr. Huggins” or even the proper “Hello” or “Good Day”!  The first sentence is ok.  If I were an English teacher, I’d mark points off for the use of the plural “homes” unless the daughter really wants to buy multiple homes.  The second paragraph says to “Call, text or email” that’s fine except for that no phone number was given.  One should follow the “Call, text” or at the very least be under her name in the farewell.  Again, to be nit-picky, these are the needs of her daughter, not “my real estate needs” (my being Jennifer).  

Yellow Snow

This one started a big discussion on Lab Coat Agents today and is why I wrote this article.  Like the old joke about eating yellow snow, you don’t want to get involved with this email either. Dissection time! The header: Like “The Daughter” this header has nothing wrong with it.  Let’s note the name of the sender though, Tom Kluivert, as we’ll need that for later. The body: “Hi,” ok, this is starting out good.  “I am Paul Snow” wait, isn’t this email sent from a Tom Kluivert’s email?  Ok, that’s a big red flag!  Let us continue.  “I and my family” proper grammar would be “My family and I”.  They are looking for a five bedroom house and a lovely apartment?  I’m not going to lie, I had to read this line three times just to make sure I read that right.  What does he want?  Does he have two families?  A five bedroom house and an apartment… building maybe? “…i have been pre approved and can forward you my pre approval letter if this will help you understand what i am searching for Kindly advise.”  Again with the lower case “i”, but forget that for a second.  I honestly don’t think a pre-approval letter is going to help ANYONE figure out what he is searching for!  And while we’re at it, there needs to be a period after “for.”  

One other

I’ve received some fun ones in the past (sorry no photos) where they are looking to move to my “City”.  This one throws up the flag because not only is “City” capitalized, but they don’t list which city.

Posted by

Ryan Huggins
Broker, Huggins Homes
CICP, CRISC, CISA, TLO
805.905.4000
Ryan@HugginsHomes.com
HugginsHomes.com

Serving your Real Estate needs in Ventura and Los Angeles Counties

DRE# 01234617

All information is deemed reliable but not guaranteed.

Comments (59)

Mick Michaud
Distinctly Texas Lifestyle Properties, LLC Office:682/498-3107 - Granbury, TX
Your Texas Lifestyle is Here!

It pays to be diligent in getting emails from first time contacts.  I am very wary of these.  Thanks for the heads-up and detailed analysis.  

Nov 25, 2017 10:36 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure.

Nov 25, 2017 07:53 PM
Michael Eisenberg
eXp Realty - Bellingham, WA
Bellingham Real Estate Guy

Wire scam fraud has become such an issue our broker is now requiring us to have a document signed by clients alerting them to this potential problem, We need to make them aware of what is going on and teach them to protect themselves.

Nov 25, 2017 01:04 PM
Ryan Huggins - Thousand Oaks, CA

California put an advisory in as part of the purchase contract.

Nov 25, 2017 07:53 PM
Sam Shueh
(408) 425-1601 - San Jose, CA
mba, cdpe, reopro, pe

We all received similar eMail constantly and they go to trash bin. In each sentence there is a redflag. Some have more than others.  When it was harder to find rent and Apple, Google and Facebook offering $7,500 to 9,000 a month to have a college intern I often received these requests. One mom found my name on my high school alumini and one was a physician. As it turns out these kids did not need me and I would not have got paid for rentals.  One college student sent me requesting measurements of each room and a layout of the house in CAD. He requested furniture, towels, sheets to be provided by home owners for all rooms. These spoiled Ivy league college kids have much growing up to do.   

Nov 25, 2017 01:07 PM
Ryan Huggins - Thousand Oaks, CA

WOW!  Spoiled is right!

Nov 25, 2017 07:54 PM
MichelleCherie Carr Crowe .Just Call. 408-252-8900
Get Results Team...Just Call (408) 252-8900! . DRE #00901962 . Licensed to Sell since 1985 . Altas Realty - San Jose, CA
Family Helping Families Buy & Sell Homes 40+ Years

Wow, thank you for the heads up, we must be on the same email lists for these jokers.

Nov 25, 2017 03:20 PM
Ryan Huggins - Thousand Oaks, CA

I think they're hiting california hard right now, but the entire country to some extent.

Nov 25, 2017 07:55 PM
Eva B. Liland Century 21 Doug Anderson
Century 21 Doug Anderson - Lancaster, CA
Glad to be of Service 661-714-1643

We are now reminded every week or so, to be on the alert. Especially when it comes to wire fraud.

Nov 25, 2017 03:55 PM
Greg Mona
West USA Realty - Scottsdale, AZ
Professional Real Estate Representation for YOU!

Hi Ryan,

Like many others have already commented, I receive these email messages from time to time myself, and with one exception (the latest one!), I have seen right through them and deleted them accordingly.  Unfortunately I was duped recently, and I must say, it passed my initial "sniff test", to the point where I actually responded. It took only one response to my message to see it was a scam, and I was done.  Fortunately no vital information was exchanged, nor anything else that could be compromised, but boy, did I feel stupid! It will be interesting to see where things continue to go to with these type of messages, but sadly they appear to be here to stay.

Nov 25, 2017 08:46 PM
Kat Palmiotti
eXp Commercial, Referral Divison - Kalispell, MT
Helping your Montana dreams take root

Yes, it's important to be aware of the details of these emails, so we can determine which are/are not scams. Also, thank you for mentioning URLScan.io - I'd never heard of it, so am going to check it out.

Nov 26, 2017 04:03 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure Kat.  I used it in my prior career.

Nov 26, 2017 09:29 AM
Theresa Akin
CORPUS CHRISTI REALTY GROUP - Corpus Christi, TX

I get so many of these, it doesn't take long to scan through them and know to immediately trash them. Often you don't even have to open up the email. They give themselves away in the first few words of the subject line.

Nov 26, 2017 04:12 AM
Betsy N. Robinson - Serving the Sandhills, NC
Everything Pines Partners, LLC. - Whispering Pines, NC
CNS

Just delete anything suspicious immediately.  If it happens to be legitimate rest assured you will be contacted another way.  Even it the email is well written and seems to be on target get rid of it completely.  The thieves are getting more and more clever and sophistacted every day.  Always better safe than sorry.

Nov 26, 2017 05:03 AM
Liz and Bill Spear
Transaction Alliance 513.520.5305 www.LizTour.com - Mason, OH
Transaction Alliance Cincinnati & Dayton suburbs

Ryan, These scams remind me of the ones I get from the SEO "experts" saying "we were looking at your website and found errors".  If they don't even specify which of my websites they were looking at in the email, I'm going with "you're a generic spammer" approach and there's no way I'd want you under the hood of my website(s) even if I thought you were legit.  Bill

Nov 26, 2017 05:25 AM
Ryan Huggins - Thousand Oaks, CA

Agreed!

Nov 26, 2017 09:30 AM
Carol Williams
Although I'm retired, I love sharing my knowledge and learning from other real estate industry professionals. - Wenatchee, WA
Retired Agent / Broker / Prop. Mgr, Wenatchee, WA

Hi Ryan,
It's quite annoying how many of these scams are out there.  When you have your radar up, they aren't that hard to spot.  Unfortunately, I think some agents (particularly newer ones) are so anxious for business they ignore the signs.  I know there are some VERY sophisticated scams that are difficult to identify, though.   Thanks for taking your time to write this detailed article.

Nov 26, 2017 09:57 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure Carol.

Nov 26, 2017 11:17 AM
Jim Paulson
Progressive Realty (Boise Idaho) www.Progressive-Realty.info - Boise, ID
Owner,Broker

Solution:  Refer these over to your main competitor for a 25% referral fee.  LOL

Nov 26, 2017 01:46 PM
Ryan Huggins - Thousand Oaks, CA

LOVE IT!!!

Nov 27, 2017 09:19 AM
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

Ryan Huggins - Thousand Oaks, CA "“Lynn Hamilton” sending an email but her email address is “MariaBennetabe”, that fails the sniff test right there."

Right on target - and - re-blog!

Nov 27, 2017 03:36 AM
Ryan Huggins - Thousand Oaks, CA

Thank you for the reblog!

Nov 27, 2017 09:18 AM
Sheila Anderson
Referral Group Incorporated - East Brunswick, NJ
The Real Estate Whisperer Who Listens 732-715-1133

Good morning Ryan. This is superb. So important to ignore, delete and remove any unknown email.

Nov 27, 2017 06:30 AM
M.C. Dwyer
Melody Russell Team at eXp Realty of California, Inc. - Felton, CA
MC Dwyer-Santa Cruz Mountains Property Specialist

Good analysis and a well deserved feature post Ryan.     I've gotten two so far this month - like you, one relocating to California and one posing as part of the escrow team.       Traps for the unwary!

Nov 27, 2017 09:51 AM
Ryan Huggins - Thousand Oaks, CA

Thanks M.C. Dwyer!  Glad you were able to catch them.

Nov 27, 2017 07:10 PM
Anonymous
Donna Benton

I use Quicken and was sent an offer for 5 years and unlimited tech support. Quicken used to not have tech support. I fell for it. I received 2 years and then the # was no longer working. The guy knew what he was doing. Probably used to work for Quicken. He helped me with a lot of issues that I was having and reloaded my accounts. When I called Quicken to report it. They said as many as they shut down, more pop up.

Nov 27, 2017 11:45 AM
#54
Diana Dahlberg
1 Month Realty - Pleasant Prairie, WI
Real Estate in Kenosha, WI since 1994 262-308-3563

I get these all the time ... just delete and move on.  If you don't give me the right information I'm not going to play this game.

Nov 27, 2017 01:22 PM
Pat Starnes-Front Gate Realty
Front Gate Real Estate - Brandon, MS
601-991-2900 Office; 601-278-4513 Cell

Ryan, this is great information. I can usually spot a spam email, especially the first one. The last one went right over my head with the different name, perhaps because I had read three examples in a row. The .IN link is scary and a good warning for us to be careful when clicking on attachments.

Nov 28, 2017 06:09 AM
Ryan Huggins - Thousand Oaks, CA

My pleasure Pat!

Nov 28, 2017 09:37 AM
Ryan Huggins - Thousand Oaks, CA
https://HugginsHomes.com - Thousand Oaks, CA
Residential Real Estate and Investment Properties

UPDATE: I finally got a reply from "The Daughter" spammer.  They included a sensible list of what they were looking for and appologized for not having a phone number in there.  Funny thing is, the phone number was a link THAT LINKED TO ANOTHER NUMBER!  Fun times!  Needless to say I laughed at that and hit delete.

Nov 28, 2017 09:39 AM
Lisa Von Domek
Lisa Von Domek Team - Dallas, TX
....Experience Isn't Expensive.... It's Priceless!

Ryan Huggins - Thousand Oaks, CA Starting early on my New Year's wishes as I have limited time to play in the Rain this week and I don't want to miss anyone!  So....

Dec 26, 2017 08:05 PM
Ryan Huggins - Thousand Oaks, CA

Thank you Lisa!  Happy New Year to you too!

Dec 27, 2017 08:46 AM