Read more about
mortgage wire fraud at:
The couple’s subsequent lawsuit against the mortgage lender, real estate agent and mortgage broker
alleges that “during the negotiation, inspection and
closing process, the defendants routinely sent sensitive financial information through non-secure e-mail,
violating their own and industry guidelines.” The couple’s attorney believes that someone hacked into one
of the companies’ databases, retrieving sensitive financial information to which only they would be privy.
The fraudster then sent a wire request under the
guise of the closing company, requesting the cash
prior to close. In essence, the couple was duped into
wiring their downpayment directly to the fraudsters
rather than the title company assisting in the closing.
The threat is growing
The above stories are, in fact, fairly simple examples
of identity fraud in the closing process. The challenge,
however, is that it appears fraudsters are getting more
aggressive and more sophisticated. By impersonating
businesses that are legitimately involved with a target
transaction, fraudsters are starting to demonstrate
a real familiarity with the industry, its norms, timing
For example, in the first case — and in at least 20
other cases the company heard about while researching their case — the fraudulent impersonator never
sent e-mails before 9 a.m., which is common practice
in the title industry. Nothing happens before 9 a.m.
when it comes to a closing. The company also saw fake
domains or e-mail addresses that replicated those of
legitimate businesses — down to a difference of a hexadecimal or single letter.
The “trigger” to these types of fraud usually involves
a change in wiring instructions or the delivery of wiring
instructions in the first place. Unfortunately, numerous
genuine mortgage transactions involve legitimate
changes to wiring instructions. It’s no secret that the
days leading up to a closing are usually chaotic, stressful and volatile. All parties can see the proverbial light
at the end of the tunnel, and nobody wants to add to
the cost or, especially, delay the closing by verifying
identity over and over again.
A recent article in RIS MEDIA by Matt Cohen did an
excellent job summarizing the typical identity fraud
from a real estate agent’s perspective. Originators
and other mortgage professionals may recognize
several of the red flags from that article described
here. Typically, a fraud starts with a hacker accessing a real estate agent’s transaction-management
system, a lender’s loan origination system or a title
company’s database. This attack usually begins via a
From there, the hacker enters the system, identifies
transactions ripe for fraud and collects sensitive information that only a housing professional would have.
Unfortunately, many people use the same credentials
for their e-mail and data-system access so it’s quite
possible for hackers to access an agent’s or originator’s
e-mail account at this point as well.
It’s not uncommon for a hacker to set up an e-mail
filter to begin capturing e-mails sent by the targeted
client. These messages skip the professional’s inbox
and go straight to the hacker. At this point, the hacker
can send messages to clients directly from the real estate agent’s actual e-mail address.
Even if the hackers never access lender or title
company systems, they can get sensitive information about those parties from the Realtor’s transaction system, and can replicate e-mails from those
professionals as well. Hackers can even send e-mails
from multiple spoofed accounts (e.g., the lender and
the title agent) to verify information to each other.
The rest of the scheme works like a typical wire
fraud. When the time comes, the hacker instructs
clients to wire their closing funds to an account the
What can be done?
Although data breaches continue to be a major focus
of cyber criminals, real estate fraud today has leveraged sophisticated social engineering techniques designed to “trick” someone into doing something they
would not normally do. It’s a modern-day version of
a con man but instead of face-to-face trickery, they
use technology and industry knowledge as their tools
of choice. This makes it harder to identify and stop a
fraud scheme once it starts.
Often, the solution to this type of fraud involves
some combination of increased diligence, the deployment of common sense and a simple technological enhancement. Unfortunately, all of these things
still may not be enough to detect identity fraud at or
prior to closing. A new phone-porting scam makes
“call and verify” a waste of time once fraudsters insert themselves into the chain of communication.
In such cases, the title agent or Realtor is basically
calling the imposters and asking them to verify their
A healthy dose of caution and skepticism on the
part of all stakeholders in a transaction never hurts,
but it’s going to take more to fight back. This includes a way to identify and verify the communication device being used when wiring instructions are
delivered. This means verifying that all stakeholders
— especially parties that aren’t present at the time
of the closing — are who they say they are and also
have a legitimate stake in the transaction in the first
place. It means confirming and authenticating bank
It’s amazing how little information comes with
some wire requests. The industry has seen plenty of
examples of wire fraud where the bank’s name did
not match the routing number included on the wiring instructions.
As with any sophisticated fraud, combatting the
closing-fraud menace will require layers of technology working together with trained and aware professionals. There are technologies coming online right
now that can help. The most effective ones are designed to authenticate parties to the transaction using multiple, overlapping sources of data. There are
effective ways to do this that are not so expensive as
to be prohibitive to smaller companies.
n n n
For now, it’s time for the housing industry to become
aware of the growing menace of wire fraud and to
heighten its awareness at all levels, from originators
to title agents and beyond. As sophisticated as these
fraudsters are, they prefer to work under cover of
darkness. By making wire fraud a point of emphasis
across the industry, we can take away this advantage
and expose their intent before any more borrowers
suffers a loss. n
<< Menace continued from Page 66 “Combatting the closing-fraud menace will
require layers of technology working
together with trained and aware
RISMedia Fraud Article:
FBI E-mail-Fraud Report:
Colorado Case-Study Article: