The news came to Aaron Cole last month while he was driving a truck for the Canby machine shop where he works.
The $123,000 he had wired to buy his family’s dream home? It never arrived. The wiring instructions he received via email had been sent by cyberthieves who’d gone to great lengths to impersonate his title agent.
The money had vanished, and it soon became clear it was lost forever -- likely to crooks overseas.
Having sold his old house and now out the proceeds he’d planned to use for the new one, Cole was struck by the realization he would soon have nowhere for his wife and young kids to live and no money to buy another home.
The 30-year-old sat in his truck and took a moment to “beat the heck out of my steering wheel.” Then he told his wife and spent the rest of the day feeling nauseated.
The Coles were victims of a sophisticated form of cybercrime. Hackers impersonate a real estate or title company online, then trick buyers into wiring money to the wrong bank account.
The FBI says the number of cyberthieves targeting real estate transactions exploded by 1,100 percent from 2015 to 2017 with losses as high as $12 million a month. Operating over the internet, the thieves could be anywhere in the world so the money is rarely recovered.
Though the problem has been widely acknowledged within the real estate sector, the industry and its regulators are struggling to come up with a solution.
Insurance rarely covers such thefts, and businesses are wary of putting new restrictions on how homebuyers transfer money, for fear of jeopardizing deals or making the process more cumbersome or expensive.
There is no comprehensive tally of Oregon victims but there were at least three thefts last year involving more than $100,000 apiece. WFG said it had a dozen clients victimized last year. Since the attacks take place online, the crooks could strike anywhere.
It’s especially devastating for individual families like the Coles, who can lose their entire life savings while trying to buy what they thought was the safest possible investment – their own home.
The Coles’ horror story had a surprise ending. His title company, WFG National, agreed to cover their losses. And with the money in hand, the Coles were able to rescue their deal for their dream home in Oregon City.
“We realized by having such a hard, corporate approach to this…we weren’t taking on the human side of this very well,” said Don O’Neill, WFG’s chief compliance officer.
In exchange, Cole agreed to become a spokesman for WFG’s efforts to raise awareness about real estate wire fraud. WFG hopes such a real-world example will raise awareness among homebuyers and help put the entire industry on guard against such fraud.
“We’d like to have a broader platform to put this information out to consumers and real estate professionals that, frankly, have been a little bit disinterested,” O’Neill said.
Online scams are nothing new, of course. We’ve all had the emails from Nigeria.
What makes this fraud particularly insidious is that the thieves tailor their attack to an individual, using the names of real estate or title agents to fool homebuyers into trusting them. After hacking into an email account, they lie in wait until a deal is near closure.
Then they swoop in with what appear to be wiring instructions from someone the homebuyer already knows.
Sometimes they will insert themselves right into an email thread with the homebuyer’s agent, making it seem the instructions were part of an ongoing electronic conversation. That’s what happened last summer when hackers stole $379,000 from a couple buying a home near Lebanon.
That family got most of their money back because the bank was able to recover funds from the fraudulent account before the hackers cleared it out.
In the Coles’ case, the email with the fake wire instructions appeared to come from a WFG escrow officer.
“Please advise if you can wire closing funds today so that I can provide our updated wire instruction and the exact closing figures,” one email read.
Another: “Leave an email as soon as you confirm that the wire has gone out.”
A close reading of the notes show occasional grammatical errors and unusual linguistic choices that suggest the sender’s first language may not be English. (Americans typically don’t “Leave an email.” We send them.)
But for homebuyers like the Coles, dealing with an unfamiliar process, such lapses may not stand out – especially when the email appears to be from a familiar name and part of an ongoing conversation.
It’s not clear who hacked into Aaron Cole’s email conversation, or how. WFG says it checked its systems and found no evidence of a breach. Cole admits it’s possible someone got into his account, but again, there’s no evidence of that.
That’s the thing about this scam, though. There are millions of real estate transactions every day. Hackers only need access to a few to steal hundreds of thousands of dollars.
“The cost of entry to do this from a criminal standpoint is minimal and the return on investment is massive,” said Bruce Phillips, WFG’s chief information security officer. “Why would you go rob a bank when you can send an email and make a lot more money?”
‘We’re going to take this up’
So, who is going to stop these thefts, and how?
“Now that this is becoming such a rampant problem, education is always good. We’re doing the best we can,” said Jenny Pakula, chief executive of the Oregon Association of Realtors.
And as e-signatures supplant many elements of the homebuying process that people used to do in person, it’s easier for homebuyers to get confused about who they send money to, and under what circumstances.
“There are disclosures and notices provided but let’s face it, it’s a lot of paperwork,” Pakula said. And it’s easy for a homebuyer to overlook a caution about wire transfers in a pile of forms about home inspections, loan terms and title insurance.
There are few regulatory safeguards around wiring money and insurance doesn’t usually cover this kind of theft.
“Now the scams are just so sophisticated. They’re using technology and they’re just so sneaky,” said Ellen Klem, director of consumer outreach and education for the Oregon Department of Justice. “Once you wire this money it’s virtually impossible to get it back.”
Real estate organizations and regulators are cool to the suggestion it may be time for reform. They want to see if raising public awareness, highlighting examples like the Coles’ experience, may stem the tide.
If that doesn’t work, though, Klem and others say they are open to exploring new practices, rules or regulations to fight the thefts.
“I’m very intrigued by the idea of looking into that issue and seeing if there should be more protections,” Klem said.
Voices within the industry remain cautious but allow that it may be time to start exploring other solutions, like wire fraud insurance or requiring extra steps before wiring large sums of money in connection with a home purchase.
“It’s an interesting topic to explore. I don’t know for sure whether it’s realistic or feasible,” said the Realtors’ Pakula. “We want the problem to stop but potential solutions have to be explored.”
Dean Owens, acting commissioner of the Oregon agency that licenses real estate brokers, property managers and escrow agents, agreed that caution is needed. “We have to think really carefully before we put somebody in a position to oversee the transfer of funds for somebody else,” he said.
Asked about the monetary implications of implementing new safeguards, Owens said, it was “on our radar. We’re going to take a look at it and we’re going to have a conversation about it.
“Consumer protection is what we should be looking to do, and we’re going to take this up.”
As regulators and trade groups ponder the options, Aaron Cole is settling into his new home with his wife and kids, ages 3 and 5.
It’s 1,000 square feet bigger than the place he sold last year, with bedrooms for each of the kids and a bathroom and full-size closet in the master bedroom. Chastened by his near miss, Cole said he’s hopeful his experience will serve as a cautionary tale.
“Don’t take anything to be gospel,” he said. “In the future, I know that I will call on every single transaction and email.”
-- Mike Rogoway | twitter: @rogoway | 503-294-7699