This past week the legal staff of the California Association of REALTORS® (CAR) performed a significant service for REALTOR®members and their clients by providing a clear and thorough advisory (Wire Fraud Advisory, WFA) dealing with the on-going problem of fraudulent hacker activity in real estate transactions.
The problem has been around for a couple of years now. Rather than diminishing, it seems to be occurring with greater frequency. In short, what happens is this: the hacker gains access to the "network" of participants involved in a real estate transaction. His entry point may be through a real estate agent's email account, or escrow's, or any one of a number of affiliated services such as title or home warranty. Certainly, the hacking of an agent's account seems the most likely. The hacker will monitor the transaction, learning all the names, phone numbers, and financial information involved. Then, at some point near closing, the hacker will send an email -- posing as one of the relevant figures -- issuing false instructions as to where money is to be wired. Too often, the people who receive the bogus instructions will comply. (This does not always involve principals. In one case escrow was tricked into misdirecting a large commission payment.)
To date many in the real estate community seem somewhat oblivious to these threats. Certainly, not many of their clients know about them. While CAR had already produced a warning advisory about this scam, it unfortunately only appeared as a five-line item -- number 47 of 56 -- contained in a generic 12-page advisory form.
The new advisory (WFA) is a stand-alone on one page. It will be much easier to make it the object of attention, and agents should very much want to do so. The WFA makes 5 specific recommendations.
- Obtain the phone number of the Escrow Officer at the beginning of the transaction.
- DO NOT EVER WIRE FUNDS PRIOR TO CALLING YOUR ESCROW OFFICER TO CONFIRM WIRE INSTRUCTIONS. ONLY USE A PHONE NUMBER YOU WERE PROVIDED PREVIOUSLY. Do not use any different phone number included in the emailed wire transfer instructions.
- Orally confirm the wire transfer instruction is legitimate and confirm the bank routing number, account numbers and other codes before taking steps to transfer funds.
- Avoid sending personal information in emails or texts. Provide such information in person or over the telephone directly to the Escrow Officer.
- Take steps to secure the system you are using with your email account. These steps include creating strong passwords, using secure WiFi, and not using free services.
It is worth noting that the advice does not lean heavily on technological solutions. This is a good thing. In a day when hackers can get into the accounts of Target, SONY, and Mark Zuckerberg -- to mention only a few -- it is probably unrealistic to think that we should rely on our security measures.
Another item to note is that there is much emphasis on getting the right phone numbers at the outset, and then not to be persuaded to switch to another one. Some of the more sophisticated scam operations have call centers set up at the bogus phone numbers, so that if one calls for verification, they will receive a (bogus) assurance that all is well.
No clear lines of liability have yet been set with regard to these scams, but you can be sure that no one will forget to include the real estate agents and their companies in the lawsuit. Agents are well advised to use the WFA or something like it early on in their transactions. And don't say, "oh, it's just another disclosure we have to fill out." Let clients know that this is serious stuff.