How to Protect Yourself from Wire Transfer Scams

 

Imagine you’re 28 years old and, having just sold your computer company, you’re sitting on a pile of cash. Wouldn’t it be great to buy your first house? Wouldn’t it be even better if you could buy it outright?

The young buyer found a beautiful newly constructed ultra-modern home in Pasadena that was recently completed by one of our borrowers. The agreed-upon purchase price exceeded $2.5 million, and the excited buyer put down $300,000 in earnest money, leaving a balance of over $2.2 million. The transaction was handled through title and an independent escrow company. So far, so good.

Just days before the scheduled closing, the young buyer received an email from escrow containing wire instructions for the remaining $2.2+ million. Excited, he quickly wired the funds. Then proudly, and fortunately, he immediately called escrow to notify them of the transfer. There was only one issue; his call was met with deafening silence because escrow never emailed him to wire any money. The email he received spoofed the escrow company and the wire instructions were to a scammer’s account.

The saving grace in this deal was the timely call to escrow. In a panic, he quickly called his bank, which then quickly called the receiving bank. They had received the funds but, thanks to split-second timing, had not yet credited the scammer’s account. Thus, they froze the funds and after a two-week investigation, the lucky buyer got his money back. In the end, his purchase closed normally. Whew!

So, what happened and what should have happened?

First, shame on the escrow company for poor computer hygiene. It’s likely they were either infected with malware that allowed a scammer into their email system or they fell victim to a phishing attack that revealed their login information. Here, anonymous monitoring would enable a scammer to determine all aspects of the deals the escrow company was handling. Armed with this information, they would email fraudulent wire instructions to the buyer in this case, or to a lender in another.

Email, which was invented in the 1970s, became widely used as personal computers became popular in the 1980s. Its use exploded with the internet in the 1990s. Unfortunately, as a 50-year-old technology, email was never designed to be secure. In fact, some suggest that your emails are about as private as a postcard and should be assumed as safe.

With limited information from escrow, it’s an easy task to create an email account and fill out the “Mail From:,” “From:,” “Reply To:,’’ and all other email fields with fake info that accurately spoofs an escrow email account. Hotmail, Gmail, Yahoo mail, and the like, are not designed to verify authenticity. They will report anything a scammer fills out. A suspicious and sophisticated recipient might detect the fraud, but an excited and motivated buyer would not. Nor might any of us as lenders. So how can anyone protect themselves?

It’s common now to see a message, usually bold and in red, at the bottom of any email you receive from escrow or title. The message will caution you to call to verbally confirm if you receive an email changing wire instructions midway through a transaction. This is shortsighted. You must always call to verbally confirm all wire instructions no matter when and how received. Unless you have a verified phone number, several independent sources are preferred. Here’s the multi-step process we use:

  1. We will never accept wire instructions from, nor wire money to, an independent escrow company. Ever. When it comes to transferring money, we only deal with title.
  2. Once we receive the preliminary title report we will find the title company’s phone number online. Never from an email, though we’ll compare the two.

If it’s one of the major title companies, we likely have a verified phone number from a prior deal. We then call and ask them to email their wire instructions. Many, but not all title companies will use encrypted email, and we request that if available. (Why this is not the standard for all title and escrow companies is beyond me.) The email must arrive while we are on the phone with the title rep. If not, we’ll call again later using a different phone number if possible.

  1. A few days before we are due to wire funds, we’ll call again. Here, we ask to verbally confirm the wire instructions. We will ask the title rep to read half of each number to us and we read the second half back.
  2. We repeat the prior step on the day we are due to wire funds, always using a different phone number from a different source if available, even one from the preliminary report, and we attempt to speak to other individuals at the title company if we can.
  3. Once we submit the wire transfer request to our bank, we email or text everyone in the deal, as appropriate. We also call escrow and title requesting notification that the wire was received. You can’t over-communicate here.Not perfect, and we hate to jinx ourselves, but we haven’t had an issue wiring money using this multi-step verification process. If you have any improvements or recommendations, we’d love to hear them. Meanwhile, computer fraud is a rampant problem that grows in our industry. So, if you meet a 28-year-old former computer company owner, now with a head of gray hair, you know how he got it.Jeff Smallowitz is the manager of Private Lending Direct, a CA finance lender. He can be reached at jeff@privatelendingdirect.com.