How to detect mortgage wire fraud before it is too late

Wire fraud victims have few options once they discover they’ve been had. But when minutes mattered, one Michigan homebuyer enlisted the help of a few friends—and made a recovery. What follows is an actual instance of mortgage wire fraud. Here's how it got detected, before it was too late.

Tuesday, November 28, 2017, 9:28 a.m. EST: Although the stiff breeze was perfectly normal for a late autumn afternoon, the bright sunshine and 60-degree temperatures contrasted starkly with the Christmas decorations adorning downtown Grand Haven, Michigan.  But, lost in his thoughts, Tom Erickson didn’t have time to take in the scenery as he strode to his office. He had just reached an agreement with the owner of a property adjacent to his own on the East side of town – he would be purchasing the new property for $135,000 cash. He was familiar with the seller’s real estate agent and his own had proven his worth again and again. In fact, he knew the seller as well (she rented another property downtown from him).  After thinking about it for years, all of the pieces were in place to for him to move forward and purchase this special property. This deal would move quickly…then he could think a bit more about the holidays.

Saturday, December 2, 2017, 1:32 p.m. EST:  Tom wasn’t a real estate agent, but he was certainly starting to feel like one.  Well, at least he was getting familiar with the often-cumbersome real estate process, as a homeowner himself and especially after co-signing refinance mortgage documents with his son recently.  Sitting down at the kitchen table to make a quick e-mail check, he wasn’t surprised to see the familiar encrypted format e-mail from the seller in his own pending transaction. Mildly comforted by the effort to stave off fraud, deceit and other faceless, lurking evils, Tom dutifully took a moment to sign in and fill out a bit of virtual “paperwork.” 

Saturday, December 2, 2017, 8:34 p.m. EST:  Wait…hadn’t he already done this?  Making one last e-mail check before settling in to watch a Christmas movie he’d seen dozens of times already…bowl of popcorn at the ready…Tom was mildly surprised to see in his inbox the same encrypted email format he thought he’d responded to earlier.  Muttering to himself, Tom dutifully registered and filled out his information again. Technology, for all its benefits, seemed to come with its share of glitches and headaches as well.

Monday, December 4, 2017, 1:58 p.m. EST: Quickly scrolling through the stream of e-mails on his phone, Tom had a couple of minutes to kill before his 2 pm meeting. Aha!  Here was one from the seller’s real estate agent.  Eh…nothing of note -just some pleasantries. Interesting that the real estate agent was using a different e-mail account than before (only slightly different).  Oh well—real estate agents are busy people.  Probably takes 3 e-mail accounts to do the job, thought Tom.  Putting down the phone, Tom rose to greet his clients as they entered the meeting room.

Tuesday, December 5, 2017, 5:58 p.m. EST:  Another e-mail from the seller’s real estate agent, this one stating that the closing would take place on the 13^thand the name and location of the title company, which happened to be just a few blocks away from Tom’s office.

Thursday, December 7, 2017, 11:31 a.m. EST:   Another e-mail from the seller’s real estate agent, but this one meant business. Clearly, the deal was racing to a conclusion.  Tom read the e-mail carefully.  He was to wire payment for the property—the bank, routing number…all there. After re-reading the instructions, Tom forwarded them to his own bank. Everything was coming together nicely!

Thursday, December 7, 2017, 12:50 p.m. EST:  Tom replied to the email that he would wire the funds on Monday.

Thursday, December 7, 2017, 1:31 p.m. EST:  Tom received an email back from the seller’s real estate agent with the closing document attached.  The email itself instructed that “All closing funds are usually deposited into the escrow's trust account three working days before closing.  We only have today and tomorrow to get this done. Try to get to your bank tomorrow morning if you can't today.”

Friday, December 8, 2017, 11:30 a.m. EST:   Tom contacted his bank with instructions to wire the funds. “Now, on to a relaxing weekend,” he thought to himself. Everything had been set in motion. Finally, there’d be a closing next week.

Monday, December 11, 8:00 a.m. EST:    A frown on his face, Tom hung up. It was the bank.  The wired funds had been returned because there was some kind of issue with the account name. If it wasn’t one thing, it was another…

Monday, December 11, 10:36 a.m. EST:  Having dutifully emailed the seller’s real estate agent about his call with the bank, Tom scanned the real estate agent’s response.  More wire instructions…(sigh).  Grabbing his car keys, Tom prepared for yet another trip over to the bank.

Tuesday, December 12, 7:05 a.m. EST:  “Hey Tom…did you get my e-mail yesterday?  About bringing the check to the closing?” A seemingly innocuous question from the seller’s real estate agent, who had stopped in Tom’s office on another matter.  It was, in fact, the first time Tom had seen the selling real estate agent face-to-face.  It had all been (presumably) e-mail to this point. However, those two sentences resonated in Tom’s head like a fire alarm. No, Tom had not received THAT e-mail. And it contradicted everything Tom had been instructed to do by the person he’d thought was the very same seller’s real estate agent. Tom points to his computer screen “this is the email that you sent me telling me to wire the funds”. The realtor looks and states “I did not send that email”.

It only took a short conversation for Tom to realize that the communications between him and the person he had presumed to be the seller’s real estate agent were, in fact, taking place with someone else.  Someone who likely didn’t belong in the loop.  Someone who was trying to steal his hard-earned money.  Within 20 minutes, Tom had e-mailed his banker as well, begging him to stop the wire transfer if at all possible.

Immediately, Tom was gripped with fear, anger and disbelief after the realization hit him: he had been defrauded out of his life savings.    But who, exactly, does one call when he believes he’s the victim of a wire fraud?  Tom’s instinct was to contact local law enforcement and his bank.  Suddenly, Tom’s life was being measured in seconds and minutes, although for everyone else, it seemed to be years and decades. Naturally, the bank didn’t open until 9.  And law enforcement promised to send someone to his office “as soon as possible.” That turned out to be 9 am. 

7:25 a.m. EST: Tom looked at the e-mail again. That was his banker’s name in the “from” field, but …something seemed off.

“Dear God, how can people be so corny? Thank God you got to discover this on time. Usually, funds don’t reflect in the receiving account until the next day after its been wired. I will alert the Fraud department right away. I am going to need you to come to the Bank around 1 30p.m to sign some documents. I am really sorry about this Tom.  We are going to start the retrieval process right away”

His suspicions heightened by the morning’s event, Tom thought for a moment. He quickly typed a reply asking the sender of the email to wait until 1:30. Tom then picked up the phone again. This voicemail to his banker would spell out all he knew about the fraud to this point.

7:40 a.m. EST: While impatiently waiting for the cavalry to arrive, Tom paced and fidgeted—unsure of what else he could do about the issue so early in the day.  The seller’s real estate agent said he had the name of a person that may be able to help back at his office. One more thing to wait for.  All the while, Tom awaited word from the bank.

9:08 a.m. EST:  Finally, progress. In the midst of giving his story to a befuddled local sheriff’s deputy, Tom’s real estate agent called again.  This time, he had a suggestion.  The real estate agent‘s broker had a friend in Grand Rapids who had been the victim of wire fraud himself and he called in a favor to help.  That contact, an attorney and title agent, had managed to recover most of his own stolen funds a couple years back. Within minutes, as the deputy looked on with interest, Tom was on the phone with me.

9:31 a.m. EST:  “With all due respect, officer, there’s probably not a lot you can do right now. The police couldn’t help me in my case because money crosses state lines so quickly. Tom, here’s what you need to do RIGHT NOW. Every minute matters…” I explained as Tom and the deputy stared intently at the conference room speaker phone. Over the next ten minutes, I spelled out the multiple steps needed to identify his funds were transferred, how to “freeze” the funds from further transfer and, as best possible, begin the tracking process to the root of the fraud.  Tom jotted notes feverishly and agreed to follow the instructions to the letter…

Wednesday, December 13, 2017, 3:30 p.m. EST: Tom was tired. Bone weary, in fact. The past 24 hours had been a whirlwind of activity. With my understanding of the severity of the fraud and knowing that time was of the essence for any chance of recovery, I added an anti-fraud/security consultant from Pittsburgh, Ken Robb, to the mix.  Ken was well-connected in the fraud prevention community, and had instructed Tom to file a crime report through the FBI’s cyber crime complaint portal while he immediately set about contacting several key, behind-the-scenes people. Tom learned, to his amazement, that this kind of fraud, wire fraud, was so rampant that his loss (about $135,000) was considered low-priority by virtually any and all law enforcement agencies, who were simply overwhelmed with casework. Nonetheless, Ken was able to call in a few favors that would help Tom trace his stolen money. At the same time, Tom followed my instructions as he spent his second day camped out at his bank. Not all were intuitive but looking back they were all material to recover process.  By the end of the day, Tom received enough information to instill hope that most of his money would be recovered.

Today: Although Tom’s case was never completely solved, quick work by the bank, Ken Robb, myself, and others have helped Tom Erickson recover most ($120,000) of his stolen funds. The team has also traced the money trail, as the stolen funds were transferred at lightning speed from Tom’s bank in West Michigan to a bank in Maine to another depository in South Florida. Today, Tom has pinpointed at least one member of the fraudster group—apparently, most wire frauds are international in nature, and generally involve multiple perpetrators. Unfortunately, the amount of wire fraud taking place is so massive that law enforcement is stretched to its breaking point.  As a result, there is little that can be done from their perspective—especially since most of the funds have been recovered.

Tom remains introspective about the entire event. “Fraudsters are clever—they know when you’re most distracted and that’s when they move,” he said. “If I’ve learned anything, it’s this: trust the voice in your head when it notices something’s even a little off. I noticed the second request for information via encrypted email, but didn’t think to verify the request. I noticed the different e-mail address from the selling real estate agent but didn’t think anything of it. And when the first wire failed, I should have heeded the instructions from my real estate agent.  I am thankful that my real estate agent’s broker made the call that led to Cronkright and Robb becoming fully engaged in helping me recover. I was a complete stranger to them when the call came in and they took time out of their lives to dive in when it really mattered.  Who does that?”

The fact of the matter is that wire fraud perpetrators have fooled industry professionals and consumers alike—including veterans extremely familiar with the real estate closing process. They’re also growing more brazen and sophisticated by the day. To this point, the real estate and mortgage industry has been caught mostly unprepared. But preparation starts with awareness.  Whether you’re a real estate agent, a home buyer, a mortgage broker, title agent or loan officer, you are now officially on notice:  mortgage wire fraud is not a nuisance.  Instead, it’s a threat; an epidemic. It’s now past time for the entire industry to address it as the crisis it is.