Real Estate cyber attack attempts – how to spot the newest breed

Reblogger Tony and Suzanne Marriott, Associate Brokers
Real Estate Agent with Serving the Greater Phoenix and Scottsdale Metropolitan Area BR534744000 & BR540649000

Ryan Huggins - Thousand Oaks, CA "“Lynn Hamilton” sending an email but her email address is “MariaBennetabe”, that fails the sniff test right there."

Right on target - and - re-blog!

Original content by Ryan Huggins - Thousand Oaks, CA 01234617

Phishing Cyber Attack Attempts Against Real Estate Agents, How to Spot Them

I’ve been recently getting several phishing emails that take on a new tactic.  They are looking for an agent to work with on a relocation this year or early next year.  These have many red flags that immediately sound the alarm for me, but I’ve noticed several agents not seeing the same red flags so I’m writing this article to help.   Three of the ones I’ve recently seen are below.  I’ll call them the “The Relocation”, “The daughter” and “Yellow Snow” in this article.  

The Relocation

  On the surface, this email seems like a good thing, but let’s dissect this sentence by sentence.  The “Good day” sentence, nothing wrong here.  The next sentence, “hubby” isn’t a term used often as it is usually a nickname not spoken to strangers, but that can pass.  What I like is that I showed up on a search for “good realtors in California.”  That’s a nice way to butter someone up, but still nothing that hits the red flags.  Planning to relocate to the area… this sentence I would expect the city name (or at least the county name) to be used here, especially since I cover multiple cities.  “We are also first time buyer so we were advice to…” and this is where you go from writing at an adult level to that of a robot that doesn’t understand grammar and sentence structure.  Big red flag there.  “Are u full time?” and “Also how do u get paid?”  Ok, so I’m hitting two sentences at once here.  The use of “u” instead of “you” is again not a manner in which people talk and write emails (texts yes, emails no).  Full-time is not a typical question people ask, even first time buyers.  The how do you get paid question is a good one though.   That concludes the body of the email.  Now I have my email program configured to display the full headers (the part where the “To” and “From” are listed) and this is where it gets full of red flags.  “Lynn Hamilton” sending an email but her email address is “MariaBennetabe”, that fails the sniff test right there.  With an email address based on a name, you’d expect it to say “Lynn” somewhere in there, like on the reply to line where it says “LynnSullivan36”, that makes more sense.  Of course, the fact that you have the email coming from one address with a reply-to as another address is another red flag.  The biggest red flag, where my email program tells me I was BCC’d (Blind Copied) and not put in the “To” line.  If you’re sending a legitimate business email to someone, you put their email in the “To” line.   Now for fun I replied with a basic “Hi, what area are you looking at” email and received the below response:   So now let’s dissect this one! In the header the email address I had replied to (LynnSullivan) writes back and uses the name Lynn Hamilton.  I’d expect the Lynn Hamilton part (I actually saw one that didn’t do that), but you’ll notice the reply-to address is now “LynnTon001” so their switching to yet another fake email address.  Most of these scammers stay with one email the entire time, this person must be new!  At least I’m in the “To” line this time!!! Now for the body.  “Thank u… at such short notice”  Again with the text speak of “u” and now something about short notice.  That doesn’t make sense since that phrase doesn’t apply to anything in this email chain.  Next sentence, her “husband James” instead of “hubby” from the first email and the improper capitalization of the word “I”.  That’s second first grade English class stuff.  Really, a process MIGHT seem new to you as first time buyers?  My guess is it WOULD BE new to you!  Final sentence could be worded better, but at this point I’m just glad they can string a sentence together!  Now for the last line in the email… “Aproval.pdf”  First of all… is should be spelled “Approval” not “Aproval”.  Second of all, this is a link instead of an attached document.  If you hover over the link (but don’t click on it) you will see it points to an “gajaria.in” website.  The “.in” means it is an URL registered in India.  I put the link into URLScan.io, a tool that checks websites to see where they are located, if they have any malicious code, technologies used and much more.  The key thing is on the right hand side a screenshot of the website.  This is a page made to look like the Google login screen.  The goal of the attacker is to steal your Google account credentials and to hopefully use that to gain access to your transactions.  Assuming that you send your emails through that Google address, they could then insert themselves into the transaction and send fake wiring instructions to your clients as you!  

The Daughter

This one is just fun! The header: NOTHING WRONG here!  Unlike the last one, “Jennifer Kumar” is sending from and email “JennyKumar1” and the email is only addressed to me.  All legitimate. The body: This is where it gets fun.  Who starts off a business email with “Hey there”?  Not “Hey Ryan” or “Hey Mr. Huggins” or even the proper “Hello” or “Good Day”!  The first sentence is ok.  If I were an English teacher, I’d mark points off for the use of the plural “homes” unless the daughter really wants to buy multiple homes.  The second paragraph says to “Call, text or email” that’s fine except for that no phone number was given.  One should follow the “Call, text” or at the very least be under her name in the farewell.  Again, to be nit-picky, these are the needs of her daughter, not “my real estate needs” (my being Jennifer).  

Yellow Snow

This one started a big discussion on Lab Coat Agents today and is why I wrote this article.  Like the old joke about eating yellow snow, you don’t want to get involved with this email either. Dissection time! The header: Like “The Daughter” this header has nothing wrong with it.  Let’s note the name of the sender though, Tom Kluivert, as we’ll need that for later. The body: “Hi,” ok, this is starting out good.  “I am Paul Snow” wait, isn’t this email sent from a Tom Kluivert’s email?  Ok, that’s a big red flag!  Let us continue.  “I and my family” proper grammar would be “My family and I”.  They are looking for a five bedroom house and a lovely apartment?  I’m not going to lie, I had to read this line three times just to make sure I read that right.  What does he want?  Does he have two families?  A five bedroom house and an apartment… building maybe? “…i have been pre approved and can forward you my pre approval letter if this will help you understand what i am searching for Kindly advise.”  Again with the lower case “i”, but forget that for a second.  I honestly don’t think a pre-approval letter is going to help ANYONE figure out what he is searching for!  And while we’re at it, there needs to be a period after “for.”  

One other

I’ve received some fun ones in the past (sorry no photos) where they are looking to move to my “City”.  This one throws up the flag because not only is “City” capitalized, but they don’t list which city.

Ryan "The Rescue Realtor" Huggins
Realtor, Huggins Homes
CICP, CRISC, CISA
Top 5% of Realtors nationwide
Top 40 Realtors in California
805.905.4000
Ryan@HugginsHomes.com
www.HugginsHomes.com
Serving your Real Estate needs in Ventura and Los Angeles Counties

DRE# 01234617

All information is deemed reliable but not guaranteed.

close

This entry hasn't been re-blogged:

Re-Blogged By Re-Blogged At
Topic:
Real Estate Technology & Tools

Spam prevention
Show All Comments
Rainmaker
3,325,065
Nina Hollander
Coldwell Banker Residential Brokerage - Charlotte, NC
Your Charlotte/Ballantyne/Waxhaw/Fort Mill Realtor

Great reblog, as I missed the first posting. I get these emails every so often... and without dissecting them... they always scream scam to me. In 25 years, no "real" buyer has ever contacted me with these kinds of "stories" about buying a home.

Nov 27, 2017 03:43 AM #1
Rainmaker
1,763,499
Lise Howe
Keller Williams Capital Properties - Washington, DC
Assoc. Broker in DC, MD, VA and attorney in DC

So glad that you shared this post by Ryan Huggins - Thousand Oaks, CA - it is one of those that can not be reposted too many times! 

Nov 27, 2017 03:43 AM #2
Rainmaker
3,055,915
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

Agreed Nina Hollander and - thanks for stopping by with a comment!

 

Nov 27, 2017 03:49 AM #3
Rainmaker
3,055,915
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

Indeed Lise Howe and - thanks for stopping by with a comment!

 

Nov 27, 2017 03:49 AM #4
Rainer
554,342
Sham Reddy CRS
H E R Realty, Dayton, OH - Dayton, OH
CRS

All real estate professionals need to pay attention for obvious red flags in these Phishing emials.

Nov 27, 2017 03:55 AM #5
Rainmaker
4,432,583
Gita Bantwal
RE/MAX Centre Realtors - Warwick, PA
REALTOR,ABR,CRS,SRES,GRI - Bucks County & Philadel

Thank you for reblogging the post. I missed reading the original one 

Nov 27, 2017 05:21 AM #6
Rainmaker
3,781,087
Sheila Anderson
Referral Group Incorporated - East Brunswick, NJ
The Real Estate Whisperer Who Listens 732-715-1133

Good morning Tony and Suzanne. This is a great re-blog and is terrific information.

Nov 27, 2017 06:29 AM #7
Rainmaker
1,281,577
Ryan Huggins - Thousand Oaks, CA
https://HugginsHomes.com - Thousand Oaks, CA
Residential Real Estate and Investment Properties

Thank you very much for the reblog Tony and Suzanne Marriott, Associate Brokers, I really appreciate it!

Nov 27, 2017 09:22 AM #8
Rainmaker
586,408
Pat Starnes-Front Gate Realty
Front Gate Real Estate - Brandon, MS
601-991-2900 Office; 601-278-4513 Cell

I can usually spot a spam email, especially the first one. The last one went right over my head with the different name, perhaps because I had read three examples in a row. The .IN link is scary and a good warning for us to be careful when clicking on attachments.

Nov 28, 2017 06:08 AM #9
Rainmaker
3,055,915
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

Agreed Sham Reddy and - thanks for stopping by with a comment!

 

Nov 29, 2017 04:04 AM #10
Rainmaker
3,055,915
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

You're welcome Gita Bantwal and - thanks for stopping by with a comment!

 

Nov 29, 2017 04:04 AM #11
Rainmaker
3,055,915
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

Thanks Sheila Anderson and - thanks for stopping by with a comment!

 

Nov 29, 2017 04:04 AM #12
Rainmaker
3,055,915
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

You are most welcome Ryan Huggins - Thousand Oaks, CA - thanks for authoring!

Nov 29, 2017 04:05 AM #13
Rainmaker
3,055,915
Tony and Suzanne Marriott, Associate Brokers
Serving the Greater Phoenix and Scottsdale Metropolitan Area - Scottsdale, AZ
Haven Express @ Keller Williams Arizona Realty

Agreed Pat Starnes, Brandon, MS and - thanks for stopping by with a comment!

 

Nov 29, 2017 04:05 AM #14
Rainmaker
543,900
Francine Viola
Coldwell Banker Evergreen Olympic Realty, Olympia WA - Olympia, WA
REALTOR®, In Tune with your Real Estate Needs

Scary stuff and so frustrating that you have to be so vigilant all the time.  Ryan outlined some really great things to look out for.

Nov 29, 2017 01:32 PM #15
Ambassador
2,154,025
MichelleCherie Carr Crowe Just Call...408-252-8900
Get Results Team...Just Call (408) 252-8900! . DRE #00901962 . Licensed to Sell since 1985 . Altas Realty - San Jose, CA
Family Helping Families Buy & Sell Homes 40+ Years

I re-blogged this one too-don't want any naive but good-hearted folks to get scammed.

Nov 30, 2017 11:29 PM #16
Show All Comments

What's the reason you're reporting this blog entry?

Are you sure you want to report this blog entry as spam?

Rainmaker
3,055,915

Tony and Suzanne Marriott, Associate Brokers

Haven Express @ Keller Williams Arizona Realty
Ask me a question
*
*
*
*
Spam prevention

Additional Information