Posted May 7, 2015 by Tim Lemieux

---

---

The North Carolina State Bar sent out a warning to its members to beware of changes in payment instructions in real estate transactions. Scammers there hacked or faked the accounts of realtors and sent altered wiring instructions. They could also try to impersonate clients or other firms. (In a previous post about fake emails from law firms we explained how emails can be faked.)

Here’s the text of the warning:

Last week the Bar received multiple reports of fraudulent activity relating to wired funds in real estate transactions, with losses as high as $200,000. Here is a redacted sample of what we have received:

“On a closing that took place on Friday morning, before we disbursed, we received an email and a phone call from a lady purporting to be our out‐of‐state seller asking us to wire funds to her bank account. On Monday we learned that the seller’s email was compromised and bad actors had inserted themselves in her place. We attempted to retract the wire and we learned late yesterday that the bank did not retract the wire and will not communicate further without a subpoena.”

This firm had two‐level authentication practices in place to protect against fraudulent wires, but the hackers emailed and called the firm to confirm the wiring instructions as was required. The hackers gained access to the email account of one of the parties to the transaction and learned the necessary information in order to assume the identity of one of the parties and initiate the fraudulent transaction.

Another defrauded firm noticed after the fact that the email address of the hacker was different from the actual seller’s email address by one letter.

One way to protect against this fraud is for the lawyer to initiate the phone call to confirm the emailed wiring instructions, calling only the number in the client file even if a different number is provided via email.

We haven’t yet had any reports of this from Ontario lawyers, but it’s always good to be vigilant when it comes to communicating about payment and account information. If you have been targeted by any of these frauds, please forward any of the emails and supporting documents that you have received to [email protected]