At Keystone, safeguarding our clients’ assets is our top priority. We recently encountered a sophisticated fraud attempt that highlights the importance of rigorous security protocols, especially in large transactions like real estate purchases.
The buyer was in escrow for the purchase of a property in an all-cash deal. Their real estate agent had asked them to be prepared to wire the purchase price in the next few days.
Just before closing, the buyer received an email that appeared to be from their real estate agent, copying the escrow company. The email asked if the buyer had received wire instructions for completing the transaction and instructed them to proceed with the wire. The escrow company replied that they had not yet provided instructions but that the instructions were now attached to the email.
Unbeknownst to the buyer, a hacker created fake email accounts for the real estate agent and the escrow company. These imposter accounts began communicating with each other on the email chain, adding an extra layer of believability to the scheme. The fake accounts were very convincing, using the expected timing of the transaction, matching the writing styles of the various parties, and using exact copies of the email display name, font, and email signatures of their legitimate counterparts. On a mobile device, typically only the display name of the email address shows, so it would only be possible to detect the irregularities in the email domains by reviewing deeper.
This is a critical reminder that even the most tech-adept individuals can be targeted for fraud. In our mobile-first and high-productivity world, it can be all too easy to quickly wire money when everything looks fine on the surface and without carefully checking the details. We remind all of our clients to stay vigilant and to be patient with us when we take precautions to verify wire instructions!
Here are some of the key points of the passage
- Fraudsters are becoming increasingly sophisticated with social engineering and targeted attacks.
- Always verify the email domain and details, even if the email appears to be from a trusted source.
- If you have any doubts about the legitimacy of wire instructions, contact the company directly using a phone number or email address that you know is legitimate.
Best,
Peyton
