Over 200 homebuyers were scammed out of their life savings, losing an average of $85,000 each and $20 million total, as the result of a sophisticated email compromise scheme targeting real estate transactions. Here’s how it happened—and how you can protect yourself.

 

How the Scam Worked

Cybercriminals didn’t target the homebuyers directly. Instead, they infiltrated real estate agents' email accounts through phishing attacks, gaining access to sensitive communication. Once inside, they waited patiently for transactions to near completion. Then, posing as the agents, they sent fake wiring instructions to buyers. Trusting the seemingly legitimate emails, victims unknowingly transferred funds to fraudulent accounts.

 

What Went Wrong?

• Lack of Two-Factor Authentication (2FA): Many email accounts lack basic security measures like 2FA, which adds an extra layer of protection by requiring a second verification step.

• Reliance on Email for Sensitive Information: Wiring instructions were sent via email, a non-secure communication method easily spoofed or compromised.

• Lack of Verification Protocols: Buyers didn’t verify wiring instructions over the phone or through secure portals, making them vulnerable to deception.

 

How to Stay Safe

• Enable Two-Factor Authentication: Protect your email by requiring a second step to log in. Even if your password is stolen, 2FA can block unauthorized access.

• Avoid Sharing Sensitive Information Over Email: Use secure client portals or encrypted communication tools to share critical details like wiring instructions.

• Verify Instructions Independently: Always confirm wiring instructions directly with the sender via a trusted method, such as a phone call to a known number.

• Educate and Prepare: Businesses and individuals alike should recognize that they are potential targets. Regular training and awareness can prevent costly mistakes.

 

Industry and Policy Improvements Needed

This case highlights the need for systemic changes in real estate and banking practices. Secure client portals, pre-authorized wires, and stricter bank verification processes could significantly reduce fraud risks. Meanwhile, small firms must take cybersecurity seriously, adopting measures like SSL encryption for websites and mandatory client education on safe communication practices.

 

What You Can Do Now

Take action today: turn on 2FA, review your email security, and ensure your transactions follow best practices. It’s not just about protecting money—it’s about safeguarding your peace of mind.