10 ms·

Have a friend who lost more than $12k in the process of buying a house. Scammers sent the wiring instructions a few hours before the legit closing attorney sent

Have a friend who lost more than $12k in the process of buying a house. Scammers sent the wiring instructions a few hours before the legit closing attorney sent the real instructions. The email looked exactly right except for a minor change to the domain name from address. After one hour, wire transfers sent in error are no more recoverable than crypto. How the thieves knew so much about the process and timing is supposedly being investigated, but no one is holding out much hope. And the attorneys have a strong incentive to cover up any evidence of intrusion on their side, assuming it was their infrastructure infiltrated.

api 6y ago
Is it just me or is there fantastically more fraud these days than a decade or two ago? Any transaction feels like walking around in northern Canada during black fly season. I receive several cold scam calls per day and I’ve known people who have done things like purchase a home and been inundated by fake calls from “the underwriter” and other scams. Is there no mail and telemarketing fraud enforcement any more?
- ikiris 6y ago
  I wonder what changed in global cyber security and law enforcement during this time window.
- pmarreck 6y ago
  Imagine a world with way less wealth inequality
- hnick 6y ago
  We're definitely getting more of the Chinese robocalls and other SMS spam here in Australia too. I think there are two sides to it: scammers like everyone else are feeling the pinch from reduced economic activity, and desperate people are easier to scam. A lot of scams do feel like low hanging fruit that would be easy to track down. I think there is a lack of will and capability for resolving "small" scams of up to a few thousand dollars which can be crippling for individuals.
- sukilot 6y ago
  In 1994 the Internet became widely available, exposing you to attack from 6billion people.
est31 6y ago
> After one hour, wire transfers sent in error are no more recoverable than crypto. The receiver account can still be seized by government institutions though, something much harder with cryptocurrencies.
- koonsolo 6y ago
  You would think, but in all scammer cases that I heard, they are able to get their money out. I really don't get it, because I have to provide my ID every year or so for verification. I really don't get how these scammer can get away with that, but obviously every time.
  - novok 6y ago
    Its easy to get fake ids that look very real (ask a local 20 year old). Also you often do not even need to take a picture of an ID to open an account online, just have the info of an identity that you steal. After that, you get an atm card, wear a covid mask, shades and hat, call to raise the limit and take it out asap.
    - boring_twenties 6y ago
      Which banks allow non-trivial ATM withdraw limits? My experience with 4 different banks: 1. Limit of $500 cannot be changed 2. Limit raised to $1,100 over the phone; apparently if I show up at a branch and bring my first born, I can get it as high as $1,500. 3. Limit of $500 suddenly reduced to $200 (!) with the option to call in and raise it to $400. 4. Limit raised to $2,000. Some years later, suddenly reduced to $1,000. Haven't bothered looking into this yet.
      - siberianbear 6y ago
        Fidelity Investments brokerage and cash management accounts have a limit of $1000 a day, and I have four of them, so I can get $4000. I recently learned that some Chase Bank ATMs inside branches used with Chase ATM cards can get $3000 in one transaction. I did it the first time a few days ago.
hbosch 6y ago
When we bought our house last year, the packet came with a big, bright red page (as well as a verbal warning from our loan officer) to look out for these scams.
- dkarl 6y ago
  Same for me a year ago, and they called early in the morning on the day of closing to repeat the warning. It wasn't even mentioned when I closed on a house seven years ago.
  - philjohn 6y ago
    I tend to phone people I'm making transfers to, where they've emailed or otherwise electronically sent the sort code and account number, to verify. Adds a couple of minutes, but could save tens of thousands.
    - sneak 6y ago
      This is possible because the telephone network is (more) secured, in the same way email and other forms could be, but aren’t.
- anamexis 6y ago
  Likewise. Ours instructed us to look up the title agency in the phone book, call that number, and verify the wire details before we did it.
- stjohnswarts 6y ago
  Similar, my old and jaded real estate agent said "don't trust this computer shit, call me or call the loan people on anything involving money or signing something"
nodesocket 6y ago
I am closing on a house, and this is quite terrifying. How in the world did the scammers know all the exact details of the house? I am guessing the $12k was good faith money? In my case, I was able to write a plain old check for my good faith money.
- ballenf 6y ago
  It was the down payment on the house in this case. And was actually a lot more than $12k. It has to be a wire transfer since checks take so long to clear and the title can't transfer with that uncertainty. My advice to anyone buying or selling is to get the attorney's phone number from a known good source in advance, and call them to verify the wiring instructions before submitting. Also compare the bank account name down to the character with the real one (although I don't know how hard it is fake this). Your bank should read off the bank account info you're sending to before you give the confirmation to proceed.
  - Reelin 6y ago
    > It has to be a wire transfer since checks take so long to clear and the title can't transfer with that uncertainty. Why was an escrow service not an option?
    - sukilot 6y ago
      Escrow is an option. They require wires. Checks can be uncleared long after they clear (another common scam, since checks have no security model), so nobody sane accepts checks from stranges for large numbers.
- CobrastanJorji 6y ago
  My title company gave us all of the relevant information and account numbers in person on paper and made us sign documents agreeing that we were warned not to trust any information sent via email, web, or phone. You should expect the same.
  - 6y ago
nyanpasu64 6y ago
https://www.cnbc.com/2019/10/05/homebuyers-are-falling-for-this-scam-some-lose-their-life-savings.html https://www.cnbc.com/2019/10/05/homebuyers-are-falling-for-t... > Here’s how these scams usually go down: A thief hacks into a real estate or title company’s computer system and then studies the transactions, from the language used to the format of the wiring instructions. When the scammer strikes, he or she will often pose as someone from the real estate or titling company to instruct the buyer to wire funds to them.
- dheera 6y ago
  Can't this be avoided simply by making sure the property owner gives you wiring instructions in person?
  - chii 6y ago
    or use public key cryptography, and have a verification signature that can only be signed by knowing a secret.
    - VonGuard 6y ago
      Hey you know that and we know that, but the real estate industry is barely able to handle email, let alone secure it.
    - Ar-Curunir 6y ago
      lol yes, because signed and encrypted email hasn't been tried.
    - lolinder 6y ago
      The scam here relies on someone having compromised the network of the company sending the instructions. In that situation, wouldn't you have to assume the intruder found the secret key?
      - sukilot 6y ago
        The scam relies on absolutely insane system of financial institutions sending critical key information over email, instead of any controlled channel.
Waterluvian 6y ago
I wanted it to be convenient and electronic transfer but my lawyer said I’m simply not allowed to. I had to get cheques from my banks and hand deliver them to the lawyer’s office. I’m not sure I fully understand, in retrospect, the desire to shave off inconvenient corners for large life events you do so rarely. I think there’s real wisdom in some of these things being so slow and old school.
- pkilgore 6y ago
  Interestingly, property is the slowest and old-schoolest of all the branches of law. Some systems of deeds and recorders have existed for hundreds of years. As an attorney I used to look at a lot of boilerplate skeptically but is a RE attorney told me I had to sign in the presence of a clergy, my mother and law, and three local stray dogs I'm marching my butt to a pet store and making some calls without a question.
  - boring_twenties 6y ago
    As an attorney, you should know to read your contracts more carefully :) nothing in a pet store should qualify as a "stray dog," so is the whole thing null and void now?
    - pkilgore 6y ago
      To buy treats, to lure in said strays :-)
- creato 6y ago
  This reasoning also (especially?) applies to voting. Trying to make voting "efficient" is not worth it when we do it rarely and we have not had a problem just getting people to count ballots manually.
  - nend 6y ago
    This is a really bad comparison. Making it easier to vote has a big affect on how many people vote. Requiring a hand delivered check vs wire transfer to buy house has a minimal effect on how many people buy a house. Plus, the US has elections far more frequently than how frequently an average person buys a house.
pmarreck 6y ago
I mean... this is the most literal definition of "man in the middle attack" you can get. And we already know the solutions to that
RhodesianHunter 6y ago
For anyone interested, a friend of mine works on a technical solution to this exact scam. https://certifid.com/ https://certifid.com/ No affiliation besides having a friend who works there.
- sukilot 6y ago
  That doesn't help. The scammer will just imitate certified instead of the escrow company. And it's yet another party that can get hacked. The solution is for the parties to talk too each other to verify their relationships, instead of replacing all the trusted people by random websites.
  - RhodesianHunter 6y ago
    It's generally considered useful to actually look at how a thing works before disparaging it counter-factually.
porcine-flight 6y ago
This problem can be avoided if the parties use digital signatures and require a phone call for final confirmation of the instructions.
- sukilot 6y ago
  That requires the escrow companies hire people who understand technology instead of just sales. It's a principal-agemt problem. Real estate agents hire their friends to do escrow.
raverbashing 6y ago
Well, I'm not sure why transfers are not checked against the name, especially for high value ones This is fraud. It might not be recoverable immediately but it merits a police report. And maybe with that report you can have the receiving bank take action
- sukilot 6y ago
  The receiving bank is in Russia or somewhere.
deleted 6y ago
[deleted]
DougBTX 6y ago
That scam relies on the purchaser sending the full payment almost as soon as the bank transfer details have been sent to them, otherwise they’ll see the legit details too. When I’ve bought residential property in the past, there have always been various fees to pay in advance, using the same bank details. So when it comes to the final big payment, I’ll have already had the bank details for weeks, and have already used them to send previous payments. Double checking the payment instructions by phone just before making the payment helps too, as that allows confirming the account and the final amount.
- deleted 6y ago
  [deleted]
Aeolun 6y ago
That makes no sense, unless the money has been taken out of the target account in physical form.
sonicggg 6y ago
Whenever I send a wire, I have to prove the name of recipient, that being a company or a person. Why would I wire it to an unrecognised name?
rstuart4133 6y ago
> Scammers sent the wiring instructions a few hours before the legit closing attorney sent the real instructions. In my view, this mess is temporary. It's caused by a partial transition from an old system (manual via solicitors, cheques, and bank managers) to a new one. The old one was pretty reliable, but involved a lot of expensive people. The new one is like operating in the matrix. When communications happens electronically, the checks built into the old system break down and it's near impossible for a human to know if a electronic message is real. It is not near impossible for a computer to know of course. A computer validate a series of cryptographic assertions anchored at the titles office relaying what bank to credit, and it can do with far greater accuracy than the old "human relationship" system, and it can do it in factions of second. But right now we use the new system to communicate because it self evidently more efficient to do so, and still use the checks from the old system to validate those communications. You see this all the time. Phishing fraud, where accounts are sent fake invoices from what appears to be a valid supplier is essentially the same thing - humans using eyeballs to verify an electronic document is valid (which is essentially impossible), as opposed the supplier just signing it and the bank account details it contains. It's almost comically bad. I was asked by the accounting section of one of the top computer contracting organisations to verify I controlled another bank account. They demanded a bank statement to prove it. Problem: the details on the bank statement were inaccurate. I raised a ticket with the bank to get it fixed, but as seems to happen depressingly often the bank screwed it up. So in the I downloaded PDF, edited it, rendered it to TIFF, added noise, and sent it. It was accepted of course. Right now most organisations are wide to being exploited because they are communicating electronically, and using eyeballs to validate the result. They seem oblivious to the idea The Matrix wasn't just a move, it was a prophecy. And now the future it prophecised has arrived. It will change, but only after quite a few companies have been ripped a new one.

api 6y ago

Is it just me or is there fantastically more fraud these days than a decade or two ago? Any transaction feels like walking around in northern Canada during black fly season. I receive several cold scam calls per day and I’ve known people who have done things like purchase a home and been inundated by fake calls from “the underwriter” and other scams. Is there no mail and telemarketing fraud enforcement any more?

ikiris 6y ago
I wonder what changed in global cyber security and law enforcement during this time window.
pmarreck 6y ago
Imagine a world with way less wealth inequality
hnick 6y ago
We're definitely getting more of the Chinese robocalls and other SMS spam here in Australia too. I think there are two sides to it: scammers like everyone else are feeling the pinch from reduced economic activity, and desperate people are easier to scam. A lot of scams do feel like low hanging fruit that would be easy to track down. I think there is a lack of will and capability for resolving "small" scams of up to a few thousand dollars which can be crippling for individuals.
sukilot 6y ago
In 1994 the Internet became widely available, exposing you to attack from 6billion people.

est31 6y ago

> After one hour, wire transfers sent in error are no more recoverable than crypto. The receiver account can still be seized by government institutions though, something much harder with cryptocurrencies.

koonsolo 6y ago
You would think, but in all scammer cases that I heard, they are able to get their money out. I really don't get it, because I have to provide my ID every year or so for verification. I really don't get how these scammer can get away with that, but obviously every time.
- novok 6y ago
  Its easy to get fake ids that look very real (ask a local 20 year old). Also you often do not even need to take a picture of an ID to open an account online, just have the info of an identity that you steal. After that, you get an atm card, wear a covid mask, shades and hat, call to raise the limit and take it out asap.
  - boring_twenties 6y ago
    Which banks allow non-trivial ATM withdraw limits? My experience with 4 different banks: 1. Limit of $500 cannot be changed 2. Limit raised to $1,100 over the phone; apparently if I show up at a branch and bring my first born, I can get it as high as $1,500. 3. Limit of $500 suddenly reduced to $200 (!) with the option to call in and raise it to $400. 4. Limit raised to $2,000. Some years later, suddenly reduced to $1,000. Haven't bothered looking into this yet.
    - siberianbear 6y ago
      Fidelity Investments brokerage and cash management accounts have a limit of $1000 a day, and I have four of them, so I can get $4000. I recently learned that some Chase Bank ATMs inside branches used with Chase ATM cards can get $3000 in one transaction. I did it the first time a few days ago.

hbosch 6y ago

When we bought our house last year, the packet came with a big, bright red page (as well as a verbal warning from our loan officer) to look out for these scams.

dkarl 6y ago
Same for me a year ago, and they called early in the morning on the day of closing to repeat the warning. It wasn't even mentioned when I closed on a house seven years ago.
- philjohn 6y ago
  I tend to phone people I'm making transfers to, where they've emailed or otherwise electronically sent the sort code and account number, to verify. Adds a couple of minutes, but could save tens of thousands.
  - sneak 6y ago
    This is possible because the telephone network is (more) secured, in the same way email and other forms could be, but aren’t.
anamexis 6y ago
Likewise. Ours instructed us to look up the title agency in the phone book, call that number, and verify the wire details before we did it.
stjohnswarts 6y ago
Similar, my old and jaded real estate agent said "don't trust this computer shit, call me or call the loan people on anything involving money or signing something"

nodesocket 6y ago

I am closing on a house, and this is quite terrifying. How in the world did the scammers know all the exact details of the house? I am guessing the $12k was good faith money? In my case, I was able to write a plain old check for my good faith money.

ballenf 6y ago
It was the down payment on the house in this case. And was actually a lot more than $12k. It has to be a wire transfer since checks take so long to clear and the title can't transfer with that uncertainty. My advice to anyone buying or selling is to get the attorney's phone number from a known good source in advance, and call them to verify the wiring instructions before submitting. Also compare the bank account name down to the character with the real one (although I don't know how hard it is fake this). Your bank should read off the bank account info you're sending to before you give the confirmation to proceed.
- Reelin 6y ago
  > It has to be a wire transfer since checks take so long to clear and the title can't transfer with that uncertainty. Why was an escrow service not an option?
  - sukilot 6y ago
    Escrow is an option. They require wires. Checks can be uncleared long after they clear (another common scam, since checks have no security model), so nobody sane accepts checks from stranges for large numbers.
CobrastanJorji 6y ago
My title company gave us all of the relevant information and account numbers in person on paper and made us sign documents agreeing that we were warned not to trust any information sent via email, web, or phone. You should expect the same.
- 6y ago

nyanpasu64 6y ago

https://www.cnbc.com/2019/10/05/homebuyers-are-falling-for-this-scam-some-lose-their-life-savings.html https://www.cnbc.com/2019/10/05/homebuyers-are-falling-for-t... > Here’s how these scams usually go down: A thief hacks into a real estate or title company’s computer system and then studies the transactions, from the language used to the format of the wiring instructions. When the scammer strikes, he or she will often pose as someone from the real estate or titling company to instruct the buyer to wire funds to them.

dheera 6y ago
Can't this be avoided simply by making sure the property owner gives you wiring instructions in person?
- chii 6y ago
  or use public key cryptography, and have a verification signature that can only be signed by knowing a secret.
  - VonGuard 6y ago
    Hey you know that and we know that, but the real estate industry is barely able to handle email, let alone secure it.
  - Ar-Curunir 6y ago
    lol yes, because signed and encrypted email hasn't been tried.
  - lolinder 6y ago
    The scam here relies on someone having compromised the network of the company sending the instructions. In that situation, wouldn't you have to assume the intruder found the secret key?
    - sukilot 6y ago
      The scam relies on absolutely insane system of financial institutions sending critical key information over email, instead of any controlled channel.

Waterluvian 6y ago

I wanted it to be convenient and electronic transfer but my lawyer said I’m simply not allowed to. I had to get cheques from my banks and hand deliver them to the lawyer’s office. I’m not sure I fully understand, in retrospect, the desire to shave off inconvenient corners for large life events you do so rarely. I think there’s real wisdom in some of these things being so slow and old school.

pkilgore 6y ago
Interestingly, property is the slowest and old-schoolest of all the branches of law. Some systems of deeds and recorders have existed for hundreds of years. As an attorney I used to look at a lot of boilerplate skeptically but is a RE attorney told me I had to sign in the presence of a clergy, my mother and law, and three local stray dogs I'm marching my butt to a pet store and making some calls without a question.
- boring_twenties 6y ago
  As an attorney, you should know to read your contracts more carefully :) nothing in a pet store should qualify as a "stray dog," so is the whole thing null and void now?
  - pkilgore 6y ago
    To buy treats, to lure in said strays :-)
creato 6y ago
This reasoning also (especially?) applies to voting. Trying to make voting "efficient" is not worth it when we do it rarely and we have not had a problem just getting people to count ballots manually.
- nend 6y ago
  This is a really bad comparison. Making it easier to vote has a big affect on how many people vote. Requiring a hand delivered check vs wire transfer to buy house has a minimal effect on how many people buy a house. Plus, the US has elections far more frequently than how frequently an average person buys a house.

pmarreck 6y ago

I mean... this is the most literal definition of "man in the middle attack" you can get. And we already know the solutions to that

RhodesianHunter 6y ago

For anyone interested, a friend of mine works on a technical solution to this exact scam. https://certifid.com/ https://certifid.com/ No affiliation besides having a friend who works there.

sukilot 6y ago
That doesn't help. The scammer will just imitate certified instead of the escrow company. And it's yet another party that can get hacked. The solution is for the parties to talk too each other to verify their relationships, instead of replacing all the trusted people by random websites.
- RhodesianHunter 6y ago
  It's generally considered useful to actually look at how a thing works before disparaging it counter-factually.

porcine-flight 6y ago

This problem can be avoided if the parties use digital signatures and require a phone call for final confirmation of the instructions.

sukilot 6y ago
That requires the escrow companies hire people who understand technology instead of just sales. It's a principal-agemt problem. Real estate agents hire their friends to do escrow.

raverbashing 6y ago

Well, I'm not sure why transfers are not checked against the name, especially for high value ones This is fraud. It might not be recoverable immediately but it merits a police report. And maybe with that report you can have the receiving bank take action

sukilot 6y ago
The receiving bank is in Russia or somewhere.

deleted 6y ago

[deleted]

DougBTX 6y ago

That scam relies on the purchaser sending the full payment almost as soon as the bank transfer details have been sent to them, otherwise they’ll see the legit details too. When I’ve bought residential property in the past, there have always been various fees to pay in advance, using the same bank details. So when it comes to the final big payment, I’ll have already had the bank details for weeks, and have already used them to send previous payments. Double checking the payment instructions by phone just before making the payment helps too, as that allows confirming the account and the final amount.

deleted 6y ago
[deleted]

Aeolun 6y ago

That makes no sense, unless the money has been taken out of the target account in physical form.

sonicggg 6y ago

Whenever I send a wire, I have to prove the name of recipient, that being a company or a person. Why would I wire it to an unrecognised name?

rstuart4133 6y ago

> Scammers sent the wiring instructions a few hours before the legit closing attorney sent the real instructions. In my view, this mess is temporary. It's caused by a partial transition from an old system (manual via solicitors, cheques, and bank managers) to a new one. The old one was pretty reliable, but involved a lot of expensive people. The new one is like operating in the matrix. When communications happens electronically, the checks built into the old system break down and it's near impossible for a human to know if a electronic message is real. It is not near impossible for a computer to know of course. A computer validate a series of cryptographic assertions anchored at the titles office relaying what bank to credit, and it can do with far greater accuracy than the old "human relationship" system, and it can do it in factions of second. But right now we use the new system to communicate because it self evidently more efficient to do so, and still use the checks from the old system to validate those communications. You see this all the time. Phishing fraud, where accounts are sent fake invoices from what appears to be a valid supplier is essentially the same thing - humans using eyeballs to verify an electronic document is valid (which is essentially impossible), as opposed the supplier just signing it and the bank account details it contains. It's almost comically bad. I was asked by the accounting section of one of the top computer contracting organisations to verify I controlled another bank account. They demanded a bank statement to prove it. Problem: the details on the bank statement were inaccurate. I raised a ticket with the bank to get it fixed, but as seems to happen depressingly often the bank screwed it up. So in the I downloaded PDF, edited it, rendered it to TIFF, added noise, and sent it. It was accepted of course. Right now most organisations are wide to being exploited because they are communicating electronically, and using eyeballs to validate the result. They seem oblivious to the idea The Matrix wasn't just a move, it was a prophecy. And now the future it prophecised has arrived. It will change, but only after quite a few companies have been ripped a new one.