The real estate industry has become an increasingly attractive target for cybercriminals in recent years. With vast amounts of sensitive personal and financial data, high-value transactions, and often inadequate security measures, real estate companies face significant cyber risks.
Key Cybersecurity Threats
Business Email Compromise (BEC) and Wire Fraud
BEC scams involve criminals impersonating executives or trusted partners to initiate fraudulent wire transfers. Given the large sums involved in real estate transactions, these attacks can be particularly devastating. The FBI reported 9,521 real estate-based BEC complaints in 2023, highlighting the industry’s vulnerability to these attacks.
Phishing Attacks
Phishing remains one of the most common and effective attack vectors in real estate. Cybercriminals send fraudulent emails posing as trusted entities to trick recipients into revealing sensitive information or clicking malicious links. These attacks often target real estate professionals aiming to gain access to client data or financial accounts.
Ransomware
Ransomware attacks have surged across industries, including real estate. In these attacks, malicious software encrypts a company’s data, with the attackers demanding a ransom for its release. For real estate firms, such attacks can cripple operations and compromise sensitive client information.
Evolution of Real Estate Threats
Recent phishing attacks targeting real estate agents and buyers have become increasingly sophisticated and prevalent. Here are some key examples and trends:
- Email account compromise: Scammers are hacking into real estate agents’ email accounts, particularly those using Gmail or Hotmail, to monitor communications about upcoming closings. They then use this information to send fraudulent wire transfer instructions to buyers.
- Fake property listing inquiries: Attackers send emails posing as potential buyers interested in a property, often through platforms like Zillow. When agents respond, it gives scammers access to compromise their email accounts.
- Fraudulent wire transfer requests: Using compromised email accounts, scammers send seemingly legitimate emails with fake wiring instructions to redirect large sums of money meant for property purchases to their own accounts.
- Impersonation of trusted entities: Phishing emails are designed to look like they’re from banks, mortgage lenders, or other trusted real estate professionals, asking recipients to reset PIN numbers or provide sensitive information.
- Lockbox code change requests: Scammers send emails or texts posing as clients, requesting changes to lockbox codes to gain unauthorized property access.
In addition to common threats plaguing our industry for years, new trends have emerged in the last twelve months.
- Increased sophistication: Phishing emails have become more convincing, with perfect English, professional language, and even accurate logos or signature blocks of legitimate companies. This makes it harder for them to identify as fraudulent.
- Targeted spear phishing: Instead of mass phishing attempts, attackers are using more targeted “spear phishing” approaches, specifically going after real estate professionals and parties involved in transactions.
- Exploitation of multiple parties: Attackers are targeting various participants in real estate transactions, including buyers, sellers, agents, and third-party vendors, to increase their chances of success.
- Use of legitimate-looking links and attachments: Phishing emails often include links or attachments that appear genuine but are designed to harvest credentials or install malware.
- Cloned emails and websites: Attackers create fake emails and websites that closely mimic legitimate ones, often using nearly identical domain names or email addresses with slight variations.
- Home title fraud: With the increasing digitization of property records, cybercriminals are attempting to steal personal information, forge signatures to falsify documents, manipulate ownership records, or fraudulently sell properties.
- Exploitation of remote work trends: With more real estate work being done remotely, attackers are taking advantage of potentially less secure home networks and cloud services.
- Cloud breaches: With the shift to remote work and increased use of cloud services for real estate transactions, attackers are focusing on exploiting vulnerabilities in cloud infrastructure. This is especially risky when employees access crucial data and personally identifiable information (PII) outside the office.
- Third-party vendor exploitation: Cybercriminals are increasingly targeting the numerous third-party vendors and subcontractors involved in real estate transactions. A breach in just one of these vendors can potentially harm the entire real estate company and its clients.
- Smart home exploitation: As smart home technology becomes more integrated into properties, cybercriminals are increasingly targeting Internet of Things (IoT) devices. Vulnerabilities in smart thermostats, keypad locks, and garage door openers can be exploited to gain unauthorized access to homes or sensitive data.
These attacks highlight the evolving nature of cyber threats in the real estate industry, emphasizing the need for robust cybersecurity measures, employee training, and vigilance throughout the transaction process.
Protective Measures
To mitigate these cyber risks, companies, and businesses should implement comprehensive security measures:
Conduct Regular Risk Assessments
Evaluate your company’s cybersecurity infrastructure to identify potential vulnerabilities. Use this information to develop a tailored, long-term security plan.
Implement Robust Employee Training
Educate staff on recognizing phishing attempts, social engineering tactics, and other cyber threats. Regular phishing simulations should be conducted to test and reinforce this training.
Enhance Access Control
Implement strict user access policies, including two-factor authentication for remote workers. Ensure that organizational email encryption and anti-malware programs are up-to-date.
Improve Data Storage and Disposal Practices
Follow established guidelines for consumer data disposal to prevent unauthorized access to deleted information. Regularly scan for vulnerabilities and use password managers to enhance security.
Develop an Incident Response Plan
Create a comprehensive response plan to prepare for potential breaches. This plan should include steps for containing the breach, notifying affected parties, and recovering compromised systems.
Invest in Cybersecurity Technology
Implement advanced security solutions such as next-generation firewalls, endpoint detection and response (EDR) systems, and security information and event management (SIEM) tools.
Regularly Update and Patch Systems
Ensure all software, operating systems, and applications are promptly updated with the latest security patches to address known vulnerabilities.
Consider Cyber Insurance
Explore cyber insurance options to provide financial protection in the event of a successful attack. This can help cover costs associated with data breaches, business interruption, and legal liabilities.
Conclusion
As cyber threats continue to evolve, the real estate industry must prioritize cybersecurity to protect sensitive data and maintain client trust. By implementing robust security measures, providing comprehensive employee training, and staying vigilant against emerging threats, real estate companies can significantly reduce their cyber risk exposure. Remember, cybersecurity is an ongoing process that requires constant attention and adaptation to new challenges. Our industry is evolving and becoming very technical. Ensure you have (internal or retainer) resources that qualify to provide guidance and assistance when needed.
Genady Vishnevetsky
Genady Vishnevetsky serves as Chief Information Security Officer (CISO) for Stewart Information Services Corporation, a leading provider of real estate services, including global residential and commercial title insurance, escrow and settlement services, lender services, underwriting, specialty insurance, and other solutions that facilitate successful real estate transactions. An established leader with experience in building successful security programs and developing the defense against emerging threats, Vishnevetsky leads security, governance, and compliance programs for global enterprises. Genady holds the following cybersecurity and risk management certifications – Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified in Risk and Information Systems Control (CRISK).
