According to Forbes "In 2017, a Washington, D.C. couple lost $1.5 million in a phishing scam that compromised their title company’s email server. Last year, a Colorado man lost a $56,000 down payment. And just last week, a tech executive lost $260,000. The tales of financial heartbreak go on.

 

Tom Cronkright, president at Sun Title  is now an expert on what he calls the fraudster “playbook.” It all starts with the industry’s Multiple Listing Service and syndication sites like Zillow and Trulia, where thieves can identify pending home sales. The fraudsters then profile all parties in the transaction (largely using publicly available websites) and attempt to hack one of the email accounts involved.

Once they’re in, they bide their time, watching ongoing correspondence until they can step in and send over false wiring instructions to steal away a down payment, closing costs or mortgage payoff funds.

This is usually done with a spoofed email account, like in my case—one that’s one or two characters off from a trusted party in the transaction.

“This is the playbook—rinse, repeat—nearly every single time we’ve seen across the country,” Cronkright said. “It’s methodical.”

The sheer number of parties involved is part of the problem. Everyone is vulnerable, Cronkright said—attorneys, lenders, agents, title companies, sellers and buyers included.

This is how it works:
1.    Hackers break into thousands of email accounts without anyone knowing.

2.    They watch the activity and spot when someone is about to conduct a real estate transaction.

3.    Just before close, they send a phony email to the buyer. This email looks like it comes from the title company, saying they’ve just changed banks, and providing “new” wire instructions.

4.    In the meantime, they’ve set up an offshore checking account. When the money changes hands, they cash it out and vanish."