AI making life easier for business email compromise scammers, cybersecurity experts warn

Three days before closing on his Chicago-area condo in September, Cullen Brown received an email detailing down payment wiring directions from the title company working with the seller, one of the final steps before he could achieve his dream of first-time homeownership.

But the instructions hadn’t actually come from the title company. Brown had wired nearly $60,000 ($A94,000), just about the entirety of his savings, to the wrong place.

WATCH THE VIDEO ABOVE: How to make yourself scam-aware.

He’d been scammed.

Without realising it, Brown had fallen victim to a real estate con that has grown more common as communication for business transactions increasingly move online.

The FBI calls this sophisticated scam “business email compromise,” or BEC. It occurs when a criminal hacks into the email account of a legitimate business or individual to impersonate them, then tricks another person into sending money or sensitive information.

Experts warn that new technologies such as artificial intelligence and faster payment products have made this scheme even harder to detect and track down.

To Brown, the supposed title company’s email looked legitimate: It included his name, address and the amount of money he owed for his home’s down payment.

“The email came three days before closing. It had all the correct closing information. It all made sense in the moment,” Brown said.

The FBI received 21,489 BEC complaints with adjusted losses of over $US2.9 ($A4.5) billion in 2023, making business email compromise the second-costliest type of crime last year, according to the federal agency’s most recent Internet Crime Report.

“If you go through the home-buying process these days, this sort of thing does happen,” said Michael Chapple, a business analytics and cybersecurity professor at the University of Notre Dame.

“Unfortunately, it’s successful because people either don’t heed warnings about this type of attack, or it’s just too convincing and has an air of legitimacy to it.”

An under-the-radar risk

Brown caught the fraud quickly. His attorney called about an hour after Brown sent the money to let him know it hadn’t been received by the title company.

“That’s when it all started to unravel,” Brown said. “I realised it was my mistake not verifying this information beforehand.”

He believes the criminals hacked the title company’s email to get his personal information.

In a survey of 650 homebuyers and sellers, more than half of respondents said they were only “somewhat” or “not aware” of fraud risks, according to a recent report by CertifID, which provides fraud recovery services.

Ritu Tirthani, a 37-year-old in Nashville, said she had “no idea something like this could happen to somebody” until she, too, was tricked into wiring her home’s down payment, worth tens of thousands of dollars, to scammers in August.

She didn’t learn about the con for an entire day.

“The day after I wired the money, I got a call from the banker saying they hadn’t received the wire yet,” Tirthani said. “I remember my brain just froze. I’ve worked two jobs just to afford this house.”

Advances in technology have increased the risk of real estate fraud, according to CertifID. AI has helped criminals more effectively communicate and the Federal Reserve’s FedNow instant payment feature launched in 2023 has greatly compressed the window to potentially recover fraudulent payments.

Real estate is especially vulnerable to fraud because data on property listings is publicly available and the transactions usually involve large sums of money, CertifID CEO Tyler Adams told CNN.

Tirthani immediately contacted the authorities after learning of the fraud and said she called her bank four times a day to check whether they had recovered her money.

“I don’t think I slept for four nights,” Tirthani said. “I felt like, ‘Oh my God, somebody could just trick me like that and take everything I worked for?’”

Watch out for red flags

Both Brown and Tirthani were able to recoup their money and close on their homes. CertifID helped Brown get the bulk of his money back in one week, and Tirthani said the FBI helped her track down all of her money in about two weeks.

Neither Brown nor Tirthani said they knew the identities of the people who tried to steal their money. Many other victims don’t get their money back at all.

Joan Rogers, a real estate agent in Portland, Oregon, has been taking extra precautions with buyers and sellers. Years ago, a deal she worked on was nearly scuttled when a homebuyer was tricked into wiring $500,000, the entire cost of her future home, to scammers. The buyer didn’t realise her mistake for more than 48 hours, and Rogers doesn’t believe the money was ever tracked down.

The longer someone waits to report the crime, the less likely it is that the money is recovered, Adams said. Even in instances where the money is found, it can take years to get it back.

Since that incident, Rogers told CNN she asks that her clients copy her on all incoming emails to ensure they are legitimate.

“I always tell clients not to open an email from my escrow company unless you get the all-clear from me first,” Rogers said. “It’s time-consuming, but I couldn’t stand the thought that I could have prevented something by taking the extra time to do that.”

Cliff Steinhauer, the director of information security at the National Cybersecurity Alliance, said homebuyers and sellers should look for red flags among the flurry of emails and other communication around a home’s closing.

“Look out for an unexpected change in the amount of money owed, a change in where to send it or a change in the person you’re dealing with,” Steinhauer said. Real estate agents can also help verify this information.

“The main thing you have to remember is that any incoming message can be faked,” he added. “It can be faked from who it’s coming from, so picking up the phone and calling a known, trusted phone number to validate information is really important.”

Steinhauer advises not to call a number included in emails, since that can also be spoofed. Instead, find a phone number from the company’s or individual’s website.

If you suspect that you’ve fallen victim to this type of wire scam, contact the police and your bank immediately, he said.

In an era of low inventory and increased competition for homes, buyers may feel pressure to respond quickly, making themselves more vulnerable to these types of scams.

Tirthani said if she could go back to the moments before she wired the money, she would tell herself to slow down.

“Don’t rush so much. Everything feels like a rush during that time,” she said. “It feels like anybody can ask you for anything and you’ll just give it to them.”