Real estate industry hit hard by hackers

22 hours ago
3 min read

Imagine this: You’re a real estate agent, and unknown to you, a hacker gets into your email. Then, also unknown to you, one of your clients, a first-time home buyer, receives fake wire instructions that appear to come from YOU.

Your client calls the number included in the email, thinking they’re speaking with your brokerage’s finance team to confirm the amount and the transaction. They speak with someone who sounds legitimate and confirms all the details of the wire transfer.

So, your client wires their $250,000 deposit and waits...

A few days later, your client calls to ask for an update. Of course, you have no idea this happened because there’s no record of it in your inbox. You get a bad feeling and begin to suspect that the money your client “wired you” is gone. And you would be right.

Could you as the real estate agent be sued? According to recent news, the answers is absolutely yes.

According to the latest IC3 report from the FBI, based on figures reported by the National Association of Realtors last year, at least 12,368 victims and more than $275 million in real-estate-related fraud evaporated, that's roughly three quarters of a million dollars a day.

Those numbers up around 37% from the year before - no surprise considering hackers are now heavily using AI. Escrow and title firms are very attractive targets because they have legitimate high-dollar wire activity, time-critical transaction deadlines and heavy dependence on email.

The Takeaway

Once a hacker infiltrates an agents' email account, they monitor deals, closing dates, parties and amounts. Next they create look-alike domains and mailbox rules to hide their activities, including correspondence with banks, brokers and home buyers.

When the time is right, they'll strike - sending buyers counterfeit wire instructions, often with authentic-looking closing documents and route the money through mule accounts until it eventually ends up off-shore and out of reach.

I know what you're thinking - how do we stop this con? Glad you asked and yes, I recommend you implement these procedures for any business where high value transactions are involved, not just for real estate.

Establish transaction policies. For example beneficiary allow-lists, approved-country restrictions, daily and per-wire caps.
Have cybersecurity monitoring of your company email boxes. If a hacker gains access, they'll create mailbox rules, log in from impossible travel locations and download a large volume of emails so that they can comb through them for anything they can sell or use. Cybersecurity monitoring will catch this behavior and lock down your mailbox before the criminals have a chance to do real damage.
Never accept new or changed wire instructions solely by email. Verify via a known, independently sourced telephone number. DO NOT call the number listed in the email. Scammers will put their phone number on there, waiting for you to call them. When you do, in a very official sounding manner, they'll tell you to wire the money. They can use AI and voice modulation to sound like just about anyone.
Be sure all of your agents, not just your office team have cybersecurity awareness training. Threats, scams and technology is changing at a runaway pace. Having a structured, tailored and professional security awareness training program greatly improves your chances of dodging a major problem like this.
Have a practiced response run book. This includes knowing how to do a bank recall, recipient-bank freeze request, immediate IC3 report, FBI field office notification, evidence preservation, insurer notification and counsel engagement.

Time matters. The FBI Financial Fraud Kill Chain process only has a chance of stopping funds transfers if reported within 72 hours. The key message for agents, title companies, and brokerages is to not wait to complete an internal investigation before reporting. Even though recovery is never guaranteed, the chance of freezing funds declines rapidly as attackers move money through mule accounts.

In short, be responsible, don't lose your clients' money and don't get sued.

Stay safe out there.

-Attila

New Friday Funnies!

What do real estate agents have to be thankful for this year?

Lots.

Which kind of music do realtors love listening to the most?

House music.

What room has no walls?

A mushroom.

What room in your house are zombies most afraid of?

The living room.