email hacking in real estate discussion

[thecompu-doctor]

I wanted to start a conversation for you all to weigh in on. I have numerous real estate based clients (attorneys, agents, title companies, etc...) that we support. I've seen both among a couple of my real estate attorneys and read about other real estate attorneys being targeted for social engineering email scams. Or more importantly I should say the clients of the attorneys are targeted.

It goes like this: person buying the property gets an email that says its the from "the attorney" but really it is just some bogus gmail/hotmail account. This email will include fraudulent money wire instructions. If the buyer falls for it, then they wire away $75k or something similar. Now I don't know how to truthfully isolate where the breach occurred because I don't have access to all the pieces of the puzzle, meaning the buyer's computer and email, the real estate agent's computer and email and things like that. I do have access to my client's stuff and have done thorough virus/malware scans beyond my MSP scans. We changed their O365 hosted exchange password as an extra precaution in case he was somehow compromised at the email level. It would be nice to see IP's that users have logged into their O365 webmail from, but I'm not aware of a way to do this.

The way I see it, the likely ways this breach occurred are:

1. the buyer's email or computer were compromised and a hacker saw communications between a lawyer, agent and buyer and started the scam (this is a crime of oportunity)
2. lawyer or real estate agent were compromised at the email or computer level (targeted crime)

So, how do we combat these types of phishing scams? If the breach is not on my client's end, throwing technology tools and better passwords still wont help as the breach occurred elsewhere and the scammer just used my clients name. Even if the breach happened on my clients end, what can we do to help ensure no one falls for the scam? It would be great if we could somehow do a 2FA method so when the lawyer emails wire instructions, the buyer also gets a text with a secure code or something.

Now two ideas I had are:

• at the start of the buyer, lawyer relationship the buyer gives the lawyer a passphrase that the lawyer must use when sending wire instructions as they get close to closing on the property
  • my concern with something like this is the buyer may forget they didn't see the passphrase if they get fraudulent instructions
• use an encryption email service

Now, my customer does have an email encryption service on top of their O365 hosted exchange and they use it when sending protect info, but not simple wire instructions. This encryption service is much like others where the buyer gets a generic email saying you've got a secure message waiting for you and then the buyer signs into a secure web portal to communicate via email with the lawyer. I know this is a pain and that's why they only use it when sending Protected Info. They can change this habit by company policy, and if need be, we can set it so all email has to be sent encrypted.

A slight side note and a danger when it comes to secure email portals. This same client was briefly/slightly compromised a few months back when he received an email from a real estate company vendor he works with regularly telling him to sign into a secure portal for an email message. This was not uncommon for his communications with this particular vendor so he clicked on the link and entered his username and password. Unfortunately that vendor had been hacked, and the hackers sent out bogus emails to their address book with a bogus phishing secure email portal link. It was discovered in a few hours and he went to the real portal for that vendor and updated his password. I also had him change his email password back when this occurred.

 

[Markverhyden]

What makes you think their emails have been compromised? Do these emails they are receiving regarding making payment contain the specifics, such as the address or legal property description? Is the purchaser's proper name being used? Property transactions are publicly tracked so it's easy to gather this information from public sources.

 

[YeOldeStonecat]

Quite a wide spread scam, my wife had recently changed broker offices, and her new broker had it happen on a closing they were working on..he mentioned it to me, and a few days later while I was down in Florida I came across this article in a local real estate magazine.

 

[nlinecomputers]

What makes you think their emails have been compromised? Do these emails they are receiving regarding making payment contain the specifics, such as the address or legal property description? Is the purchaser's proper name being used? Property transactions are publicly tracked so it's easy to gather this information from public sources.

This. With effort and a trip to the courthouse, I can find out most any and all players involved in an ongoing real estate transaction. A few phone calls pretending to be parties involved can gather the rest through social engineering.

 

[nlinecomputers]

One way to solve some of the problems is for the attorney to use SSL signed email.

 

[eric76]

This. With effort and a trip to the courthouse, I can find out most any and all players involved in an ongoing real estate transaction. A few phone calls pretending to be parties involved can gather the rest through social engineering.

You cannot find out all players involved in an ongoing real estate transaction until escrow is closed and after the property has been recorded with the county.

 

[thecompu-doctor]

You cannot find out all players involved in an ongoing real estate transaction until escrow is closed and after the property has been recorded with the county.

That's what I was thinking.

I do also agree that with the right degree of social engineering scammers can find out lots of info from a call to a realtor for instance.


Now I just found out in this current instance, the scam email sent to the buyer from the "attorney" did have a PDF attachment in it. This PDF was sent out from the paralegal of the attorney the day before to the real estate agent and bank. According to my client, the attorney they (he or his paralegal) have not at anytime had any email contact with the buyer.


Also, in the attorney's normal signature, it states a disclosure about:

But this only helps if people pay attention. This is why I want to figure out some form of verbal 2FA or something like what I mentioned in the original post

 

[YeOldeStonecat]

It's pretty crazy the amount of details they'll get. I happen to know all parties involved in the transaction that I got to see.....I knew the selling agents office, the closing lawyer and his office, and the buying agent. The scam e-mail arrived during the morning of that closing...like 2 hours before the closing, with an urgency to it, and had all the names right. It spoofed my wifes broker...you could see the actual address in the e-mail headers...I had the closing atty copy the headers and send them to me.

 

[mraikes]

If I was going to target someone in a real estate related scam, I wouldn't try to hack attorneys, Realtors, buyers or sellers. I'd target the title companies where closings come together. Anything and everything (names, addresses, dollar amounts, schedules, etc.) are tracked and consolidated at title for the closing. Compromise a title company and you've reached nirvana in phishing possibilities.

 

[Markverhyden]

You cannot find out all players involved in an ongoing real estate transaction until escrow is closed and after the property has been recorded with the county.

Depends on local statutes. Technically even after closing one may not know, as shell companies, etc are very common. Toss in things like foreclosures and liens and it becomes easier. But you can find the transaction principles which is what matters to thieves, especially who is making the payment.

 

[thecompu-doctor]

It's pretty crazy the amount of details they'll get. I happen to know all parties involved in the transaction that I got to see.....I knew the selling agents office, the closing lawyer and his office, and the buying agent. The scam e-mail arrived during the morning of that closing...like 2 hours before the closing, with an urgency to it, and had all the names right. It spoofed my wifes broker...you could see the actual address in the e-mail headers...I had the closing atty copy the headers and send them to me.

Ever figure out where the breach happened?

 

[thecompu-doctor]

Quite a wide spread scam, my wife had recently changed broker offices, and her new broker had it happen on a closing they were working on..he mentioned it to me, and a few days later while I was down in Florida I came across this article in a local real estate magazine.
View attachment 7344

FYI I found a link to the online version of this simple, but educational article. I just shared it out to my numerous real estate related clients. http://www.sun-sentinel.com/real-estate/fl-gary-singer-col-01092017-20170106-story.html

 

[thecompu-doctor]

So, other than hackers possibly finding out from public records (which I doubt due to not having sold the house yet, shouldn't be recorded in public records till after) how are these scammers targeting with such precision the buyer and knowing who their agent and closing company are?

 

[callthatgirl]

This is getting pretty bad. I have 2 clients so far attacked. The first client is a Title Company and after one time, they moved to encryption email only and changed all of their communication processes. The second client, a real estate company, almost transferred $77,000 before someone caught it for wire transfer fraud. He thought he had checks in place right? nope. On Saturday he forwarded me an email of a company that copied his domain, added a letter, bought it off an online print company (that we all know of) and they had information that is on his Office 365 account with MFA! I read the forward, called the online company, talked to their website department and they said the account was already shut down that morning for fraud. WTF?

My client was freaking because the email sent from this fake company had current detail info. We are checking on keylogger and all that and I told him to finally call the FBI, 2nd attack and all that.

 

[thecompu-doctor]

That sounds very similar Lisa and equally scary. There were a couple of real estate lawyers late last year that got hit right at the same time for both around $70k and they did not get the wire cancelled in time. That is when my client above took notice and put in what I think is a very good email signature (pictured above). But that is clearly not good enough.

We all know there is no way to stop some scammer from creating a similar domain/email address and going after the buyer. I'm just wondering how they are finding this info out and how to get to the buyer who will ultimately wire the money. I've checked my customers computers thoroughly and no signs of any kind of keyloggers. So I'm pretty sure this is more of a social engineering scam than a hack/infection/webmail break in. I'm just not sure how this is happening.

What are other things/policies/procedures we can do to put in place to stop someone from falling for this?

 

[callthatgirl]

I told my client to call the FBI, it's outside of my level of knowledge. I'm sure they are inside somehow. But I know the client now has a new process to talk over the phone directly before doing anything with wire transfer. Sad thing is that the scammers know he is busy right now, closing 20 houses a week. I think I do a new employee setup once a month at least. He's one of my favorite clients!

 

[thecompu-doctor]

So I've been googling and found this really good article from March:

http://www.chicagotribune.com/class...03-kenneth-harney-column-20160331-column.html

It specifically says the realtors are the most common target for the hackers to break into their email account. This makes complete sense too. Often realtors are using their own "personal computer" and not one supplied or monitored by a company. Thus they're going to have less security and less knowledge about security practices compared to a title company or real estate attorneys. Plus they have knowledge of virtually every aspect of the transaction from both the buyer's and sellers side to the closing companies side. So if the bad guys break in there, they will be able to watch almost all sides of the transaction and easily pose as the title/attorneys office.

 

[thecompu-doctor]

FYI, this Sunday's PodNutz is going to be on this subject if anyone wants to tune in/call in