post

Email Hackers Are Stealing Millions of Dollars From Greater Boston Real Estate Closings

David Bates / August 31, 2017-12:37 pm

Did you hear about the Boston home buyer who got an email from his closing attorney, only it was not from the attorney? It was from a hacker posing as the attorney.

It gets worse.

The spoofed attorney’s email contained wiring instructions for the homebuyer’s forthcoming closing. Once executed, however, the wired funds would not be going to the closing attorney or towards the buyer’s home purchase. Instead, the funds would be heading to an account unrelated to anyone involved in the transaction but was the account of the hacker’s liege.

According to numerous sources, wire fraud like this is occurring with startling frequency in the Greater Boston real estate market.

Kosta Ligris, the founder of Ligris+Associates, a four-office law firm that specializes in Greater Boston real estate, observed a business email compromise scam (BEC) occur in the area for the first time last fall. Since witnessing this type of wire fraud, Ligris estimates he has done 30 seminars on the subject for area brokerages. This past December, he was featured in investigative journalist Hank Phillippi Ryan’s report on the subject.

Ligris, 40, has been involved in Hub real estate since 2001, and his firm has offices in Back Bay, Cambridge, Newton, and Wellesley. In the last 12-months, Ligris says he has spent $300,000 trying to protect the law firm, its network, and its 20-plus attorneys from hackers who try to gain access to the firm’s emails on a weekly basis. Of course, if it is happening to that law firm, it is happening to others as well.

However, it is not just real estate law firms that have to protect themselves. The buyers, sellers, and agents in a transaction also must protect their email from hackers. If hackers compromise any email account involved in a real estate transaction, they can get access to all the details concerning a sale—all the names, contact information, email addresses, and numbers. From there, hackers are perhaps just one spoofed email away from convincing an unsuspecting buyer, seller, or attorney to wire an extraordinary amount of money to the bank account of someone who is at the direction of the hacker.

Spoofed emails are easily mistaken as coming from someone involved in the sale because hackers work hard to mimic the look and feel of that person’s real emails. Spoofed emails can have the same logos and even the same salutations as the real person’s email. Sometimes, the only noticeable difference between a real and a spoofed email is a barely perceptible change in the email address. It is a difference that is so small that it is likely to get overlooked. An example would be transposing the “e” in “michael.jones@xyzmail.com” so that it reads “micheal.jones@xyzmail.com.”

There are a million variations of those slight changes. However, Ligris made clear the sophistication of today’s real estate hackers, describing the time hackers compromised an email account and got hold of a transaction’s purchase and sale agreement. “So, using that deposit amount (listed in the P and S), they went in and they plugged in numbers for appraisal and credit report and closing costs,” Ligris said. Then, they emailed the wire request.

Michael Kelly, the supervisor of the Economic Crime Squad for the Boston FBI, says that while BEC scams hit all industries, real estate “is by far the heaviest hit sector.”

Kelly’s office covers Massachusetts, Maine, New Hampshire, and Rhode Island. In just the past two years, he has logged hundreds of BEC attempts and wire transfers. Although BEC scams are not restricted to real estate and the FBI does not track by industry, Kelly estimated that about three-quarters of BEC scams reported to the Boston FBI concerned real estate transactions and that the majority of those occurred in Greater Boston.

In the 2015–16 calendar year—which goes from October to September—the Boston FBI said that 85% of the BEC scams in their jurisdiction were successful. In other words, 85% of the time, the email recipients wired hackers the funds they requested. That is both incredible and scary.

According to the Boston FBI, BEC attempts have dramatically increased in 2016–17 compared to last year, and the average transfer is $140,000. The silver lining is that the FBI, other law enforcement agencies, and real estate attorneys, brokers, and professionals, and others have reduced the hacker success rate to 37%.

BEC, of course, is not just a Greater Boston concern. It is an international problem. An FBI flyer showed that such cyber crime was found in all 50 U.S. states as well as 78 other countries.

William Mullen, the legal counsel and director of risk management at the Greater Boston Real Estate Board (GBREB) says that GBREB has been educating brokers on BEC for several years and that the organization provides its members with the latest information on an ongoing basis. Mullen says he received a call just last week on an attempt that was foiled. “Those are the success stories we like to hear,” he said. However, as the FBI numbers reveal, not all the BEC stories are success stories.

Mullen described one such outcome, the happenings of a member of the armed services who sold her house and, after waiting a few days to go to the bank, discovered the check she received at the closing would not go through. Apparently, hackers had spoofed her email and instructed the closing attorney to cancel the check and wire the monies instead. They did. “So those funds were gone,” said Mullen.

Mullen also recalled a much, much worse story where $400,000 was inadvertently transferred to hackers.

Note that brokerages are not required to report BEC swindles to the GBREB and the Boston FBI is not the only law enforcement agency to which consumers report BEC crimes. That means that there are even more Greater Boston hacker attempts and successes than have been reported in this post—including, presumably, the over one million–dollar wire transfer to hackers that one real estate attorney told me about but which the FBI could not confirm.

What can be done to prevent hackers from stealing purchase and sale deposits and closing funds?

“Awareness really is the key,” said Agent Kelly, pointing out that “If you don’t know the scheme is out there, you’re not going to look at these emails with any type of skepticism.” Kelly has been getting the word out about BEC schemes and looks forward to the day when wire fraud information will be given to sellers and buyers as a routine part of the real estate sales process.

“You can’t trust email anymore. You have to pick up your phone,” said Ligris. Upon receipt of wiring instructions, the attorney wants sellers and buyers to call the appropriate person and get confirmation that the email they received is legitimate and that the bank account numbers are the right ones.

Of the $21 million that the Boston FBI says has been wired to hackers this year, $11 million has been recovered. However, ten-million is still out there. When it comes to reporting fraudulent wire transfers, like other aspects of real estate brokerage, time is of the essence. The faster it is reported to the FBI, the better chance it has of recovering the monies.

For a complete guide on how to protect yourself against real estate hackers and what you should do if you are a victim, see the links below.

Helpful Links Concerning Business Email Compromise Scams:

The FBI has created a guide that can be accessed here: www.themarreport.com/wp/wp-content/uploads/2016/03/BEC-Flyer-002.pdf

Report any incidents to the FBI’s Boston office at 617-742-5533 and IC3 at www.ic3.gov

Contact the Massachusetts Attorney General’s office at www.mass.gov/ago or the Federal Financial Fraud Task Force at www.stopfraud.gov