Real estate agents and law firms have been the target of email phishing scams that have left some would-be buyers without a down payment.
While the scam isn’t new — the National Association of Realtors issued a warning in 2015 and the FTC issued one in spring of 2016 — one couple’s story detailed in a recent Krebs on Security post reminds folks to stay vigilant.
The story details what happened to Jon and Dorothy Little, a couple who were set to close on a home in Hendersonville, North Carolina. The week of the scheduled closing, the Littles’ realtor emailed the law firm handling the closing, asking for wiring instructions.
“An attorney with the closing firm responded with wiring instructions as requested, attaching a document that had the law firm’s logo and some bank account information that was represented as the seller’s account number. The Little’s realtor sent the wire on Thursday morning, the day before settlement,” according to the post.
After signing all the papers at closing, the Littles learned from the attorneys that the money had never arrived.
“Someone’s email had been hacked by the fraudsters and was used to divert the wired funds to an account the criminals controlled,” according to the post.
It turns out the hackers forged the law firm’s letterhead and included their own account information.
According to the story, “Fortunately for the Littles, the FBI succeeded in having the resulting $180,000 wire transfer frozen once it hit the TD Bank account. However, efforts to recover the stolen funds were stymied immediately when the Littles’ credit union refused to give Bank of America a so-called ‘hold harmless’ agreement that the bigger bank wanted as a legal guarantee before agreeing to help.”
In the end, the Littles had to cancel the contract on the house because their $180,000 was tied up for months in an account the Credit Union and the bank were haggling over.
This story comes as a stark reminder to never trust bank account details and payment instructions that arrive via email. Whomever is managing the wiring process should confirm the wiring instructions in person, or at the very least over the phone.
The Littles were lucky in the end. In many other cases, the money is gone and virtually unrecoverable.
“If you’re buying a home and get an e-mail with money-wiring instructions, STOP,” the FTC posted in its March 18, 2016 bulletin. “E-mail is not a secure way to send financial information, and your real estate professional or title company should know that.”
The bulletin goes on to share some tips to help you avoid phishing scams:
- Don’t email financial information. It’s not secure.
- If you’re giving your financial information on the web, make sure the site is secure. Look for a URL that begins with https (the “s” stands for secure). And, instead of clicking a link in an email to go to an organization’s site, look up the real URL and type in the web address yourself.
- Be cautious about opening attachments and downloading files from emails, regardless of who sent them. These files can contain malware that can weaken your computer’s security.
- Keep your operating system, browser, and security software up to date.
And if you think you’re much too smart to get scammed, think again:
“Be aware that these emails are extremely convincing,” warns a National Association of Realtors article. “Many sophisticated parties have been duped. No one should assume that they are ‘too savvy’ to recognize the fraud. In addition, no one should assume that they are ‘too small a target’ to be on these criminals’ radars. This fraud is pervasive, convincing and constantly evolving.”
Are you covered for identity theft?
Get Covered
Image: Pixabay