Zwiren Title Agency, Inc - ZTA Blog #Cyber Wire Fraud

Identifying Spoofed Emails

Mon, 19 Dec 2022 15:55:01 -0500

Identifying Spoofed Emails

A fraudster's income is largely based on defrauding innocent individuals, so like most other careers, the more proficient they become at their "job", the more they earn. Real estate transactions are a huge target because it means a bigger pay day. This is simply a reminder that they are working relentlessly to defraud individuals because their livelihood relies on it.

Individuals can pay for and implement many forms of cybersecurity defenses such as security software and email spam filters; however, phishing and spoofed emails often get past the defenses and make it to the Inbox. Therefore, it is each person's job to be alert for suspicious activity to keep from becoming the scammer's next victim.

Spoofed Emails in Real Estate Transactions

In real estate transactions, scammers use phishing emails to compromise an email account of someone involved in a deal to gain access to that person's emails. Once they have access, they can read all of the emails related to the transaction and learn specific details that only those included in the emails would know (i.e. loan amount, closing date, funds needed to close, other parties involved in the transaction, etc.). Next, they will try to impersonate someone in the email thread by creating a similar email address or by forging the "email from" address. This is a process known as spoofing. Spoofed emails are emails from scammers that are made to appear like they are coming from a real person.

Spoofed emails are more challenging to spot because the messages look like they are actually coming from a known, trusted party. In real estate transactions, scammers will use transaction specific information gained from studying prior emails, to craft spoofed emails that are difficult to identify. When scammers choose who, within the transaction, they want to impersonate, they will study the prior emails written by that person and note any key words and phrases often used. Then, when crafting a spoofed email, they use those same key words and phrases, along with transaction specific details and will even copy that person's email signature to make it seem more legitimate. The scammer's ultimate goal, when sending spoofed emails, is to send fake wire instructions so funds are sent to their account, instead of the account of whomever is handling the settlement.

When reading about real estate wire fraud victims, many of them have said they had sent a few emails, back and forth with the scammer spoofing emails before receiving fake wire instructions, and they had no idea they were not communicating with the actual person. This is a clear indication that scammers are skilled at spoofing emails and impersonating people. Hence, learning to identify spoofed emails is critical for preventing wire fraud.

The following are some examples of how you can identify a spoofed email.

1. Look at the sender's actual email address.

When sending their spoofed emails, scammers often create an email address that is similar to the person they are trying to impersonate by changing a few characters, or using a different domain extensions (such as “.net” or “.org” instead of “.com”) to trick users into thinking the email has come from a friend, colleague, vendor, client or other known party . They may even create a new email account at a public domain (i.e. Gmail, AOL, etc.) by copying the person's full email address (domain and extension included) to make it appear legitimate. The unsuspecting user won't see any spelling errors in the email address and may overlook the domain. Additionally, scammers often add a Display Name to their email which distracts the user from their spoofed email address.

For example, in the below image, labeled Image #1, the display name says the email is coming from John Smith and it is addressed to you and your co-worker. Not very suspicious at first glance; however, if you look at the sender's actual email address (within the angle brackets) the spelling of "John" and "Smith" are not correct. The "N" in John was replaced with an "M" and the "M" in Smith was replaced with an "N". Plus, in this example, the full email address, domain and extension were used to create a new Gmail account. At first glance, an unsuspecting user sees this email and doesn't think twice because it looks like John Smith's actual email address.

Therefore, if you receive an email from someone you know, but the content of the email seems suspicious, out of character, or request’s sensitive information, double check the sender’s email address to ensure it is spelled correctly and has the correct domain and domain extension.

2. Check where the email response will go.

Some scammers will send spoofed emails that appear to come from the actual email address of whomever they are impersonating. Since the email looks like it came from a legitimate source, checking the sender's email address is not an effective method of identifying a spoofed email. Scammers who spoof emails like this can easily trick users into reading their emails; however, since their goal is to correspond with the user, the scammer needs to receive the user's email reply. They accomplish this by manipulating the email's "Reply-to" settings, which are email settings that allow the sender to program where a reply email is sent. The scammer will program the email so the reply is sent to themselves and not sent to email address of the person they have spoofed.

For example, in the below email header (Image #2), the email address is correct, leading the user to believe the email is legitimate. Upon clicking "Reply", the response message automatically populates an email address into the "To" field, based on sender's "Reply-To" settings. In Image #3 below, the email address that populated in the "To" field is clearly not the same email address that sent the initial email (from image #2).

When an email from someone you know seems out of character or requests sensitive information that is unnecessary for the sender to have, you may have a suspicion that something isn't right, so you check the sender's email address, to make sure it is correct. When the email address is spelled correctly and the domain extension is also correct, check who the Reply Email will be sent to by simply clicking the "Reply" button. Also, if you have any questions as to the validity of the email it may be a good idea to forward the email to the actual person's known trusted email address instead of replying to the suspicious email.

3. Look at the phone number in the email signature

In real estate transactions, parties are typically advised to call and confirm wire instructions before sending wires. Therefore, when scammers send fake wire instructions, they will copy and paste the email signature of the individual they are impersonating; however, they often replace the phone number in the email signature with their own phone number. This ensures the party who received fake wire instructions will call the scammer to confirm the fake wire instructions. When the scammer confirms the fake wire instructions are correct, the unsuspecting user ends up sending their funds to the scammer's account and by the time anyone realizes, the funds are no longer traceable.

Image #4 below, shows John Smith's actual email signature and the scammer's spoofed email signature. At first glance, they look identical, and any unsuspecting reader could be fooled; however, when you look at the phone number in the scammer's spoofed email signature, it is not the same as John's actual phone number. Not only is it different, but it also has an area code for a different state.

Checking the area code can be a helpful indicator of whether the email is spoofed. If you know a company is based out of New Jersey, but the phone number area code is from South Carolina, a warning signal should go off in your head. However, even if the area code was from the same state as the company and the email seems suspicious, you could compare the phone number to another email from that person, but the easiest solution is find a company's phone number online, either on Google (or any other trusted search browser) or by visiting the company website. Especially when it comes to confirming wire instructions, it is recommended that the phone number is either confirmed prior to receiving the wire instructions via email or from a known trusted source (like the company's website).

Always to be On-The-Lookout for Spoofed Emails

Remember to keep these tips in mind when reading emails. Scammers are always looking for ways to infiltrate real estate transactions and exploit individuals for their own personal gain That is why it is important to always remain vigilant when receiving emails, whether it is from an unknown sender, an organization you are familiar with, or even someone you know.

Victims of Real Estate Wire Fraud - Part 2

Fri, 30 Sep 2022 17:04:52 -0400

5 Stories Detailing how Cybercriminals have Defrauded Real Estate Transactions

Read Part 1

Wire Fraud schemes continue to plague the real estate industry regardless of the numerous news articles published, warning buyers and sellers of the risk and the educational materials advising real estate professionals to establish preventative measures. In 2021, the FBI Internet Crime Complaint Center reported 19,954 victims and $2,395,953,296 in victim losses for all business email compromise crimes. Below are some real stories of people who became victims of real estate wire fraud.

Young Couple in California

$921,235.10

The couple found their dream home in Northern California listed at $1.4 million. Thanks to recent family inheritance, they only needed a small mortgage and could pay the rest in cash. The couple was emailing with their real estate agent and the title company about the transaction. They received an email with the closing documents, so the couple reviewed the documents and confirmed all of the numbers were correct. Attached to the same email were wire instructions, so the couple wired $921,235.10 from their bank account to an account at Wells Fargo. Two days later, the lender called asking where they had sent the wire. When they replied that the funds were wired to a Wells Fargo account, the lender told the couple to call their bank immediately because they did not have an account with Wells Fargo. By the time the couple contacted their own bank and Wells Fargo to file a fraud claim, their funds had already been wired out of the Wells Fargo account, into an account in China.

Two weeks later, they bank called the couple. They were able to get all of their money back. While the bank declined to discuss specifics about how they were able to return all of the money, they did advise that as soon as the couple filed a claim, the bank took quick action to recover the funds and due to their immediate action. Fortunately, the couple’s dream house was still on the market, so they were able to continue with their transaction – this time, using a certified check that they carried directly to the closing table.

First Time Homeowner

$42,000

After saving up for years to become a homeowner, in 2021 a young woman in Chicago had enough saved to for a down payment of 20%, which totaled $42,000. She was advised by her real estate agent’s paralegal that they would send her wire instructions the following week; however, she received the wire instructions later that same day from what appeared to be the paralegal’s email address. The email advised that the funds needed to be wired sooner than expected. Nothing within the email made the woman feel suspicious, as the email stated the correct down payment amount, the correct property address, and had her actual mortgage commitment attached. The woman replied to the email asking clarifying questions, which were promptly answered. In total, there were 16 emails back and forth between the young woman and who she though was the real estate paralegal. Later that day, the young woman went to the bank and wired her $42,000, using the wire instructions had received via email.

The following Monday, the young woman received a call from the paralegal, asking about the down payment. The woman replied she had already sent the wire after receiving the paralegal’s email. The paralegal advised she had not emailed the wire instructions yet. The young woman opened her email correspondence about the wire and examined the email address of the sender. The sender’s email address looked almost exactly like the paralegal’s email address, but it had two extra characters. This is when the young woman realized she had become a victim of wire fraud and her entire down payment and years worth of savings was gone.

By the time she contacted her bank, they were able to put a stop payment on $9,000 of her $42,000 down payment; however, it took over a year, and a request for comment from a news outlet, for the bank to deposit the $9,000 into her bank account. Fortunately for the young woman, her parents were able to assist her with her down payment so she could still purchase her new home.

Woman in West Palm Beach

$22,890

Days before purchasing her first house, the house she was currently renting, a 25-year-old woman in West Palm Beach received an email from her attorney’s paralegal. Attached were wire instructions for her $22,890 down payment and closing costs. The woman wired the funds, which was her entire life savings, immediately, as directed. The next morning, her attorney declared they never received any funds and the email she had received was from a scammer.

With all of her money gone, the woman was concerned that she would end up homeless, unable to continue with the sale and unable to continue renting the property. She contacted her bank to report the fraud, within 12 hours of sending the wire. Fortunately for her, all of her money was recovered because the funds were still on hold and had not been routed to the scammer’s account yet.

Man in Kentucky

$70,000

A man in Kentucky received an email from his closing attorney, encouraging him to wire the deposit funds in order to “avoid delay” with closing. The man did not find anything about this email suspicious because he had received several other emails from the same sender earlier in the transaction. He promptly wired more than $70,000 using the wire instructions he received.

At the beginning of the transaction, the man was directed by his realtor, to call immediately after sending the wire. While on the phone with the realtor, they discovered that the email requesting the funds be wired immediately, was not sent by the closing attorney. Upon learning this, the man got into his car and drove directly to his bank. The bank advised that the funds had already been wired.

When the man returned home with the bad news, he reviewed the emails - wondering how he was fooled. After analyzing emails, he noticed that the email with the wire instructions looked identical to the emails that were actually from his attorney. The scammer used the attorney’s actual logo, company letter head and email signature. He finally noticed that the email with the wire instructions was sent from an email address that was one character different from his attorney’s actual email address. The attorney’s actual email address had the word "Louisville" but the scammer's email address misspelled "Lousivile", using one "L", instead of two.

Five days later, the man received word from his bank that his funds were returned to his account and he was able to proceed with purchasing the house.

Single Mom in Texas

$40,000

A single mother spent years saving as much as she could to purchase a house. She was finally able to find a house that she could afford and her offer was accepted. It wasn’t until she was at the closing table and the Title company was asking about her $40,000 for the down payment and closing costs, that the single mother realized something was wrong. The mother had received an email prior to the closing requesting she wire the $40,000. She called her lender in tears, since she had worked her whole life to save up for “the American dream”. The lender was able to re-work the mortgage so she could purchase the house; however, her $40,000 was already gone. Her family has set up a Go Fund Me account to try to make up for her lost savings.

In the above stories, each victim received an email with fraudulent wire instructions yet none of them noticed anything suspicious about the emails before sending their wire. Typical scam emails are filled with typos and grammatical issues; however, when there are hundreds of thousands of dollars on the line, the fraudsters spend time making their emails look legitimate. These emails are targeted, well-crafted, spoofed emails that actually look like they are from the title company or attorney's office involved in the transaction. Additionally, scammers are increasingly using COVID-related excuses to make their messages seem more urgent. For example, the email may say, "Because of COVID we're short staffed so you need to send the wire today", or the email may mention outbreaks at the office, local lockdowns and other timely pandemic issues that require the wire be sent immediately.

As real estate professionals, it is crucial to advise consumers of the risks of wire fraud at the beginning of the transaction, and it would be wise to remind them the closing date nears. Advising clients to confirm the wire instructions before sending the wire, either in person or using a trusted phone number, is an excellent yet simple preventative measure that would have saved each of the victims above. A trusted phone number could either be a pre-determined number or a company phone number found by Googling the company or visiting their website.

Additionally, consider establishing an emergency response plan that details what to do and who to contact if wire fraud occurs. The sooner the bank is contacted after a wire to a fraudulent account is initiated, the higher the likelihood that the funds will be stopped and returned to the consumer. According to a 2021 ALTA Wire Fraud survey, of approximately 550 title agents, a full recovery of funds was only possible in 29% of wire fraud cases and in 40% of wire fraud cases, less than 10% of funds were recovered. Of the companies that were able to recover funds, 58% started the process by contacting the bank, highlighting the need to work quickly to report the fraud to the financial institutions and report all criminal activity to the FBI's Internet Crimes Complaint Center (IC3). In 2020, the FBI's IC3 Asset Recovery team were successfully able to freeze approximately $380 million of the $462 million reported in losses.

The scammers are becoming more skilled at tricking consumers and will continue to do so. Therefore, implementing preventative measures, an emergency response plan and advising clients to be aware of scammer emails is imperative for preventing wire fraud from happening.

The Significance of Confirming Wire Instructions

Victims of Real Estate Wire Fraud

Fri, 03 Jan 2020 14:26:40 -0500

7 Victim Stories detailing how cybercriminals have defrauded real estate transactions.

Many cases of real estate wire fraud go unreported in the media and to the FBI. However, the FBI Internet Crime Complaint Center (IC3) reproted 11,300 victims in 2018 leading to $149 million in losses, and 9,645 victims in 2017 with $56 million in losses. Below are some real stories of people who became victims of real estate wire fraud.

Utah: Elderly Buyers Defrauded

In Utah, an elderly couple received wire instructions from their real estate agent via email. Within the email, the agent added, “I will be in a workshop all day, so don’t try to call me.” Being considerate of the agent's schedule, the couple wired the funds without calling to confirm the instructions.

It wasn’t until the real estate agent received a call from the title company, requesting the buyer’s down payment that they realized the funds had been sent to a cyber criminal. Unfortunately, the elderly couple was not able to recover their $91,000.

Chicago: Buyers Defrauded from Spoofed Attorney Email

In Chicago, buyers received an email from their real estate attorney's assistant, with wire instructions attached. The attachment, on the attorney's letterhead, included the address of the property, the title company's information and the exact balance owed: $307,000.

The buyer's sent the wire but the attorney never received the funds. They later discovered that cyber criminals spoofed the assistant’s email address, sending fake wire instructions that contained their own banking information. Therefore, the down payment was wired to the cyber criminals and not the attorney. The funds were not recovered, causing the victims to lose the entire $307,000..

Colorado: Realtor Wired Buyer Funds

An attorney handling a settlement in Colorado received a request for wire instructions to the escrow account from the buyer's realtor. Another attorney at the firm emailed the realtor with an attachment containing the wire instructions on the law firm's letterhead. There was nothing suspicious about the attachment so the realtor forwarded the instructions to the buyer. The buyer wired their money the day before closing. The following day, at the closing table, the settlement attorney made it clear that they did not receive the $180,000 down payment from the buyer. They soon realized that the wire instructions the realtor had received were fake. Hackers had copied the attorney’s letterhead and put their own bank account information on the attachment .

They tried to recover the funds right away by calling the receiving bank; however, all but ten percent had already been sent to another account, at another bank. They contacted the FBI, who was, fortunately, able to freeze the entire $180,000; however, it took several months for the banks to return the funds to the buyers. The buyers had to cancel their contract on the new home and purchased a heavily mortgaged townhouse instead. Once their funds were fully recovered and accessible, they were able to pay off the townhouse's mortgage.

New Jersey: Mortgage Payoff Defrauded

Three weeks after closing and receiving their proceeds, a New Jersey couple, who had just sold their house, received an email from their bank stating their payment on their old mortgage was successful. They called their bank to question the payment because that mortgage should have been paid off after closing and discharged soon after. They soon discovered that after the closing, the mortgage was never paid off and no discharge of mortgage was ever filed.

Further investigation revealed that their attorney's email account had been compromised. Therefore, prior to closing, the hacker was reading all of the emails about the couple's transaction and when the couple had forwarded the lender's payoff information to their attorney, the hacker was able to see all all. Using the lender's payoff document as a template, the hacker created a replica that listed their own bank account information.

The hacker then used the attorney's email account to send the fraudulent payoff document to the settlement company. Subsequently, instead of wiring the mortgage payoff to the lender, the title company wired the $239,000 straight to the hacker.

After 16 months of communication between the lender, title company, the title company's insurance provider, the couple's mortgage was finally paid off and mortgage discharge paperwork was filed.

Oregon: Life Savings Gone Forever

In September 2016 a Washington lender's email account was compromised which led to a real estate broker's email account getting compromised. With access to both a lender and broker's email accounts, cyber criminals were able to learn all of the buyer’s personal information and the nuances of their transaction.

The title company received wire instructions from the realtor and distributed the funds accordingly. After closing and disbursement of funds, the seller realized they were missing $60,000 of their proceeds. When the seller realized they never received their payoff, they contacted the title company, who immediately contacted their bank and the bank where the money was wired. Ultimately, $25,000 was able to be recovered.

The title company’s email accounts were never compromised; however, they were the recipients of the fake wire instructions that appeared legitimate. The title company claims they they had been training their team on wire fraud and still ended up falling for the scam.

Michigan: Buyers Recover more than half of Defrauded Funds

The day before closing, a buyer in Michigan received their wire instructions via email. They subsequently, wired their funds as instructed. The following day their real estate agent called the buyer, reminding them to bring a $135,000 check to the closing for their down payment.

The buyers soon realized the wire instructions they received were fraudulent and they had already sent their down payment directly to a cyber criminal. They immediately notified their bank and the receiving bank and along with the FBI in attempt to retrieve their funds. Because they acted quickly, these buyers were able to retrieve $120,000 of their down payment.

While these buyers were lucky enough to get a majority of their money back, they still ended up losing $15,000 to cyber wire fraud.

Title Company Wires Funds to Fraudulent Account

While some of these victims were able to retrieve all or a portion of the funds they lost, it is more common that people end up losing everything. These seven victim's stories confirm the significance of educating team members and the end consumer on cyber wire fraud because hackers will target anyone in the transaction that is wiring money.

Try to agree in advance who will manage the wiring process. Don't trust bank account details and payment instructions sent via email until they are confirmed in person, if possible, or over the phone, using a trusted phone number. Additionally, consider creating an emergency response plan that establishes what to do and who to contact after a fraud occurs. Typically, both the sending and receiving bank should be contacted, along with law enforcement, and all parties involved in the transaction. Those who act quickly after funds are wired, have the best chance at retrieving all or a portion of the funds.