How Title Agents Can Stop Wire Fraud & Social Engineering | Ep 53

In a world where change is the only constant, Mo Shumil stands at the forefront, guiding title professionals to not just grow their businesses, but to master the art of innovation. With every episode, you're handed the keys to unlock unparalleled growth and stay ahead of the curve. Get ready for a transformative journey. Welcome to the Deep Dive, where we take a stack of information and really try to extract the most important nuggets of knowledge to help you become truly well-informed. Today we're plunging headfirst into a digital minefield.

It's one that's costing billions and causing, well, immense headaches, especially in the real estate world. Our mission in this Deep Dive is to unpack the exploding threat of wire fraud and social engineering in title and escrow. We're digging into this comprehensive guide, Navigating the Digital Minefield, a title agent's guide to combating wire fraud and social engineering. We're going to give you a shortcut, really, to understanding this critical, often surprising and incredibly actionable topic. So let's unpack this.

The real estate and title escrow industry, if you're involved in it, is really at a crossroads, wouldn't you say? Absolutely. Yeah. We're seeing just this massive surge in cyber-enabled financial fraud. And look, this isn't just about losing money.

It's about whether your business can even keep running. And frankly, it's about your reputation. It's true. And the scale of it is what's truly eye-opening. The FBI's IC3, that's their Internet Crimes Complaint Center, they reported total losses exceeding $12.5 billion across all sectors in 2024.

Twelve and a half billion. Wow. Yeah. And within that staggering number, real estate wire fraud alone accounted for an estimated $500 million. Think about that for a moment.

Half a billion dollars just in real estate. That's a staggering figure, but I imagine it gets even more granular for the folks actually on the front lines, right? It absolutely does. For title companies specifically, a significant 17% experienced wire fraud just in 2024. And surveys back this up.

95% of title and escrow professionals saw an increase or a consistent volume of wire fraud attempts. Over 60% of companies reporting direct targeting. Directly targeted. Yeah. And here's the grim part.

The median loss per title-related incident in 2024 was $72,000. $72,000. But the real kicker, only 19% to 28% of those lost funds are typically recovered. Oof. 19% to 28%.

So the cold, hard truth here is, if you get hit, your money is likely gone for good. Prevention isn't just a good idea. It's your only real shot. That's the bottom line. And what I find truly compelling here is this idea of a critical shift.

Are we seeing the same old types of cyberattacks or is there like a fundamental change in how fraudsters are operating now? That's a great question because there absolutely is a shift. Well, you know, technical vulnerabilities are still a threat, definitely. But there's a marked rise in what are called seller impersonation scams and social engineering. Okay.

Phishing and business email compromise, or BEC. These are consistently identified as the most prevalent risks. Get this. 93% of title and escrow companies experienced phishing attacks in the past year. 93%.

Yeah. So fraudsters are spending less time hacking networks and more time hacking people. That makes so much sense. And if we connect this to the bigger picture, the whole real estate transaction process itself, it seems almost custom built for these kinds of attacks, doesn't it? Like a perfect storm.

Precisely. It really is. Think about it. You have public listing data, a multitude of stakeholders like agents, lenders, title companies, all communicating. Right.

Lots of moving parts. Exactly. It's predominantly digital. Huge sums of money are involved, and there's that immense time pressure. Hackers zero in on sensitive data, like client financial information, and the interconnectedness means a compromise in any single party system can expose the entire transaction.

Wow. Fraudsters also weaponize those tight deadlines, you know? Yeah. They know that pressure can lead to hurried decisions. And since nearly all wire fraud involves digital fund transfers, the primary way money changes hands is inherently susceptible.

So if it's less about breaking into computer systems and more about getting people to do what you want, let's talk more about social engineering. This is really about bypassing the tech defenses by exploiting human psychology, right? Exactly. Social engineering, at its heart, it's all about mind games. It's tricking someone into doing something they shouldn't.

Like giving up a password or sending money. Yeah, exactly. Just by playing on their trust or maybe their fear. Phishing, for example, involves these malicious actors posing as trusted individuals, could be colleagues, vendors, even government officials. This exploits human trust, meaning a human firewall built on vigilance and critical thinking is, well, it's paramount, absolutely paramount.

And then you have spoofing, which is a pretty sophisticated technique often used in these attacks. Spoofing? How does that work? It's about creating email addresses or phone numbers that closely resemble legitimate ones, you know, subtle alterations like gmail.com instead of gmail.com, or using .biz instead of .com. Oh, tiny changes.

Easy to miss. Very easy. These minute changes are easily overlooked, especially when you're busy or under pressure. And business email compromise, or BEC, this is often the financially most damaging result of successful phishing. An attacker impersonates an employee or maybe a trusted external party to trick a victim into an unauthorized wire transfer.

They often monitor email communications to insert themselves at just the right moment using insider language to manipulate urgent actions. This podcast is brought to you by Struggling to set appointments and generate leads? What if you had a team working behind the scenes to help you book more meetings and close more deals? At Alltech National Title, our dedicated inside sales team help you find your pipeline so you can focus on what you do best, building relationships and closing business. Why join us?

One, built-in lead generation. Our inside sales team actively sets appointments for you. Two, more time selling, spend less time cold calling, and more time closing. Three, proven support system, advanced tech, industry expertise, and marketing tools at your fingertips. And four, unlimited growth potential, no red tape, just the resources to help you thrive.

Ready to take your career to the next level? Visit AlltechNationalTitle.com or DM us today to start the conversation. I can see how those subtle changes under pressure could lead to disaster, but what about even newer threats? I've been hearing about AI-generated voices and deepfakes. This sounds like something out of a sci-fi movie, but it's real now in fraud.

This raises a truly important question for all of us, really. What happens when AI-generated voice messages can convincingly mimic a real estate agent or an escrow officer? Experts predict voice replication will become more prevalent, and that erodes the reliability of traditional verbal verification. For years, the advice was always verbally confirm sensitive info via a known phone number, right? Right.

Call the number you know is good. Exactly. But if a fraudster can initiate a call with a replicated voice, that whole safeguard is compromised. We absolutely need multimodal verification now, combining voice with, say, a visual check, maybe a prearranged code, or using a secure digital platform. That's a chilling thought.

So it really comes down to human psychology, doesn't it? These fraudsters aren't just tech wizards, they're masters of manipulation. They absolutely are. The success of these attacks hinges on exploiting fundamental human psychological vulnerabilities. Fraudsters are experts at playing on our emotions.

They'll create panic, use tight deadlines, or pretend something is top secret, anything to make you rush and skip those vital verification steps. Bypass the process. Right. They craft messages conveying urgency or threatening tones to compel quick action, like emails demanding immediate action to avoid losing a home or incurring penalties. This deep understanding of human cognitive biases means even, you know, really advanced cybersecurity frameworks can be ineffective if the human operators aren't prepared to resist that psychological manipulation.

That's such a powerful point. The human element is both the weakest link and potentially our strongest defense. Let's maybe look at some real-world examples that really drive this home, both successful attacks and, thankfully, those that were thwarted. Okay, sure. In one devastating case, a law firm's paralegal's email was compromised.

This led to fraudulent wire instructions for a $100,000 real estate sale. And the fraudulent email used a dummy account with just a subtle typo that was easily overlooked. Another law firm received fraudulent instructions, supposedly from a client's real estate agent, with really poor grammar, like, please send me the info you need. Please. Wow.

But still. Still worked sometimes, or almost worked. A couple in Washington state lost $272,000 intended for a home purchase after a spoofed email from their title company. $272,000 just gone. And in Manhattan, a real estate brokerage lost over $1 million when a hacker gained access to an agent's email and redirected closing funds.

These just underscore how a vulnerability in one party's system can expose all the other parties in that chain. So it's not just about your defenses. It's about the security posture of everyone you're working with. And I hear a particularly alarming and increasing threat now is what's called empty lot scams. What's that about?

Yes. These are a form of seller impersonation fraud, where fraudsters pretend to own vacant land they don't. They often tell agents not to place for sale signs to avoid alerting the real owners. Sneaky. Very.

Oh. And this is rapidly increasing. a vulnerability in one party's system can expose all the other parties in that chain. So it's not just about your defenses. It's about the security posture of everyone you're working with.

And I hear a particularly alarming and increasing threat now is what's called empty lot scams. What's that about? Yes, these are a form of seller impersonation fraud, where fraudsters pretend to own vacant land they don't. They often tell agents not to place for sale signs to avoid alerting the real owners. Sneaky.

And this is rapidly increasing. Sixty six percent of title and escrow professionals reported experiencing these scams in 2024. That's up from 58 percent just in 2023. Sixty six percent. That's huge growth.

But there are success stories, too, right, where vigilance really paid off. Absolutely. There are. Flying as title and escrow of Montana, for instance, they stopped three fraudulent vacant land transactions in a single month. Wow.

Three in one month. Their success was really down to team vigilance and strict protocols. They used technology like closing lock for identity verification. They flagged a suspicious seller who refused a vetted notary. A reverse search revealed multiple names and addresses linked to the supposed seller.

And there was a fake I.D. with a clearly cut and pasted photo. Ah, the red flags were there if you looked. Exactly. And many California escrow companies now require amended wire instructions to be notarized, or they make direct phone calls to customers at a confirmed phone number to verify any changes.

And client empowerment is crucial, too. We've seen ready users share stories of thwarting scams just by insisting on printed instructions or their closing agent having a strict policy of verbal verification, sometimes even resorting to a good old fashioned check. This podcast is made possible by our sponsor. You have worked so hard to build your business. So why do 70 to 80 percent of businesses never sell?

The truth is, most owners wait too long. They don't plan properly or they can't find the right partner. At Alltech National Title, we help title company owners avoid these pitfalls, ensuring that you maximize value, protect your team and transition on your terms. Whether you're looking to grow, merge or sell, we'll help you craft a strategy that actually works. A good deal is one where everyone wins.

Let's talk about how to make that happen for you. Visit Alltechnationaltitle.com or DM us to start the conversation. Alltech National Title, smart transitions built to last. Interesting. So what's the common thread here for you?

It really highlights the power of layered defenses, doesn't it? Where technology kind of augments that human vigilance. That's exactly it. Layers. So when fraud does hit, the consequences extend far beyond just the direct financial loss.

Right. There's this complex ripple effect on title agent liability, closing efficiency and crucially, insurance. Oh, definitely. Beyond the estimated 500 million dollars in real estate wire fraud losses, incidents incur significant legal fees, recovery and investigation costs, crisis management expenses. It adds up fast.

For example, there was a Michigan title agent who lost seven hundred and eighty thousand dollars. But her insurance claim was denied because the loss resulted from social engineering, not a direct system breach. Denied. Why? Many traditional policies consider this a voluntary parting of funds because someone chose this in the wire, even though they were tricked.

Voluntary parting. That's a legal term that sounds like a potential loophole for the insurance companies. So what's the landscape actually like for getting covered when these social engineering attacks occur? Is it tough? It's a complex landscape, to say the least.

Errors and omissions or, you know, insurance generally excludes financial fraud. Cyber insurance often excludes social engineering losses unless you have a specific endorsement or it has really low sublimits. Like how low? Like maybe a hundred thousand to two hundred fifty thousand on a million dollar policy. Not nearly enough sometimes.

Right. Fidelity bonds, they protect against internal fraud. So that's different. The good news, though, proactive investment in prevention can actually reduce premiums. We saw Title Smart Inc.

reported a 50 percent reduction in their EOS premiums after adopting Certified, which is one of those specific security solutions. OK, so being proactive can actually save you money on insurance. So what does this all mean for you if you're involved in these transactions? It sounds like you absolutely need to have detailed discussions with your insurance agents, asking specific pointed questions about social engineering coverage, sublimits, deductibles. Don't just assume anything, right?

You absolutely cannot assume. You need to ask directly. And beyond the money, fraud causes significant operational disruptions, delays in closings. That leads to missed deals and eroded client trust. Victims often face, you know, substantial financial losses with limited opportunities for recovery.

They might be unable to finalize home purchases, lost earnest money, or suffered emotional distress due to a breach of trust. Yeah, emotional toll. It can be just as damaging as the financial loss, further eroding trust in your company's reputation. So how do we build robust defenses in the face of these constantly evolving cyber threats? It clearly requires a multilayered approach.

But where do you even begin? You begin with your people. I mean, empowering your team is absolutely crucial. The human element remains the most critical defense against social engineering, period. You need to train employees to recognize phishing attempts.

Implement multifactor authentication, MFA for everything, and conduct regular simulated phishing exercises. So they get practice spotting the fakes. Exactly. Employees need to be able to identify those subtle warning signs like unusual or urgent requests. That makes perfect sense.

Your team is your first line of defense. But what about the clients themselves? Are they generally aware of these risks? Unfortunately, often no. Nearly half of buyers are unaware of wire fraud risks.

Half? Wow. Yeah. And real estate professionals are kind of expected to bridge this gap with about 35 percent of buyers placing the onus on the agents. Agents should really walk clients through the risk and help them know what to expect.

This client education piece is just vital. OK, so educating clients is key. Now, how do you operationalize that human firewall we talked about earlier? What's like the most consistent, high impact recommendation you hear? The mantra everyone needs to adopt is pause and verify.

Just pause. Pause and verify. Professionals should always verify wire instructions verbally using a known contact number. Never, ever one from the suspicious email or text. This directly counters that urgency tactic and the email compromise methods.

So this raises an important question for everyone listening is pause and verify a non-negotiable part of your workflow for any change in financial instructions. It has to be non-negotiable. Got it. Beyond that human vigilance, technology is obviously a powerful force multiplier here, isn't it? Absolutely.

You have to invest in robust cybersecurity frameworks and secure platforms. Implement MFA for all business transactions. Use secure portals for document and fund transfers, not just email attachments. Right. There are specialized technologies like CertiFIT and ClosingLock.

They offer identity and bank detail verification. They analyze fraud markers and some even provide insurance coverage. TrueWire offers real time account ownership verification. These are specifically tailored for real estate needs. And of course, don't forget fundamental cyber hygiene, updating software using encryption, antivirus, VPNs, HTTPS on your websites.

The basics still matter a lot. This podcast is proudly sponsored by Need extra hands without extra overhead? Meet Safi Virtual, your on-demand team of virtual assistants trained specifically for the title industry. Our VAs come with foundational knowledge of title insurance, ready to handle admin tasks, client communication, data entry and more. So you can focus on closing deals, not paperwork.

Scale smarter, work faster and cut costs without sacrificing quality. Visit SafiVirtual.com or DM us to find your perfect VA. Safi Virtual, expert support tailored for title professionals. Right. The basics are the foundation.

And finally, kind of bringing it all together with robust protocols. Yes. Formalized protocols are just as crucial as the technology and the training. The American Land Title Association, ALTA, they provide best practices, including written controls for escrow trust accounts and information security programs. You should use them.

Things like multi-party verification systems for critical transaction details, like dual verification processes for wire transfers requiring approval from two authorized team members. Do sits of eyes. Exactly. And pre-closing verifications, maybe three to five days prior, these are paramount. And proactive incident preparedness is also essential.

You need to develop and regularly update an incident response plan. What to do when it happens. Yeah. To guide employees on exactly how to respond to suspected attacks. ALTA even provides a rapid response plan for wire fraud incidents template you can adapt.

Look, while prevention is ideal, it's just not foolproof. So you must prepare for when fraud inevitably strikes. OK, so despite the most robust prevention efforts, wire fraud can still occur. When it does, you're saying the speed and coordination of your response are absolutely paramount. So what's the very first thing you do?

The directive is simple. Act fast. You have to move immediately. Reporting the incident within 72 hours of authorizing the wire transfer offers the best chance of recovery. 72 hours.

OK. But honestly, the probability of recovering funds diminishes rapidly with each passing hour. Sooner is much, much better. So what are those initial critical steps you take in those first few frantic hours? Walk us through it.

OK. First, verify immediately. Call the real person who supposedly sent the wire instructions. Use a known, trusted phone number. Never.

Act fast. You have to move immediately. Reporting the incident within 72 hours of authorizing the wire transfer offers the best chance of recovery. 72 hours. Okay.

But honestly, the probability of recovering funds diminishes rapidly with each passing hour. Sooner is much, much better. So what are those initial critical steps you take in those first few frantic hours? Walk us through it. Okay.

First, verify immediately. Call the real person who supposedly sent the wire instructions. Use a known, trusted phone number. Never. From the suspicious email.

Never. Got it. Known number only. Second, notify closing agent. Promptly contact the closing agent, usually the title company, so they can alert all other parties involved in the transaction.

Fast. Spread the word. Third, contact banks. Immediately notify the fraud departments of both the sending bank and the receiving bank. Request the sending bank to recall the wire.

And crucially, if the wire is $50,000 or above or international, ask the sending bank to initiate the FBI's financial fraud kill chain. Financial fraud kill chain. Okay. Simultaneously, contact the receiving bank. Tell them what happened.

Ask them to freeze the account the money went to. And fourth, secure accounts and devices. Immediately change all passwords for any potentially compromised accounts. Enable two-factor authentication if it wasn't already. And disconnect any potentially infected devices from the Internet.

Pull the plug. That's a clear action plan. And reporting to authorities like the FBI's IC3, does that really help in the heat of the moment or is it more for later? Yes, it absolutely helps. And you should do it quickly.

Reporting to authorities is a critical step both for immediate recovery potential and for broader intelligence gathering. The FBI's Internet Crime Complaints Center, IC3, is the central hub for this. Now, look, IC3 can't guarantee a direct response to every single complaint. There are just too many. Right.

So, reports enable the FBI to investigate, track emerging trends, connect dots between cases and sometimes facilitate freezing stolen funds through things like the kill chain. This collective intelligence benefits the entire industry. So, even if immediate personal recovery seems unlikely, reporting is a crucial responsibility for title agents, for everyone, to contribute to the collective defense against cybercrime. That makes sense. It helps the bigger picture.

So, clearly, this isn't a one-and-done solution. The dynamic nature of these cyberthreats means continuous vigilance is key. So, what resources are out there to help people stay ahead of the curve? Where can they turn? There are some excellent resources available, thankfully.

The American Land Title Association, ALTA, provides a really comprehensive framework through its seven primary best practices. It covers everything from business licenses to escrow account controls, information security programs, the works. Yeah. And ALTA offers a wealth of educational materials checklists, like the ALTA Outgoing Wire Preparation Checklist, that Rapid Response Plan for Wire Fraud Incidents template we mentioned, various educational videos. Their approach is holistic, covering not just wire fraud but also things like FinCEN rules, elder fraud, mortgage fraud, and that seller impersonation issue.

Then there's the National Association of Realtors, NARE. They empower individual real estate professionals with resources like a cybersecurity checklist and a data security and privacy toolkit. Useful for agents, specifically. Exactly. NARE also offers specific tools for avoiding wire fraud, including a wire fraud email notice template you can use with clients and wire fraud notices to give out.

They're also a key participant in the coalition to stop real estate wire fraud. Today's episode is sponsored by... Hey, you, title agents. Stop wasting time digging for answers or waiting on an email or call back from your underwriter. With TitleGPT.AI, you get instant, reliable answers to your title questions fast.

No more delays, work smarter, close faster, and keep deals moving. Try www.TitleGPT.AI today. It's fantastic that these industry-specific groups are providing such tailored support. But what about at a broader maybe government level? Are there resources there too that people might not know about?

Absolutely. And it's something many people overlook. Federal government agencies are providing high-level expertise, often for free. The Cybersecurity and Infrastructure Security Agency, CISA, they're part of Homeland Security, offers extensive resources and guidance specifically for the financial services sector, which includes real estate. Oh, I see.

Okay. Yeah, CISA. Their cyber hygiene services can help secure your internet-facing systems and their cybersecurity performance goal assessment helps you prioritize security efforts, figure out where to focus. CISA also provides forward-looking guidance on emerging threats like AI-specific cybersecurity risks, things like data supply chain vulnerabilities, and maliciously modified data. So they're looking ahead.

That's really good to know. Free resources from CISA. So this deep dive was really about arming you, the listener, with the essential knowledge to navigate this complex, escalating threat of wire fraud and social engineering and real estate. It's crystal clear that prevention isn't just a best practice. It's an absolute necessity for anyone operating in this space.

Absolutely. To effectively combat this evolving threat, we strongly recommend that you, one, prioritize human-centric training, implement continuous interactive programs focused on identifying social engineering tactics, spotting those subtle red flags, and really cultivating that pause and verify mindset for all wire instructions. Train your people constantly. Mandate multi-party verification protocols. Establish strict, documented procedures requiring independent, verbal confirmation of all wire instructions via known, trusted phone numbers.

Involve multiple authorized personnel for critical transfers. Get those checks and balances in place. Three, invest in specialized technology. Adopt secure platforms and verification tools designed specifically for real estate transactions, things like identity and bank detail verification software, secure portals, robust anti-malware. Use the right tools for the job.

Four, review and enhance insurance coverage. Talk to your insurance brokers. Explicitly understand social engineering fraud coverage, the sublimits, the deductibles. Make sure your policies adequately protect against this really prevalent threat. Consider specialized endorsements or crime policies.

Check that fine print. Five, develop and rehearse a rapid response plan. Create a clear, actionable incident response plan for wire fraud. Know the immediate steps for contacting banks, law enforcement like the FBI IC3, and affected parties. Understand that timely action is critical for any chance of fund recovery.

Practice makes perfect, even for disasters. And six, leverage industry and government resources. Continuously consult and integrate best practices and educational materials from organizations like ALTA and NAR. And utilize the cybersecurity guidance and free resources provided by federal agencies such as CISA to stay ahead of evolving threats. Don't go it alone.

Use the help that's out there. By embracing these comprehensive strategies, you can significantly fortify your defenses, protect your assets, and navigate this digital minefield with, hopefully, greater confidence and resilience. And finally, a thought for you to mull over as we wrap up. Given the constant, rapid evolution of these threats, what emerging technology or perhaps human behavior do you think fraudsters will exploit next? And maybe more importantly, how can we begin preparing for it today?

Thanks for joining us for this deep dive. We hope you feel a little more informed, a little more prepared, and ready to keep exploring. And that's a wrap on today's journey with Mo Shemil from the Title Agents podcast. Reminding you that mastering the art of innovation is key in the title industry's fast-paced world. If you're finding it tough to keep up with the changes and challenges, remember, you're not alone.

Our calendar is open for you. Find the link in the show notes and let's connect. Make sure to hit subscribe to not miss out on strategies that elevate and insights that empower. Together, we'll navigate the future of the industry. I look forward to our next meeting in the upcoming episode.