August 2016
Over the last two weeks, Lawyers Mutual has received multiple reports of North Carolina attorneys who were targeted by scammers attempting to divert seller closing proceeds following real estate transactions. Unfortunately, several of these attacks were successful and hundreds of thousands of dollars were stolen and are very unlikely to be recovered. However, several attacks were foiled by attorneys and staff members who approached transactions with a high degree of skepticism.  
While the details of the recent scams are emerging, it appears hackers first became aware of the closing by compromising email accounts of differing parties. Sometimes the attorney account was compromised, sometimes the Seller's account was compromised but the most common scenario was the Realtor's account was being monitored by international criminal organizations. The foreign-based hackers would observe the account, likely for several weeks, and only actively intervene once an understanding of the business practices were obtained and a significant wire was to be produced. In the interim, the unsuspecting Realtor would continue to use the account unaware his or her client and the closing attorney were being set up to be robbed.
Below are some tips which will help your office avoid falling victim to the latest series of scams.
Best Practices to Avoid Falling Victim:

  1. EVERY wire request should be verified and the more personal the verification, the better.
The best way to verify wiring instructions is to have the Seller sign the wiring instructions at the closing ceremony in the presence of the attorney. We know of no wire fraud which has taken place when this has occurred, and even if it did, the closing attorney would likely be insulated from liability by the doctrine of contributory negligence.
If the Seller is unable to attend the ceremony, we recommend the wiring instructions be included in the same package in which the deed is delivered. In these situations, have the Seller sign wiring instructions and have the signature notarized, if possible. Even then, we recommend the Seller verify the closing instructions over the telephone via a call initiated by the law office, using contact information from very early in the file prior to any discussion of proceeds and wires.
Confirming a telephone call verification via email is a good practice and a great way to document the file. However, an email verification alone is inadequate.

  1. Do not accept changes to wiring instructions.
  1. If wiring instructions are attached to an email from a free email service (gmail, yahoo, aol.com, nc.rr.com, etc.) they should be assumed to be fraudulent and extra diligence should be taken in the verifying their authenticity. Sometimes hackers will set up an alias account with a very similar name (frequently dropping or swapping letters) to send modified instructions so the authentic user is not aware of their presence. Examining the account name in detail is a good idea; however, as the hacker already has access to the original account, he or she may be not take this step and will use the same account that all other correspondence used.
  1. Real Estate attorneys should not be using free email accounts. These accounts have major security concerns and are likely being mined for data by their providers in violation of Rule 1.6 of the Rules of Professional Conduct. In addition, they are very unlikely to be complaint with the ALTA Best Practices.
If you are currently using a free service, immediate action should be taken to find a more secure and professional alternative. In the interim, it is possible to see when and from where the free account was recently accessed. Here is a link explaining how to do it for gmail accounts: http://www.groovypost.com/howto/check-gmail-login-activity/ Other services should have similar abilities. If you see suspicious activity, please immediately change account passwords and contact your professional liability carrier along with your cyber or crime carrier.

  1. Be very suspicious of wires going to any account that is not in the name of the Seller. Also, be suspicious of any account with a geographic location different than the Seller. Why is a North Carolina Seller relocating to New York sending a wire to Wisconsin? There are some reasons for the different names and odd locations, but these are red flags which should be explored in detail (and not via email).
  1. Do NOT send wires overseas. Once money leaves the United States, it is likely gone forever.
  1. Regularly change your passwords.
We understand these policies appear harsh and some pushback may occur. However, hacking crimes can be devastating to a law firm's finances and reputation. Explaining the policy up front is a good way to limit negative actions. Below is sample language I recommend to be included in your Seller engagement letter
Funds Availability Policy.
It is our goal to make real estate commission checks and funds available as soon as practical following closing. However, NC State Bar Rules expressly prohibit disbursing any closing funds prior to recording. Should you request funds be wired, our office can accommodate the request for a fee of $___.00.   In order to prevent fraud and protect your proceeds, all wiring instructions will be verified and you will be required to sign the instructions at the closing ceremony. THIS OFFICE WILL NOT ACCEPT CHANGES TO WIRING INSTRUCTIONS.
NC State Bar Scam Warning from Peter Bolac
Post Office Box 1929      Cary, NC 27512