Joanne Stellini, Escrow Officer with Lawyers Title Company in Castro Valley, California, reads each and every issue of Fraud Insights and takes it all to heart.

Based on what she has learned she never acts on wire instructions she receives by email. Instead, she picks up the phone and calls the sender at a trusted phone number to verify they sent her wire instructions, AND she verbally confirms the wire instructions are correct by confirming the bank, account number and account name.

In December 2016, one day before closing, the listing agent emailed asking her when the file was scheduled to close. This was odd because she already knew the file was scheduled to close the next day.

The font contained in the body of the email was completely different than it was in all the other emails Joanne received from her. She also noticed the email address did not match. The real estate agent normally used a vanity email account similar to Jane@janedoe.com. The email came from jane.janedoe@gmx.com.

Joanne picked up the phone and called the listing agent who confirmed she did not send the email. Joanne suggested she contact her IT department to check her email account. Shortly after they hung up the real estate agent called back and said she changed her password, and hoped the hacker was no longer able to track the transaction.

The next day another email came from jane.janedoe@gmx.com, which included wire instructions. Joanne already knew the instructions came from a fraudster but she noticed right away the instructions were flawed because the account name did not match her seller's name. She called the listing agent who asked her to take a picture of the email and send it to her phone so she could share it with her information technology officer.

Joanne reported the email to information security at our Company using the Report Phishing Button.

She continued to communicate with the parties to her transaction only by phone. Joanne always verifies emailed wire instructions on all her transactions. Way to go Joanne! For her adherence to policy and procedure, and saving the Company on this file she has been rewarded $1,500.

Another thing we have learned…

In the examples that follow, the emails purportedly coming from the listing agent's sale transactions are date/time stamped from a completely different time zone! That is right, the real estate agent is supposed to be in the same geographic location as the settlement agent, but the emails are coming from a different time zone altogether.

These examples of messages are listed from oldest to newest. The escrow officer is responding immediately to the emails, but the time stamp shows a five hour time difference between her response and the listing agent's response.

Another example reflects the time stamp on the response from the escrow officer to be prior to the request time from the listing agent:

Although not definitive, these timestamp differences are yet another red flag that could indicate fraud in the transaction. As we always advise, if something does not seem right about the email you receive, pick up the phone and call to confirm.