Secret Service

Secret Service issues new Advisory

Standard

Real estate impersonation scams have “evolved”, it says

In September, the United States Secret Service issued an update to its “Real Estate Scam – Vacant Properties” Advisory (v. 1.1) The original Advisory was issued in Spring of 2022.

The current Advisory warns that the Secret Service has become aware of an increase of instances where criminals are impersonating title companies to steal real estate funds. Remember that “title companies” actually close transactions in many states. In South Carolina, the bad actors would impersonate law firms and banks.

Now more than ever, it is important for everyone involved in a real estate transaction to validate wires before they are sent. The last thing you need is for your law firm to have to provide funds to replace lost closing proceeds!

Often, the perpetrator impersonates the title holder and negotiates to sell unoccupied property to an unsuspecting buyer. Once the contract is signed, the criminal directs the buyer or realtor to the criminal’s account, impersonating a title company or law firm. The perpetrator impersonates the closing office by purchasing fake domains, similar to the closing office’s domain. (Such as me@lawfiirm.com vs. me@lawfirm.com.)

Red flags are identified by the Advisory:

  • Communications are primarily by email and communications contain poor grammar.  (This is from me, not the advisory. If you ever seen the word “kindly”, such as “kindly wire the funds to….” Remember we don’t typically talk that way! Any twisted language or bad grammar may indicate the communication is coming from someone and some place with a first language other than English. Always use common sense!)
  • Wiring instructions are sent over standard email instead of a secure email platform.
  • The listing is below market value and the “seller” is looking for a cash buyer or quick closing.
  • The “seller” wants to use its preferred closing office.
  • The closing office is outside of the area where the real estate is located.

The Advisory suggests the following avenues of prevention:

  • Conduct an online independent search of the entity to which the funds are to be wires.
  • With a known phone number (from a trusted website or previous contact) CALL and verify the wiring instructions and names on accounts.
  • If possible, visit a local branch of the entity to which the funds are to be wired.
  • Obtain a government issued ID from each party, and evaluate IDs for abnormalities.
  • Consider a form of multi-factor authentication with your clients. For example, send an overnight letter to the mailing address on the tax bill asking the property owner to call you with a one-time code embedded within the letter.

To read more, visit http://www.secretservice.gov. And be careful out there!

Be Vigilant to Prevent “Business E-mail Compromise” Scams

Standard

fraud alertWire fraud is on the rise! Train your staff!

United States business e-mail accounts are under attack by sophisticated fraudsters.

The FBI, Financial Services Information Sharing and Analysis Center (FS-ISAC) and the United States Secret Service issued a financial services bulletin on June 19 warning against increasing wire transfer fraud against U.S. businesses referred to as “Business E-mail Compromise” (BEC) scams.

The bulletin warned that BEC is a type of payment fraud that involves the compromise of legitimate business e-mail accounts for the purpose of conducting unauthorized wire transfers.  Many compromised accounts belong to business CEOs or CFOs. The funds are primarily sent to Asia, but funds involved in these schemes have been diverted to locations around the globe.

BEC fraud compromises e-mail accounts through phishing, social engineering or malware used to obtain the user’s password. Once an e-mail account is compromised, fraudsters begin accessing and reviewing e-mails, including meeting and calendar information, contacts lists, and information concerning business partners, vendors and customers.

This activity enables the fraudsters to interject themselves into normal business communications masquerading as the person whose account was compromised. This reconnaissance stage lasts until the actor feel comfortable enough to send wire transfer instructions using either the victim’s e-mail or a spoofed e-mail account.   E-mails are typically sent to an employee with the ability to wire funds. A common tactic is to wait until the victim is away on legitimate business travel to send new wire instructions, making it more likely that individual would use e-mail to conduct business and making it more difficult to verify the transaction as fraudulent while the victim is in transit. The requests will sometimes state that the wire transfer is related to urgent or confidential business matters and must not be discussed with other company personnel.

Other incidents involve the compromise of a vendor or supplier’s e-mail account with the intention of modifying the bank account associated with that business. This scheme may also be labeled “vendor fraud” and often involves last minute changes of the bank and account number for future payments.

red-phoneThere is a relatively easy fix: all wire information received via e-mail should be verbally verified using established business telephone numbers.

Other suggestions to guard against this fraud are:

  1. Limit the number of employees with authority to handle wire transfers.
  2. Have a second employee designated as an approver for any wire transfer requests.
  3. Be careful opening attachments and clicking on links even if the e-mail appears to be from a legitimate source if you believe wire instructions may be included in the communication.
  4. Look out for e-mails that contain significant changes in grammar, sentence structure and spelling compared to previous communications.
  5. Look out for suspicious communications particularly toward the end of the week or the end of a business day. The fraudsters will have more time to access and divert funds.
  6. Maintain a file, preferably in non-electronic form, of vendor contact information, including telephone numbers.
  7. Look out for “spoofed” e-mail addresses that are made to look like the real addresses. Fraudsters use tactics like character substitution, addition and omission to make e-mails addresses appear legitimate. Here are some examples using a Chicago Title address, richard.roe@chicagotitle.com
  • roe@chicag0title.com
  • roe@chicagotit1e.com
  • roe@chicagotitlee.com
  • roe@chicagottle.com
  • roe.chicagotitle@gmail.com
  • roa@chicagotitle.com
  1. Be wary of wire transfers to countries outside of normal trading patterns.

ic3 circleIncidents should be reported to local offices of the FBI or Secret Service or to:

Dirt lawyers, protect your businesses and your clients’ funds by following these critical guidelines!