Andrew Zankel, with Core Title Services in Lake Success, New York, was handling the closing of a multi-million dollar refinance of a commercial property in Brooklyn, New York. The refinance transaction was originally supposed to close on April 17, 2019.

On April 10, 2019, an attorney, at a large law firm in New York, sent the office a payoff letter for a private mortgage secured by the subject property. The payoff letter indicated the $1,700,000 payoff of the short–term loan was to be wired to a bank account at a bank in New Jersey. The lender was also based in the same area of New Jersey and the contact info for the lender was a phone number in New Jersey.

The afternoon before the closing, Andrew received an email from the payoff attorney's office stating that his client had supplied him with a new payoff letter. The wire instructions changed to a bank in the Netherlands and the contact information for the lender changed from a New Jersey area code to a foreign phone number. The email stated that the lender would also fax Andrew the payoff letter directly to his office, but they never did.

The closing did not happen as planned on April 17, 2019, as it was postponed to a later date. Andrew was concerned by the change in instructions but did not question them, as he would have to reconfirm the information when it was rescheduled.

When the closing was rescheduled for April 22, 2019, Andrew emailed the attorney and his assistant and inquired about the change in bank wire information. The response from the attorney came back confirming everything that was sent on April 16, 2019, was correct. Andrew was asked to contact his assistant when the wire was sent, as he would be out of the office for a few days.

Something did not feel right to Andrew. He decided to look more closely at the emails he received from the attorney. While investigating, he noticed that the domain name in the attorney's email had an extra "s" in it starting with the emails on April 16, 2019, and continuing through the emails he received that morning. All the emails prior to that did not have the extra "s" in the email address.

The attorney's email signature block was also partially cut off starting on that date and going forward, which was odd since he was a partner at a prestigious law firm in New York City. His assistant, who was copied on all the emails, always had the correct email address which was puzzling.

At this point Andrew knew something was wrong and went to consult with Ethiel Melecio, Jr., who he had been working with on this file. Ethiel is the legal counsel in his office.

Andrew showed him the evidence and Ethiel agreed something was not right. He said he felt something was different about the emails received prior to April 16, 2019. The ones prior were written by a knowledgeable attorney; while after April 16, 2019, they were well written, but not quite the same.

At this time, which was about two hours before the closing, Andrew received an email from the assistant of the attorney asking if the wire had been sent. He did not want to alarm her as he suspected that her email had been compromised so he responded that the closing was happening shortly, and he would be in touch.

Andrew then proceeded to perform an internet search for the law firm, as he felt he could not trust the contact information in the email. He called the main number and asked for the assistant directly. She answered her phone and Andrew inquired about the bank wire instructions. She was confused by what he was saying and insisted the wire instructions had not changed since April 10, 2019, when the original payoff letter was sent.

Andrew asked about the email he just received from her and she said she had not sent anything. Andrew started to fill her in on the details. The assistant was shocked, as she and her boss had not sent any of the emails in question.

The assistant stated the attorney was in court and she said she would call him to relay the information. Andrew asked her to please not email him as that would alert the scammers that they were on to them. A minute later the assistant emailed the attorney and her information technology team telling them everything. At that point, the scammers knew everyone was aware of the scheme.

Andrew spoke to Underwriting Counsel Scott Spinner, at the New York Fidelity agency office, and Scott gave his thoughts on the situation. Andrew and Scott concluded they could not trust any wire instructions on this transaction and would only make this payoff by bank check to the attorney and have the check hand delivered to their office in New York City.

Andrew called the assistant back and as he started speaking to her, he received yet another email from her with new wire instructions for the payoff. Andrew asked if she had sent the email as they were speaking, and she said she did not send anything. Andrew and the assistant were both in shock as he then received yet another email from her email account demanding he call the lender immediately to confirm the new wire instructions.

Minutes later a man called Andrew's office asking for legal counsel to confirm the instructions. Ethiel, fully aware of the situation, answered the phone and the man on the other end insisted he was the lender and wanted to verbally confirm the wire instructions which were just sent via email. Andrew and Ethiel played along and hung up the phone. Andrew then left for the closing with the new plan to just send the payoff as a bank check to the attorney by messenger.

Andrew verbally confirmed receipt of the payoff funds, received the release documents and recorded them with the County Clerk. The borrowers — who were in shock at everything that happened — also confirmed with the lender the check was received and the loan was paid off in full.

Andrew said, "It is a pretty crazy experience to go through. We try to be on the edge of technology and what is happening out there in the industry. I take all the webinars on cyber–crime and read as much literature as possible on the topic to be aware of their methods. This is how I was able to pinpoint the discrepancies in the emails and notice the extra "s" in the email address. I know what a threat wire fraud is to our industry and am a big supporter of education on the topic."

This story, as told by Andrew, was submitted in hopes it will help others be on their toes in similar situations. Thanks Andrew!