Hackers target real estate deals, with devastating impact

Rob Lever

Real estate agents and others involved in home transactions have become increasing targets for hackers (AFP Photo/NICHOLAS KAMM)

Washington (AFP) - James and Candace Butcher were ready to finalize the purchase of their dream retirement home, and at closing time wired $272,000 from their bank following instructions they received by email.

Within hours, the money had vanished.

Unbeknownst to the Colorado couple, the email account for the real estate settlement company had been hacked, and fraudsters had altered the wiring instruction to make off with the hefty sum representing a big chunk of the Butchers' life savings, according to a lawsuit filed in state court.

A report by the FBI's Internet Crime Complaint Center said the number of victims of email fraud involving real estate transactions rose 1,110 percent between 2015 to 2017 and losses rose nearly 2,200 percent.

Nearly 10,000 people reported being victims of this kind of fraud in 2017 with losses over $56 million, the FBI report said.

The Butchers, forced to move into their son's basement instead of their dream home, eventually reached a confidential settlement in a lawsuit against their real estate agent, bank and settlement company, according to their lawyer Ian Hicks.

The problem is growing as hackers take advantage of lax security in the chain of businesses involved in real estate and a potential for a large payoff.

"In these cases, the fraudster knows all of the particulars of the transaction, things that are completely confidential, things they should not know," said Hicks, who is involved in more than a dozen similar cases across the United States.

- Email insecurity -

Numerous cases have been filed in courts around the country seeking restitution from various parties. One couple in the US capital Washington claimed to have lost $1.5 million in a similar fraud scheme.

Real estate is just one segment of what the FBI calls "business email compromise" fraud which has resulted in some $12 billion in losses over the past five years. But for home buyers, the fraud can be particularly catastrophic.

"In these cases, the loss can be devastating and life-altering," Hicks said.

Real estate transactions have become a lucrative target for hackers "because they handle a lot of money and because they have employees who are not the most technically savvy," said Sherrod DeGrippo, director of threat research for the security firm Proofpoint.

Additionally, hackers often do their homework and "sometimes they know more about the business than the employees do," she said.

Consumers may also be less cautious when they are feeling positive about a new home, making it easy to fall prey to scammers, DeGrippo said.

"These social engineering tactics rely on a heightened emotional state, and people can be in that state when it comes to purchase their dream home," she added.

DeGrippo said the schemes appear to originate from overseas, possibly from Russia or Africa, using a variety of techniques to stay ahead of law enforcement.

"They employ a lot of money 'mules,'" she said. "They move the cash from bank to bank to bank."

Banks have been working to counter what is seen as a growing fraud problem but are often unable to prevent scams stemming from hacked emails, said Paul Benda, senior vice president for risk and cybersecurity at the American Bankers Association.

"Banks have very strong controls in place," he said. "But when they are given wiring instructions from a customer they have a responsibility to send it where it was instructed."

Benda said that customers need to know a wire transfer is "just like cash" and may be impossible to recover, especially if it ends up overseas.

- Who's to blame? -

Lawsuits from consumers often target real estate agents, attorneys, escrow agents, banks and settlement companies that prepare documents for deals.

"There are a lot of people involved, and (fraudsters) can hack into any one of these parties," said Finley Maxson, senior counsel at the National Association of Realtors.

"These emails have become much more sophisticated, they are much harder to catch."

Maxson said the Realtors and other associations are moving aggressively to educate all parties involved about the potential for fraud and the need for better security.

"We're telling people they should never give these (wiring) instructions by email," he said.

It may be difficult to establish liability, but Hicks said that "consumers are not going to be careless with their life savings" and that the real estate professionals have a responsibility to ensure the security of their systems, and to give customers adequate information.

The lawsuit filed by Hicks for the Butchers said that "the scam that befell the Butchers was well-known in the real estate industry and easily preventable."

Earlier this year, a Kansas court assigned 85 percent of the liability to a hacked real estate agent and awarded a homebuyer defrauded by fake wiring instructions $167,129.

NEVER wire money for RE transactions. You get a certified check and you hand deliver it to your attorney's office. Don't be lazy.

I had NO idea...... When we purchased the condo on the outer banks this summer, we did exactly what they said do. We had our bank wire the money to the attorney's office.

They did indicate in their instructions that they NEVER alter their instructions and not pay any attention to any other e-mail that you may receive.

Amen to what David said. You can always OVERNIGHT a cashier's check from your bank to a reputable title company.

While I am also one who would use a bank check rather than a wire, many settlement agents refuse to accept bank checks and insist on wires. Not positive but I believe in Florida it is a law that all monies are wired.

This is all on the consumer ... deal with a settlement agent that is compatible with your comfort and wishes by finding that out at the beginning. Also, unlike so many who think e-mailing and texting is a good way to conduct business transactions, TALK to a person at the office you are dealing with.

I've said it repeatedly ... all this lack of human contact/communication is not a good thing ... I could care less how "they" want to do things, I don't do things without looking and speaking with folks I am generally dealing with... especially with large sums of money.

"While I am also one who would use a bank check rather than a wire, many settlement agents refuse to accept bank checks and insist on wires. Not positive but I believe in Florida it is a law that all monies are wired."

Yes, on the last couple I bought they said there were too many counterfeit cashier's checks and they won't accept them anymore. I'm not sure if it's a law though or just what the companies here are doing.

I have been hearing about this same scam for many years now. With the severe devastation of such a breach, I'm amazed that they still haven't put in better security and preventive measures to prevent such attacks.

The problem is that certified funds checks can be fake. So this is why closings are done with wiring instructions. And in due time the wiring of funds will need to be hack proofed. As technology advances improves HACKERS will look for ways to break into security codes placed to prevent attacks.

First of all it's "ok" to wire money but if you, the agent and the attorney are all ignorant enough to do what some random email tells you to do then I'm not sure what else to think.

This is almost exactly the same as the people that are getting scammed by the CL ads that come back and say "I'm suddenly out of the country and we need to rent our home ... don't pay attention to any signs that you may see because we can't get them to pull those - just send me $400 and once I receive it I'll send you the keys".

Sounds too good to be true? It usually is.

"Greetings - I am a Prince from a land far, far away - I have millions of dollars that I need to get out of my accounts as quickly as possible - can you help me? All I need is your name, bank account information and your address and I will transfer this amount to your account. I will then contact you once I am safe. For your troubles, I will allow you to keep one million dollars. Please help me.

Uggh ...

People get lazy, wiring money is fine. When you get wiring instructions you need to call the bank your supposed to wire the money to and confirm that everything is correct.

The REAL issue here that is being ignored is this: why couldn't this be traced better? Was it wired overseas!?? That should have been more noticeable to them.

If it was wired to any bank or CU in the USA, then that account should have already been verified. You can't walk into a bank and withdraw $240,000 in cash the next day. The government is supposed to be tracking any transactions over $10,000 anyhow, right?

We're not talking about BitCoin/crypto or something with an anonymous owner somewhere. Was it wired to an account opened with a fraudulent ID?

I'm just curious about the details. Multiple people screwed up here...

- John...

cjl: I don't think it is that simple at all. In this case, the people repeatedly received emails that were proper and expected. The bank TOLD THEM THE NAME of the person that would contact them via email with their closing information and where to wire the funds to. They then received an email from that person.

They had hacked into the real estate company (or bank's) server and were sending the emails as the actual parties involved.

This isn't at all like getting one of those "I'm your friend that is trapped in Nigeria!" scam emails where the people don't really know anything about you.

These people knew EVERYTHING that the bank knew. They had the proper numbers. They were the person that they expected to get the email from.

This wasn't a "sounds too good to be true" thing AT ALL. This was the bank repeatedly emailing them and then finally going "Ok, so, tomorrow, you'll get an email from Sally Goodworker tell you exactly where to wire the funds to so that we can close on your house" -- and then them getting that exact email from Sally Goodworker the next day with the information they expected!

It would be easy for even a seasoned real estate buyer/seller to have been tricked in this situation. I don't see that the people who were tricked were "ignorant" at all really.

- John...

To clarify, it appears that it was the title company that was hacked.

- John...

Sorry for all the posts -- just interesting the more I read about this (which actually happened in 2017, but seems to have been going around the news again recently).

So, Wells Fargo really dropped the ball on this. The couple went to their local branch to try to get things figured out and Wells Fargo did not take proper action at all, it seems. They did not contact the FBI -- and, even when ASKED by the couple to do so, were told that it was "policy" that the FBI not be contacted in these situations.

Had they contacted the FBI, they likely could have stopped it! Apparently, there is a "72 hour" "Financial Fraud Kill Chain" that allows the FBI to cancel wired funds in a fraud case.

The couple finally called the FBI themselves who then conferenced in Wells Fargo -- who then couldn't even find the investigation case number that they told the couple they had opened to look into the problem! Wells Fargo couldn't even confirm if they were investigating or not. It's pretty insane.

I'm glad they sued everyone (bank, title company, real estate company) involved. All of them were partially at fault, IMO.

- John...

Totally agree with you about where this blame lies, John.

In Ohio, payment MUST be made by wire by law. The last few closings we've participated in, the title company has been very clear that they NEVER send wire instructions via email. You have to call to get that info.

John a lot of the stolen wires go overseas to say Hong Kong, from their its a simple matter of moving the money a few times. To countries with more favorable laws.

Its almost impossible for US organizations to trace the money outside of the US.

A lot of countries don't cooperate like, Russia, China, Dubai etc etc.

Chris: Yes, I know that. The issue is that, in general, overseas wire transfers require much more detail than a normal transfer. Most banks -- including Wells Fargo in this situation -- will not do an international wire transfer without the name and address of the receiving bank. Based on this story, I doubt that the email said to send it to a bank in Hong Kong.

It could have went first to a US bank -- and then the hackers did their own transfer overseas, sure. But that would just reinforce how badly Wells Fargo screwed up by not informing the FBI more quickly since they could have then stopped it within 72 hours.

- John...

In all parts of any real estate transaction, funds and property can be lost. From a forged "title", escrow accounts, wire transfers, altered documents, etc. This is why knowledge is important and never sign anything unless you've read and understood it completely.

I believe that's how its done, its transferred to another US bank first.

Indeed. Again, the FBI flat out stated that they can stop a fraudulent wire transfer up to 72 hours from when it was started. In this case, had Wells Fargo reported it to the FBI in time, then it could have been prevented. They definitely were part of the problem (along with whoever had their email hacked, of course).

- John...