Wire Instruction Fraud Plagues NC Lawyers

Over the last few weeks, Lawyers Mutual has received multiple reports of North Carolina attorneys who were targeted by scammers attempting to divert seller closing proceeds following real estate transactions.  Unfortunately, several of these attacks were successful and hundreds of thousands of dollars were stolen and are very unlikely to be recovered.

I’ve asked our claims attorney, Troy Crawford, to talk with me about what went wrong and how to prevent it.

Troy: While the details of the recent scams are emerging, it appears hackers first became aware of the closing by compromising email accounts of differing parties.  Sometimes the attorney account was compromised, sometimes the Seller’s account was compromised but the most common scenario was the Realtor’s account was being monitored by international criminal organizations.

Camille: Sounds scary. How does this scam work?

Troy: The foreign-based hackers would observe the account, likely for several weeks, and only actively intervene once an understanding of the business practices were obtained and a significant wire was to be produced.  In the interim, the unsuspecting Realtor would continue to use the account unaware his or her client and the closing attorney were being set up to be robbed.

Camille: What can lawyers do to avoid falling victim to the latest series of scams?

Troy: EVERY wire request should be verified and the more personal the verification, the better. The best way to verify wiring instructions is to have the Seller sign the wiring instructions at the closing ceremony in the presence of the attorney.  We know of no wire fraud which has taken place when this has occurred, and even if it did, the closing attorney would likely be insulated from liability by the doctrine of contributory negligence.

If the Seller is unable to attend the ceremony, we recommend the wiring instructions be included in the same package in which the deed is delivered.  In these situations, have the Seller sign wiring instructions and have the signature notarized, if possible.  Even then, we recommend the Seller verify the closing instructions over the telephone via a call initiated by the law office, using contact information from very early in the file prior to any discussion of proceeds and wires.

Confirming a telephone call verification via email is a good practice and a great way to document the file.  However, an email verification alone is inadequate.

If at all possible, do not accept changes to wiring instructions.

Camille: Many professionals are still using free email services such as gmail, yahoo, aol.com, and nc.rr.com. What are your thoughts about the risk with these free services?

Troy: If wiring instructions are attached to an email from a free email service (gmail, yahoo, aol.com, nc.rr.com, etc.) they should be assumed to be fraudulent and extra diligence should be taken in verifying their authenticity. Sometimes hackers will set up an alias account with a very similar name (frequently dropping or swapping letters) to send modified instructions so the authentic user is not aware of their presence.  Examining the account name in detail is a good idea; however, as the hacker already has access to the original account, he or she may be not take this step and will use the same account that all other correspondence used.

Attorneys should be using secure email. Secure email essentially means that an email travels from sender to recipient without interruption, alteration, or interception. It allows the recipient to be sure of the sender’s identify and the validity of any attachments to the email. Most free email services do not offer these protections that you pay for with secure email providers.  In addition, free email services are likely non-complaint with the ALTA Best Practices because of these major security concerns and the emails are likely being mined for data by their providers in violation of Rule 1.6 of the Rules of Professional Conduct.

If you are currently using a free service, immediate action should be taken to find a more secure and professional alternative.  In the interim, it is possible to see when and from where the free account was recently accessed.  Here is a link explaining how to do it for gmail accounts:  http://www.groovypost.com/howto/check-gmail-login-activity/ Other services should have similar abilities.  If you see suspicious activity, please immediately change account passwords and contact your professional liability carrier along with your cyber or crime carrier.

Camille: What are some other red flags?

Troy: Be very suspicious of wires going to any account that is not in the name of the Seller.  Also, be suspicious of any account with a geographic location different than the Seller.  Why is a North Carolina Seller relocating to New York sending a wire to Wisconsin? There are some reasons for the different names and odd locations, but these are red flags which should be explored in detail (and not via email).

Do NOT send wires overseas.  Once money leaves the United States, it is likely gone forever.

Finally, regularly change your passwords.

While these policies appear harsh, hacking crimes can be devastating to a law firm’s finances and reputation.  Explaining the policy up front to your clients is a good way to limit negative actions. Also, be sure to share this information with your support staff. Many paralegals are on the front line of communications concerning closing instructions.

Below is sample language Lawyers Mutual recommends to be included in your Seller engagement letter:

Funds Availability Policy.
It is our goal to make real estate commission checks and funds available as soon as practical following closing.  However, NC State Bar Rules expressly prohibit disbursing any closing funds prior to recording.  Should you request funds be wired, our office can accommodate the request for a fee of $___.00.   In order to prevent fraud and protect your proceeds, all wiring instructions must be will be verified and you will be required to sign the instructions at the closing ceremony.  THIS OFFICE WILL NOT ACCEPT CHANGES TO WIRING INSTRUCTIONS.

Camille Stell is the Vice President of Client Services and Troy Crawford is a claims lawyer for Lawyers Mutual. Continue this conversation by contacting Camille at camille@lawyersmutualnc.com or Troy at troy@lawyersmutualnc.com or 800.662.8843 for an in-house presentation on Cyber Security. Contact Adam Pierce, AAI, Director of P&C Operations with Lawyers Insurance for information on cyber insurance policies at adam@lawyersmutualnc.com.