Home buyers and REALTORS/real estate agents beware: there's a new scam out there. It seems someone has found a way to send an email to a home buyer, mask it as though it's coming from their real estate agent and ask for money to be wired into an escrow account. The story is making news across the country.
Here's an excerpt from WWMT Newschannel 3 in Kalamazoo:
The Newschannel Three I-Team has a warning tonight about a scam targeting realtors and home buyers.
John Pace was just two days away from closing on his new house when he received the email.
"It was from my realtor apparently and it had several attachments including my closing statement with all the numbers and figures down to the penny what I was paying for the house. It also had wire instructions."
The email asked John to wire $48,000 into an escrow account.
He had no reason to question it, it appeared to be from his realtor.
"The fact that it was coming through my realtor's address and we normally communicate via electronic means... it didn't occur to me to be on guard," says Pace.
Amerifirst Home Mortgage first heard about this scam from a client. "This actually did happen to one of our Portage borrowers," says Sandra Cartwright, Senior Vice President of Sales & Marketing for Amerifirst Home Mortgage. "The borrower received an email that looked like it was from his REALTOR. The borrower thought it was suspicious and immediately contacted his REALTOR and Amerifirst. Because the borrower was alert and immediately checked it out, that a financial catastrophe was avoided."
Vice President of Compliance Sheila M. Strong is keeping an eye on developments. Strong sent out a company-wide communication detailing the situation and offering solutions to help keep borrowers safe.
Scammers are sending mortgage consultants individually addressed emails with new wire instructions for title companies, which are getting passed on to closing & accounting departments only to find out later that the updated wire information was fraudulent. Here is what they indicated:
- Someone poses as a representative of a known Title Company and sends updated wire instructions to the originator via email. This means that they have specific email addresses for the originators.
- The email appears legitimate and initially contains the contact information for the sender. Subsequent emails do not have the contact information or a signature line
- This person has detailed information about the loan closing including the name and loan number and the actual Title Company where the loan is scheduled to close
- The email contains wire instructions with the logo of the legitimate Title Company
- The wire instructions are to accounts at known banks
- Upon close scrutiny of the email address, the customers discovered that they were one character different from the real email address of the Title Company
- Funds are wired per the “bogus” instructions and the funds are withdrawn. We do not have specific detail on how and why the receiving banks were not alerted to the transaction activity in these accounts
What our customers can do:
- Be aware of requests to change wire instructions
- Validate the email address of the requestor
- Ensure that the requestor is someone known to them and if not, reach out to their contact at the Closing Agent to verify
- Within the instructions, check for PO Box addresses, multiple phone numbers with different area codes, area code “347” or any phone number with a “+” in front of it, ensure that the account name is not just an individual’s name, that it properly identifies the Title Company or Attorney’s account. Closing Agent accounts typically reference “escrow account”, IOLTA, etc.
- All discrepancies or anomalies should be verified by our customer with a known contact at the Title Company and not by a response to the suspicious email or to any of the phone numbers provided on that email
- Watch for multiple and “frantic” emails asking about the update to the instructions, when the funds will be there, is the money out yet, and what is the Fed confirm. Be aware that these emails typically do not contain the full signature line of the sender.