When Tom Cronkright lost $180,000 of his client's money in a wire fraud scheme related to a commercial real estate investment in 2015, he never guessed how much that experience would change his life – for better and worse.
“While we eventually got back about $140,000 of the money, we were involved in a two-year long civil litigation that helped lead the FBI to a global syndicate that was behind the scheme," said Cronkright, CEO of Sun Title in Grand Rapids, Mich. “I ended up testifying for the Department of Justice in October of 2018 with a protective FBI detail because other witnesses in the case had hits taken out on them."
In a more positive outcome of the fraud, Cronkright co-founded and became CEO of a new business, which he, and his partner, Lawrence Duthler, runs in addition to Sun Title, called CertifID, a software company that provides protection against wire fraud.
Wire transfer fraud and compromised business emails caused losses of more than $300 million per month in 2018, according to the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN). Real estate is the third most-targeted business sector for this type of fraud, primarily because the amount of money being transferred is typically significantly larger than average online transactions.
Real estate transactions had the highest average fraudulent losses of any industry in 2018 at $179,001, according to the report. More than 20 percent of all fraud losses were tied to either residential or commercial real estate in 2018.
Barry Wolfe, a senior managing director for investments with commercial real estate brokerage Marcus & Millichap's Fort Lauderdale office, said one of his clients lost about $250,000 when buying a commercial property.
“My client called his assistant to ask her to send the wire transfer for a closing and that assistant said she had sent the funds the previous day, according to the instructions from his email," said Wolfe. “Someone had hacked into his email account and sent fake instructions."
As is common with these types of situations, by the time the fraud was discovered, the funds had been transferred to an overseas bank and couldn't be recaptured.
While each case of wire fraud is unique, there is a common pattern that criminals follow to compromise real estate transactions. Both business email compromise (BEC) schemes and email account compromise (EAC) schemes use hacked email accounts to trick financial institutions or customers into transferring funds to an unauthorized account, according to the FinCEN.
The way fraudsters get the information of parties involved in a real estate transaction is either by targeting real estate companies and compromising their business emails or by targeting the property owner, whose information is easy to obtain from public record websites that share property owner's details, like email address, phone number and date of birth.
Once an email is compromised, they can do a number of things with that information, including seeing real-time updates about upcoming sales or sending emails claiming to be from the person whose email is hacked.
Victims, whether they are commercial real estate investors or home buyers, are often targeted within a week of signing a purchase agreement, said Cronkright.
“The criminals especially profile cash sales or those with large earnest money deposits – a deposit made to a seller that represents a buyer's good faith to buy a home – so they can get more money faster," he said. “But they target everyone they can find."
Once criminals gain access to a victim's email account, they search for information on financial institutions and accounts and then email transaction instructions either through the victim's actual email account or a fake email account that resembles the victim's email address. The targets for an email account takeover are often real estate agents, title companies and buyers, according to FinCEN.
Unfortunately, Cronkright believes that incidents of wire fraud are even more prevalent than reports show, particularly for commercial real estate investors. Victims are often reluctant to share their stories, especially when the funds are irretrievable. Cronkright estimates that only about 15 percent of real estate fraud cases are reported.
In Cronkright's case, as in many other wire fraud situations, the title company either voluntarily reimburses wire fraud victims or is taken to court over the lost funds.
“We personally covered the investor's loss because we were processing the transaction," said Cronkright. “We've discovered that wire fraud is symptomatic of a bigger problem, which is the inability to confirm someone's identity. It can be hard to prove that someone is actually the buyer and that the real buyer received correct information from the real title company."
Cronkright primarily markets CertifID to title companies, attorneys and lenders to help them securely send wire information and verify identities through a simple and automated process. “Title companies, lenders, attorneys and real estate agents should provide early and meaningful notice to buyers and sellers about wire fraud," said Cronkright.
Many agents and companies now include a notice on the bottom of every email that explains that they will never send wire transfer instructions via email and that customers should immediately notify them if they receive wiring instructions through email.
There are several steps that real estate investors can take to help protect themselves against wire fraud.
Whether or not you receive email instructions for a wire transfer, Wolfe recommends calling your title company directly to verify how and where to transfer funds. If you receive an email with instructions, don't call the number provided on the email because that could be false. Instead, go back to your original paperwork to find the legitimate number for your title company or attorney.
This is essential for all emails unless you verify the sender, but especially important for an email that contains wiring instructions, according to the Coalition to Stop Real Estate Wire Fraud.
If you respond to an email about a real estate transaction from your real estate agent, attorney, lender or title company, hit forward and type in their email address rather than replying to the email. This will circumvent inadvertent communication with a criminal who may have hacked their email and used a similar email address to trick you.
The faster you find out about fraud, the more likely you are to retrieve the money. Contact your title company or real estate agent immediately to validate that the funds you wired were received.
Cronkright recommended changing your passwords frequently or using a password manager system to protect your business and personal accounts from being hacked.
Being aware about the possibility of wire fraud can go a long way to helping you avoid victimization. When investing in real estate, it's wise to ask your partners, such as title companies, lenders and real estate agents, about the steps they're taking to protect your information and your money.
This article is for general information and education only. It is provided as a courtesy to the clients and friends of City National Bank (City National). City National does not warrant that it is accurate or complete. Opinions expressed and estimates or projections given are those of the authors or persons quoted as of the date of the article with no obligation to update or notify of inaccuracy or change. This article may not be reproduced, distributed or further published by any person without the written consent of City National. Please cite source when quoting.