Shannon Havens, Escrow Officer in Whitefish, Montana, received a few emails from someone who was impersonating her seller. As she reviewed them she was able to identify the following red flags she had previously read about in Fraud Insights:

• The seller sent her an email with new wire instructions for his proceeds.
• The email had poor punctuation, grammar and run on sentences, including "advise" spelled as "advice."
• The account name was not the name of the seller in her transaction.
• The seller indicated the bank account was under review and needed to change wire instructions at the last minute.
• The Canadian seller directed her to wire his proceeds to a U.S. Bank in South Carolina.

Other than the last minute emails, the transaction was seemingly normal. Shannon spoke to the seller and his real estate agent by phone and kept in regular communication with them by email. The seller was very responsive to any of her requests and followed her instructions in a timely manner.

A week prior to the scheduled closing date, the seller sent her wire instructions for his proceeds, which she confirmed with him on the phone. On the day the transaction was scheduled to close she received the following correspondence:

• "Hi, Shannon, what time we expect to be recorded and when should I expect the Disbursement of Sales proceeds."

Shannon replied she did not know the exact time she would be able to record and would let him know as soon as she received the buyer's closing funds.

• "You should email me once you have the buyer's funds, I have a pending transaction on my account which I thought would have cleared before now and the account is presently under review. I am not sure if the problem will be resolve today, Can I provide a trust account for the wire of sales proceeds to enhance a smooth transaction. Please advice."

Shannon stated that would be fine, but asked him to confirm he did not want her to wire his proceeds to the account he previously supplied.

• "I don't want it wired to the RBC account again, the account is still under review. I will forward the new account details shortly."

The hair on the back of Shannon's neck stood up as she had a feeling of what was going on. Next, she received an email with different wire instructions. The account name on the instructions was for an LLC with further instructions to reference the seller's name.

The buyer's funds came in and the transaction closed with no other hiccups. When it came time to disburse funds, Shannon picked up the phone and called the seller at a known phone number and left him a voicemail to call her right away.

She also emailed the seller's real estate agent to let her know she had received an email from the purported seller with new wiring instructions for a different account. She informed the agent she would not release the wire until she was able to speak with the seller direct to verify his wire instructions. Not five minutes later the seller replied to her email.

• "I got your calls and voice note. I can't receive or call out for now because I am in a conference. You should go ahead with the wire of my sales proceeds to the new account details provided earlier."

The real estate agent called Shannon to find out if the transaction was recorded. Shannon asked if she received her email. The real estate agent said no, she had not received any emails from Shannon. Shannon did confirm the file was recorded and they hung up the phone.

As soon as their call ended, Shannon received an email from the real estate agent.

• "You should go ahead with the wire, He informed me about the changing of account and also said he will be in a conference."

It was signed exactly as she would sign all her emails. Shannon felt a little suspicious and wondered why the real estate agent did not tell her this over the phone.

Shannon replied stating she had to talk to the seller. The agent replied.

• "Yes I spoke with him earlier today, He can't pick up if you call him right now, He should be in a conference. You can go ahead with the wire, I am sure he will give you a call later."

Shannon called the real estate agent back to confirm whether she had been emailing her. The real estate agent confirmed she did not. Shannon stopped communicating via email with everyone in the transaction and reported the incident by hitting the "Report Phishing" button on her Microsoft^® Outlook^® toolbar.

The seller called her back and confirmed he did not send her revised wire instruction. Shannon explained the situation to him, and he was very grateful she did not act on the revised instructions. Turns out, the real estate agent's email had been compromised. The agent found out any email from her would automatically defer to the hacker.

Everyone — including the seller, real estate agent and Shannon's colleagues — was amazed by how tricky the fraudsters were. The emails supposedly came from two different people, but in reality it was the one hacker responding. Shannon said, "It made me sick to think what could have happened. For this, I am very grateful to Fidelity National Title to advise me of this scheme and constantly remind me to VERIFY WIRE INSTRUCTIONS!"

We are grateful to you Shannon for identifying the scam, and taking the steps necessary to protect and save the Company from a $210,818.60 loss. She is being rewarded $1,500.