My money's where? - social engineering fraud and real estate transactions

Like most attorneys I know, I hate answering phone calls late Friday afternoon. Will I do it? Sure. But I know before I pick up the phone that whoever is on the other side will not have an issue that is easy to fix or that can wait until Monday to be addressed. For the past two years, those late Friday phone calls have typically concerned misdirected escrow funds.

Whether the call comes from an escrow agency or a purchaser, the story is all too familiar. The caller will have received an email making a modification to escrow instructions from someone involved in the transaction. The modification is not confirmed by phone, but the instructions are followed and the wire is confirmed. No one in the transaction follows up for days, or sometimes weeks, after

the funds are due. Then, one of the parties to the transaction announces that the wire was never received.

The victims of the crime do not fit within any stereotype (at least as far as I can tell). No one is safe, regardless of their level of education, sophistication, or wealth. The problem all boils down to one issue: the transfer of what should be confidential and protected information by email. Fraudsters actively look for it and jump on it as soon as it is found. Simply sending an unsecured email with financial details from an open network is sufficient to pique a fraudster's interest, and the sophistication level of schemes is only increasing. I have seen networks hacked, email addresses taken over (while the victims are still actively using them), and modifications made to email addresses that are often overlooked. How many of you caught my typo?

In the insurance industry, the issue is referred to as "social engineering fraud" and many, if not all, insurers treat it as a loss that is not covered by their policies (including crime policies). Only a handful of insurers have begun issuing social engineering fraud endorsements in select markets. Even then, standard limits are capped at $250,000.00.

Fortunately, there are steps that everyone can (and should) take to protect themselves.

Here are my top five:

1. Do not fear your phone. I have held on to numerous lessons from my past mentors that remain in my thoughts as one-liners. This point and "reading all four corners" of any document you are dealing with are two that I can never shake. Too many of us (myself included) are far too comfortable hiding out in our offices, emailing or texting the day away. One problem with that routine is that emails and texts do not convey emotion well. A larger problem is that you never really know who you are dealing with on the other side of the communication. If you take away nothing else, just make a mental note that whenever you are involved in a transaction where the wiring of funds is involved, it never hurts to call the other side of the wire to confirm the wiring instructions within 24 hours before the wire and to confirm receipt of the wire within a couple days. Do not call and ask whether the wiring instructions are still good. Actually read off and con firm the details of the instructions. That step alone prevents most problems.
2. Follow up on missed deadlines. Some industries have adopted the practice of including disclaimers and warnings in their emails. Just think of your own email signature and the obligatory attorney-client privilege statement in small type at the bottom. In the escrow industry, many people include a statement that any change in escrow instructions should be confirmed by phone. The problem is that a lot of people do not read the fine print. Even the people that do read it do not actively read it or recall it when it is important. Do not take comfort in the email warning alone. If a deadline to wire funds is missed, follow up by phone within 24 hours to find out why.
3. Anticipate the issue and draft around it. Whether you are representing a purchaser, seller, or escrow agency, draft language to specifically address the manner in which escrow instructions will be conveyed, the phone numbers that should be used to confirm modifications, and the responsibility to follow up with each party to the transaction by phone. Include that language within the purchase agreement (even if it must be by addendum), provide a separate sheet for the parties to acknowledge the instructions by signing the sheet and taking a copy of the instructions with them (especially those parties that are less sophisticated), and require the language within the purchase agreement to be mirrored in the escrow instructions.
4. Never exchange transaction documents or financial information by unsecured email. There are several programs out there offering encrypted data exchange for Little to no cost. Get one and use it. One article outlining the pros and cons of the "5 Best" for 2018 is available at https://www.lifewire.com/secure-email-services-8774358.
5. When things go wrong, get to work immediately. First, contact the local authorities. By local, I mean local to your location as well as the last known location of the funds. In the United States, the Federal Bureau of Investigation is a good place to start, but I do not suggest you start by calling them unless you already have a contact. Instead, go to https://www.ic3.gov/ and fill out a report. The FBI actively monitors it. If you report the issue within 72 hours of the wire, the FBI is pretty good at getting the funds back. Outside of the United States, you need to phone a friend. In many locations, there are numerous attorneys at larger firms or other business advisors (depending on the issue) who handle issues like this on a daily basis. Those contacts can help you maneuver through the proper systems more efficiently than phone calls to police stations hundreds or thousands of miles away. Second, contact the financial institutions involved beginning with your own. They also have some success stopping the transfer of funds.

If all else fails, you will need to evaluate your next steps carefully. Within days, sophisticated fraudsters can spread the wired funds-no matter the amount-into several different countries in ever decreasing amounts. A misdirected wire of $100,000 (equating to a couple's life savings) can quickly turn into 20 or more different transfers between accounts. Although the cost of tracing and chasing the first wire may be worthwhile, the cost-benefit analysis quickly shifts as more transfers occur. Once that happens, fingers start to get pointed and we all know where that leads. So remember, please do not fear your phone.