Wire fraudsters relentless in phishing attempts for down payments, seller proceeds

A very serious cyber threat continues to loom over the homebuying process, and hyper-vigilance is presently the only way homebuyers and sellers, as well as real estate professionals, can protect themselves.

The threat is wire fraudsters, who remain relentless in their efforts steal homebuyers’ down payment funds and sellers’ net proceeds and are becoming increasingly deft at defrauding title companies and consumers alike. We’ve encountered multiple scams in which criminals attempted to phish away down payments and net proceeds funds belonging to unsuspecting to consumers.

How do these wire fraud schemes work?

As far as we can tell, the fraudsters are gaining entry to the email accounts of unsuspecting real estate agents probably through some kind of malware or social engineering attack.

Once the criminals have access to the agent’s account, they scan the inbox looking for information they can use to make their email scams sound more legit, in particular property addresses, closing dates and the title company that will handle the closing.

Next the scammers create a phony email account that looks almost identical to the agent’s legit email account that was hacked – perhaps an extra hyphen or dash is the only difference. With the acquired bait and the phony email account in place, the trap is set.

The would-be victim receives an innocuous email. She recognizes the sender’s name because she has been working with that agent the past few weeks or even months leading up to the closing. If she is not paying close attention, she may not notice the sender’s email address is only slightly different from previous exchanges.

That’s when the defrauding occurs. The victim executes the wire transfer request and the money is gone. Fraudsters are becoming so clever they even time the delivery of their fraudulent emails to coincide with the actual dates and times of closing.

Homebuyers’ down payment funds at risk

In this scenario, the real estate agent’s email account has been compromised and the fraudsters have learned the agent is working with homebuyers and in the final stages of helping them purchase the new property.

With intel in hand, the fraudsters will reach out to the homebuyers from the phony agent email address a day or so prior to closing. The fraudster’s email directs them to wire their down payment funds to the title company’s escrow account in preparation of their big day. In this scam, the “title company’s” bank account belongs to the fraudsters.

We recommend homebuyers verify over the phone the authenticity of any wire transfer instructions just to be on the safe side, because once funds are transferred to the wrong account and cleared out by the cyber-criminals, they are virtually impossible to recover.

Sellers’ proceeds from home sale at risk

This version of the scam targets title companies more directly than consumers, but it’s worth noting because it can lead to a delay in the delivery of proceeds to the seller who may be planning to use them on the purchase of another property.

Just last month our title company spotted two of these wire fraud attempts. We received emails purporting to be from the real estate agent representing the property seller and referencing a property that was scheduled to close at our office. It was a different agent for each case, which suggests the scam may be becoming more widespread.

In the phony email the agent asked for our help wiring funds to the seller’s bank account. In this case, obviously, the scam is that the “seller’s” bank account belongs to fraudsters. What’s not always so obvious, though, are the clues to alert the would-be victim of the fraud that is taking place.

Just as we advise homebuyers, we verify over the phone the authenticity of any wire transfer instructions just to be on the safe side because, again, once funds are transferred to the wrong account and cleared out by the cyber criminals, those funds are virtually impossible to recover.

Many title companies purchase cyber fraud insurance as added protection against increasingly sophisticated wire fraud attempts, including ours. But understanding how the scheme works help avoid the hassle of filing a cyber fraud insurance claim.