Real estate transactions are complex. Detailed real estate records are often available to the public and viewable online. Many states, including Ohio, have Good Funds laws requiring the electronic transfer of money due at closing. Millions of dollars are transferred in and out of real estate escrow accounts each day for the purchase of real estate; the median home price in the US in September 2023 was $394k, according to the National Associate of Realtors. Add to that the COVID-19 pandemic, which made email and text communication the norm and you have the perfect conditions for Business Email Compromise (BEC).

Cybercriminals monitor social media, obituaries, real estate records and other publicly available information to identify upcoming real estate transactions. They then send phishing emails to trick the parties into giving them access to their email account so they can intercept email traffic. This access is used to monitor transaction status and obtain personal information such as downpayment amount. When the title agent sends wire instructions to the customer, the scammer will delete the legitimate instructions. Once the perpetrators are familiar with the parties to the transaction, they can create email addresses similar to the title company or realtor and steal logos and email signatures to make it look like the message came from those trusted parties.

Real Estate cybercriminals are very sophisticated. They often use email addresses just slightly different from title agents. For example, my email address is mccafferty@midlandtoledo.com. A cybercriminal may attempt to impersonate me using mccafferty.midlandtitle@aol.com or mccafferty@midlandtitle.com or mccafferty.midlandtoledo@usa.org. We’ve seen all of these domains used in attempts to defraud our customers. Cybercriminals will use these fake email addresses to send fraudulent wire instructions. Unknowingly, victims will then send wire transfers to the criminal’s account.

• Change your password and turn on multi-factor authentication: Most email servers (Google, Yahoo, Outlook.com etc.) now have capability for users to require multi-factor authentication to log in to their accounts. We highly recommend that you turn on this functionality. Scammers can obtain email passwords from the dark web to easily access email traffic of transaction parties. Changing passwords regularly will help ensure that your password is not public information to scammers. Click here to learn how to turn on multi-factor authentication for Gmail | Click here for Yahoo | Click here for Outlook.com
• Call, don’t email, don’t text: Scammers will pretend to be the title company or other trusted party. DO NOT try to confirm closing information via email or phone number that they provide. Confirm your wiring instructions by phone using a known number on this website before transferring funds. Never use phone numbers or links from an email. Several wire fraud attempts have been stopped when our customers call Midland Title directly to verify instructions.
• Read carefully: Scammers may misspell words when attempting to trick you using a fake email address. According to CertifID, our partner in wire fraud protection, “in one case of wire fraud where the home buyers lost $775k, the scammer used .corn instead of .com to spoof the real estate agent’s email address. They hoped the buyers wouldn’t notice. They didn’t.”
• Be suspicious: Scammers often use unusual language in their messages. According to CertifID, scammers will sometimes use “formal words like ‘kindly’ and ‘dear.’ Wire fraud scammers are often part of multi-national crime syndicates based in countries where they use British English, which often sounds just a bit ‘off.’”
• Take your time: Scammers will make the wire transfer seem urgent. Midland Title’s closing agents will not attempt to rush your wire transfer. We want you to feel at ease with your purchase. If a party to your transaction causes a sense of urgency and uneasiness, slow down, contact your trusted real estate or title agent via phone or in person, and be verify all information before moving forward.
• Call again: It is very uncommon for title company wire instructions to change. If you receive new wire instructions or payment information via email, call again to confirm.
• Confirm everything: Ask your bank to confirm the name on the account before sending a wire.
• Verify immediately: Within four to eight hours, call Midland Title to confirm they received your money. If funds are transferred to a fraudulent account, seconds matter in the recovery of your funds.