Written by: Kyle Thompson
There are few things more exciting in life than purchasing your first home. Sadly, sophisticated criminals have been taking this joyous moment from soon-to-be homeowners and turning it into an unforgettable nightmare. Wire fraud is on the rise and we have all heard the horror stories, but I am guessing many of us would deny that we could ever become the victim.
The Background
I have been given permission to share a real-life story that recently happened to a client. For privacy reasons I have redacted all names, but the elements contained within this story are accurate. My client lives in an expensive real estate market and has saved aggressively over the past 10+ years to have a sufficient down payment to purchase her first dream home. Towards the end of 2020, she had identified a property and her goal of owning a home was about to become a reality. By the end of the year, a purchase agreement was in place and closing was scheduled for February 5th, 2021.
We spent time throughout January discussing how best to fund the down payment and where the funds would be sourced from. We ultimately decided to wire the funds from her brokerage account. While the closing was not scheduled until February 5th, the client had instructed us to send out the wire a week early on January 28th since everything was in place.
However, the wire amount was $76 short after trade settlements and had to be placed on a three day hold while a new trade settled to cover the shortfall. As you will soon learn, this $76 dollar delay likely saved the client hundreds of thousands of dollars. The funds cleared on February 3rd and we were instructed to submit the wire so the money would be in the escrow account ahead of the February 5th closing.
I spoke with the client beforehand and we validated that the information we received matched what she had on file, including the name of the title company, title officer, and account number. The information was confirmed, and the wire passed all of our internal checks. It was submitted for processing on the afternoon of February 3rd.
Fraud in Action
The next day, I received a call from the client indicating that the funds had not yet posted. At the time I did not think much about it. I quickly got our administrator involved thinking either there was a wire delay, or a number got transposed on the wire instructions. We immediately called the custodian and they confirmed the wire was delivered and the information we had on the wire matched the information we had been provided.
At this point in the process, my next call was to the title officer. He confirmed that the wire had not been received and he asked that I confirm the account number we had on file. I got two numbers in when he stopped me and stated, “That is not our account number.”
That phrase hit me like a ton of bricks and my heart immediately sank. I knew at that very moment my client had been a victim of wire fraud. I literally hung up on the title officer, quickly called the client, and shared the terrible news.
Team Effort
I cut the call very short as I needed to get ahold of our custodial service team. To their credit, they immediately transferred me to the fraud team and within minutes the wire was being recalled. At this point nobody knew if the funds were still in the fraudulent account or not. The only assurance I was provided was that a criminal investigation was being opened. We were truly in a wait and hold pattern, which was not comforting for any of the parties involved. I once again called the client and shared everything I knew. It is safe to say we both had a very stressful night.
Later that evening, I was contacted by the fraud team and they walked through the entire chain of events. They confirmed we had followed their best practices and guidance around wire transactions. As I unpacked the case with them, I could tell they were shocked by the information I was sharing. They later acknowledged this was the most sophisticated fraud scheme they had seen to date and asked if they could use this particular situation as a future case study to train their team and employees.
How it Happened
While I don’t have all the details since this is still an ongoing investigation, I can share some of the specifics on what the fraudsters did to commit this crime. It is believed that this is a classic phishing scam where the criminals discovered the real estate closing through public records and identified the parties involved.
Once they knew who the parties were, they created an alias using emails that appeared legitimate but were being sent from incorrect email addresses. While my client believed she was sending emails to her real estate agent, mortgage company, and title officer, these emails were likely being diverted to the scammers who were sending back the information that they wanted my client to act upon. It appears that at some point they intercepted the correct wire instructions. They manipulated the original wire instruction document by updating the account number. Once they were done with the document, the letterhead and title officer signature matched the official wire instructions, but the account number had been changed.
My client had no idea any of this had happened as these were the only wire instructions she had received. Looking back through the information the only red flag was a very minor adjustment in the email addresses (this would have been nearly impossible to catch if you were not actively looking for an error). The spelling and grammar within the emails and text messages were error free. The signatures and contact information for the title officer matched what my client had on file. These criminals even went a step further and texted my client claiming to be the actual title officer prior to sending over the fraudulent wire instructions.
The text read, “Hi (client name), I sent you an email regarding (property address), kindly confirm receipt and advise. Your closer, (title officer and title company).” This was a fraudulent text that was received the same time the wire instructions were sent, making the instructions appear to be fully authentic. It is likely that in the days preceding the wire transfer my client was talking with the criminal who was disguised as the title officer.
The $76 Miracle
On February 4th, one day after the fraud was discovered and one day prior to the original closing date, we received the amazing news that the wire had been recovered. The custodian was able to find the money and return it back to the client’s account on February 5th.
This is where the $76 issue from above saved the day! As fraudsters are prone to do, they got greedy. The criminals had targeted several individuals and had multiple wires funneled into the fraudulent account starting a week prior. This raised alarms for the bank where the funds were being funneled into and they froze the account the morning of February 3rd (right before our client’s wire posted). If the $76 delay had not happened, the funds would have been received on January 28th and likely would have been transferred out prior to the account being frozen.
How We Will Handle Wire Transfers Going Forward
This story ended up being a best-case scenario and the client miraculously was still able to close on her original closing date of February 5th. However, this could have ended in the worst possible way and the client could have been out hundreds of thousands of dollars with no house. We do not have the final findings from the custodian’s internal fraud investigation or from the FBI, but we will be changing how we handle all future wires even though these steps are not currently required.
In an abundance of caution, we will not only confirm all wires with clients as we have always done in the past, but we will also recommend that we call the title company with our clients to confirm the account number on file and to confirm the wire instructions. We will no longer accept emailed wire instructions without fully validating them with the actual title and mortgage companies.
When it comes to wiring funds, you need to take every possible preventive measure. I share this story not as a scare tactic, but as a reminder that we can all become targets in these ever-evolving criminal schemes. The steps we take to validate future wires may be somewhat annoying, but please understand that the reason is simply to protect you and your hard-earned money.
I am so thankful everything worked out for my client and will do everything in my power to ensure something like this never happens to you!