An article from the FLTA Cyber Security Committee
1. COMMUNICATION WITH CONSUMER:
A. Initial Phone Call to Consumer in the beginning of the transaction:
- Verbally confirm that the request to initiate the wire is from an authorized person within the title company and inform them that the wire instructions will not change.
- A cashier’s check, a certified check or a wire transfer is acceptable to bring to closing. Many title companies today will only accept wire transfers and limit personal checks to no more than $500, but please be sure to check with your title company regarding their policies for accepting funds.
- Communicating directly with title company: Secure transmittal of documents and information
-
- Some title companies will utilize a portal for sharing documents and information. A client portal is a website, web application or mobile device which provides businesses a secure storage space to let all parties share important documents or information related to the closing process.
- Use of secure and encrypted email is a best practice today. Regular un-encrypted emails are easily read by anyone, regardless of whether that person was the intended recipient or not. With secure email encryption, individuals and enterprise systems render the contents of the message unreadable as the email is sent from origin to destination. Most encryption requires a password to access the information in the email.
- Contact the closing company via the phone number listed on their internet website or call the direct line that you have been using throughout the process and especially on day of the wire transfer. Never use the phone number listed on an email. If someone whom you have not spoken with from the title company calls you to verify personal information, get your social security number or verify wiring instructions inform them you will call them back and use the phone number from website or direct line.
- Verbally confirm wire instructions directly with the title company where you are closing. Be alert and speak directly with the title company if you suspect any email, text compromise or suspicious activity related to your closing.
2. COMMUNICATION WITH REALTORS
A. Speak with Realtors at the beginning of the transaction: How are we communicating with them?
- Understand your realtor’s means of communication
-
- Communication takes the lead in most things that you do during the closing process. Effective communication goes beyond saying a couple of things and assuming that you are on the same page with your realtor partners. One important consideration is finding how the realtor likes to interact and following a preferred method. Most realtors today like to communicate by email or even text messaging. There are some folks that would like you to pick up the telephone to call. Some are tech savvy and prefer to use another mean of communication. It is best to set proper expectations with your realtor at the beginning of the transaction to avoid any miscommunications.
- Consider using a portal for communication
-
- Some title companies will utilize a portal for client communication. A client portal is a website, web application or mobile device which provides businesses a secure storage space to let all parties share important documents or information related to the closing process.
- With the client portal, customers don’t have to reach out to the company for each item in a transaction This creates less strain on the company, as they don’t have to answer the phone call or get engaged in any type of real-time conversation.
- Although client portals are more secure than email, many businesses have a concern about the security of their data in the cloud. These types of businesses can opt to have a private cloud for their sensitive data and take the on-premises hosting of software.
- Telephone verification on the day of the wire transfer
-
- Verbally confirm the request to initiate the wire from an authorized person within the title company.
- § Contact the closing company via the phone number listed on their internet website or call the direct line that you have been using throughout the process, especially on the day of the wire transfer.
- Create a standard warning document about wire fraud and other real estate scams
-
- You may wish to consider adding a warning to your email signature line on wire fraud. This notice should not serve as a substitute for educating your clients and other participants in your real estate transactions about email wire fraud.
- Provide a document that informs your Buyers and Sellers of wire fraud: what it is, how it occurs and how to protect yourself from it.
B. Email discussion with Realtors
- Open email system:
-
- An open email system provides visibility to all team members. From a business perspective, the open system is a great convenience for sharing information and coordinating business process functions, but it also creates significant security risks because of the lack of privacy that is the essence of its very nature. The more people who have access, the more exposure to risk.
- Additionally, email, itself, is an open format because it can be viewed by anyone who can intercept it (i.e. hackers), despite whether the system is intentionally designed to be shared among team members.
- Compare to secure email:
-
- Today, there are two main protocols used for encrypting emails: TLS, encrypting an email while it’s in transit and End-to-end email encryption. Encrypted email technology is meant to render the content of your emails unreadable as they travel from origin to destination. For emails that hold highly sensitive information it is best to use End-to-End encryption. It is designed so that the content can only be decrypted by the intended recipient on their device. While TLS provides strong protection against attacks, the emails are still only secure when they are in transit. Take precautions to preserve privacy, and do not copy other service members on the email, as this could lead to compromising sensitive information or attachments related to the file.
- Tools to secure email:
-
- There are various technology tools available for purchase to create an encrypted email environment, such as automation and digital signatures. However, there are also some very simple steps to take, as well as free or low-cost tools available, to help secure your email:
- Do not share a common email account with anyone else
- Use strong passwords; change email passwords frequently, especially before sending out wiring instructions
- Employ a unique and not easily reproducible email name
- Email Hosting Services for secure email
-
- When using a common email platform, like Gmail or Yahoo, it is relatively easy for a fraudster to impersonate another’s email; after all, anyone can sign up for a free Yahoo or Gmail account. By changing one solitary letter in a free account email name, a hacker has an excellent chance of passing himself or herself off as the authentic sender – particularly when the recipient does not look too closely at the spelling of an expected email.
- An alternative is to use an “email hosting service,” such as Go Daddy, to purchase a specific, unique domain name for your email that cannot be impersonated (e.g. JohnDoe@MyBestRealtor.com). These services have a variety of options, such as a landing page (i.e. a webpage that subscribers are directed to after filling in fields for contact), and encryption.
