Every wire fraud defense expert says the number one factor in recovering diverted funds is time. Every minute counts when fraud has been detected, and hesitations or delays can impede efforts to track down and restore lost funds.
That’s why a Wire Fraud Response Plan is imperative for every title agent.
Before you create your plan, or if you are undergoing a review of your current plan, we encourage you to download Alliant National’s recently updated Escrow Fraud/Social Engineering: Recent Schemes and Prevention Tipswhite paper. This 23-page guide provides an in-depth review of the current schemes and offers a wealth of tools and resources for building a strong defense against fraudsters.
Here are some things to consider when creating your response plan.
Elements of a Wire Fraud Response Plan
The first step in preventing wire fraud is to maintain policies and procedures for verification of wire instructions for the protection of everyone involved in the real estate transaction.
But should the unthinkable happen, remember that the most successful response strategies are those established well in advance and communicated to staff members and your bank.
Like a well-trained sports team, every member of your team must know their role and be prepared to leap into action.
General protocols
Establish a close relationship with your bank representatives and continually dialogue regarding updated fraud threats.
Discuss wire retrieval scenarios and establish emergency contacts in the bank’s fraud department, whom you can call at a moment’s notice day or night.
Download and fill in the Wire Fraud Contacts form in our Escrow Fraud/Social Engineeringwhite paper and provide it to staff members charged with addressing suspected fraud.
Action steps
Notify management the moment suspicion arises that a wire may have been misdirected.
If funds have been transferred to the receiving bank and cannot be recalled, ask your bank (the sending bank) to formally request that the receiving bank freeze the funds.
Agents may also attempt to directly contact the receiving bank to ask that the funds be frozen.
Contact local police in your jurisdiction and the jurisdiction of the receiving bank.
Report the fraud immediately to your local FBI office.
File a complaint with the FBI’s Internet Crime Complaint Center (IC3).
Contact the underwriter involved in the transaction. Alliant National is available to help you evaluate the situation.
Contact your corporate attorney to let him or her know about the events taking place.
Depending on the nature of the fraud, contact the appropriate insurance provider (Cyber-Liability, Escrow Security Bond or Errors & Omissions).
Putting all of these resources in motion immediately can be extremely useful, as anyone of these professionals or organizations may have information that could assist you in recovering your funds.
IC3 may be one of your most important contacts. In 2018, IC3 established its Recovery Asset Team (RAT) to streamline communications with financial institutions and FBI field offices to assist freezing of funds for victims.
In 2021, RAT initiated the Financial Fraud Kill Chain (FFKC) on 1,726 Business Email Compromise (BEC) complaints involving domestic to domestic transactions with potential losses of $443,448,237. A monetary hold was placed on approximately $329 million, which represents a 74% success rate.
The efficiency of this organization’s work is largely dependent on the speed with which they are advised, so it’s critical that they be an important part of your Wire Fraud Response Plan.
Even the most vigilant companies may fall prey to fraud, but putting protocols in place can greatly reduce your exposure and give you a pathway to recovering lost funds.
As always, call your Alliant National underwriting team if you have any questions or concerns. We are here to help!
The Federal Trade Commission (FTC) updated a key data security rule, and the changes will place new compliance requirements on nonbank financial institutions including title, escrow and settlement agents. Among other things, the Safeguards Rule amendments finalized in October 2021 require covered institutions to beef up their information security programs (ISPs). The changes are a response to widespread data breaches and attacks that have caused significant consumer harm in recent years, the FTC said.
Before discussing the changes, it may be helpful to review the state and federal compliance framework of which the Safeguards Rule is an important element.
GLBA, state law and the Safeguards Rule
The 1999 Gramm-Leach-Bliley Act (GLBA), codified as amended at 15 U.S.C. Chapter 94: Privacy, establishes basic privacy standards for “financial institutions,” including title insurers, title agents, and settlement/escrow agents. Unique in their role as third-party vendors to lenders, real estate settlement service providers also have a separate obligation to comply with the GLBA on behalf of the obligations owed by their lenders.
As long as states afford consumers the same or greater protection as GLBA, they can enact their own privacy laws, and they have all done so to different degrees and standards. Asserting their own authority, many states have privacy laws that substantially mirror GLBA, while others have their own, distinctive laws; and still others simply point to GLBA and mandate compliance with it.
Typically, state privacy laws and the federal GLBA overlap in the following general categories of privacy protections:
Disclosure Protections consisting of a privacy notice, “Opt Out” or “Disclosure Authorization” notice, and limits on what types of disclosures of Nonpublic Personal Information (NPI) may be made by a nonaffiliated third party who receives the information from a “financial institution”;
Security Protections consisting of a written security program, including administrative, technical, and physical safeguards;
Security Breach Notification Requirements consisting of laws requiring a business to send out notice of any improper disclosure of NPI in its possession or control.
The FTC’s Safeguards Rule (16 CFR Part 314) is one of the federal regulations that implements the GLBA by requiring a written security program. The rule provides “elements” in 16 CFR 314.4 to develop, implement, and maintain the ISP, including risk assessment, management and control, oversight of service providers, evaluation and adjustment.
On Oct. 27, 2021, the FTC issued a news release announcing that the agency was updating the Safeguards Rule to provide better protection against breaches and cyberattacks; it includes a link to the publication of the final rule’s amendments in the Federal Register. The agency later posted a webpage to help businesses understand their compliance obligations under the rule.
There have been numerous newsletters and blog articles buzzing about the final rule’s new requirements. Davis Wright Tremain LLP has a particularly good blog that summarizes the key requirements of the final rule.
There is a lot to talk about, and while the amended final rule is much more prescriptive in its approach, it is also drafted to provide flexibility and clarity. In particular there are helpful suggestions and information about alternative security options for small businesses that may qualify for limited exemptions. It also makes it clear that the ISP is intended to protect information in both its digital and physical forms.
The final rule contains tons of commentary, including discussion regarding stakeholder input and the commission’s rationale behind its final decisions. Some noteworthy highlights, as abbreviated, are:
designating a single, qualified individual as responsible for overseeing, implementing, and enforcing the ISP;
base the ISP on a written risk assessment which includes specific criteria described in the amendment;
designing and implementing safeguards, including:
access controls;
system inventory (i.e. knowing where the data is kept, and how everything is connected);
encryption;
secure development practices for in-house developed applications, and security assessments for externally developed applications (reference applications involving customer information);
multi-factor authentication;
disposing of customer information which hasn’t been used for two years (unless required for a legitimate business purpose);
periodically reviewing record retention policies to minimize unnecessary retention of information;
change management procedures;
monitoring and logging user activity;
biannual vulnerability testing on information systems, and additional assessments when there is an elevated risk of new vulnerabilities (e.g. when there are material changes to operations or business arrangements, and those changes will have a material impact on the ISP);
implementing policies and procedures – which include training, updating, and verification requirements – and ensuring qualified personnel are available to enact the ISP;
overseeing service providers, requiring them by contract to implement and maintain appropriate safeguards;
evaluate and adjust the ISP due to circumstances which may have a material impact upon it;
establish a written incident response plan which addresses specific areas described in the amendment;
required regular reporting, in writing, by the qualified individual – at least annually – to the board of directors, or to a senior officer (when there is no board of directors) responsible for the ISP, concerning 1) the overall status of the ISP and its compliance with the final rule; and 2) material matters related to the ISP; and
exemptions for financial institutions which handle the information of fewer than 5,000 customers, from the requirements of (referring to sections of 16 CFR Part 314, as amended by the final rule):
314.4(b)(1) – a written risk assessment
314.4(d)(2) – continuous monitoring or annual penetration testing and biannual vulnerability assessment
314.4(h) – a written incident response plan
314.4(i) – an annual report by the Qualified Individual
Effective dates
The FTC is phasing implementation of the final rule, with certain parts having already taken effect Jan. 10, 2022. Other rule provisions that had been scheduled to take effect Dec. 9, 2022, were delayed six months to June 9, 2023 as announced in the Federal Register’s Supplementary Information. Provisions taking effect June 9 included (referring to sections of 16 CFR Part 314, as amended by the final rule):
314.4(a) – appointment of a qualified individual
314.4(b)(1) – conducting a written risk assessment
314.4(c)(1)-(8) new elements of the ISP
314.4(d)(2) – continuous monitoring or annual penetration testing and biannual vulnerability assessment
314.4(e) – training for personnel
314.4(f)(3) – periodic assessment of service providers
314.4(h) – a written incident response plan
314.4(i) – annual written reports from the qualified individual
This article is for informational purposes and does not contain or convey legal advice. Any opinions, or perceived opinions, are strictly those of the authors and should not be construed as legal advice or a legal opinion. Consultation with an attorney for specific advice based upon the reader’s situation is recommended.
Over the weekend, cloud-hosting and data security provider Cloudstar fell victim to a sophisticated ransomware attack. Alliant National was not impacted, however the attack has affected many agents across the country.
As a valued partner of Alliant National please know that we will make every effort to assist you and your agency if you have been impacted by this ransomware attack. During this challenging time, we are being as pro-active as possible by contacting customers and offering assistance.
Major title software vendors including Qualia, RamQuest, and SoftPro are offering hosting services to those affected by the Cloudstar attack, and there are other third-party vendors that may be able to help as well.
We have provided Alliant National forms packages to the major escrow software providers so they can be loaded quickly and easily into your environment if needed. The National Operations Center of Alliant National is on standby should you need assistance issuing individual Closing Protection Letters outside of your operating environment. We have our agency teams standing by to help you find a closing solution should you need a closing done to mitigate your reputational risk. In short, if you have a need, please reach out today to your Alliant National contact.
Please know that Alliant National will do anything possible to assist you and your agency if you are affected by this attack.
Additional information about this industry wide outage can be found here.
The adoption and implementation of remote online notarization (RON) received a tremendous boost during the COVID-19 pandemic. Buyers, sellers and title agents are looking to close transactions in the safest way possible. According to the American Land Title Association (ALTA), “Forty-eight states and the District of Columbia have either passed a RON law or issued an executive order pertaining to remotely notarizing documents. Some have done both.”
In December of 2020, ALTA reported that RON use had increased 547 percent during the year compared to 2019. If you are a “Star Trek” fan, the lightning-fast adoption of RON – as well as alternative remote closing methods such as Remote Ink-Signed Notarization (RIN) – has felt like the title industry has gone from cruising to warp speed in a nanosecond. It can even feel tempting to utter one of the show’s classic lines like “Beam me up, Scotty!” when thinking about such transformative change.
But let us back up a bit. As the automobile was invented and became a commonplace form of transportation, society built an accompanying infrastructure – including roads, highways, bridges and tunnels. The same is needed for RON. However, it takes time to develop secure and accessible technology that everyone can use. It requires effort to garner the acceptance of the county recorders who must be ready, willing and able to record native electronic instruments. Creating uniform laws to ensure interstate legal recognition and consumer confidence is also no easy matter.
Properly building out RON infrastructure necessitates the continuous collaboration of numerous parties, including individuals, industries and organizations. For example, MISMO, the Mortgage Industry Standards Maintenance Organization, has been working on standards concerning credential analysis, borrower identification, audio-visual requirements (including the recording of the electronic notarization process) and audit trails. PRIA, the Property Record Industry Association, has been developing national standards and best practices for the land records industry. ALTA and the Mortgage Bankers Association (MBA) have also joined forces to establish model RON legislation. Finally, there are numerous other stakeholders not identified here who have, and are, tirelessly working to enable the requisite RON infrastructure.
Currently, the federal Senate bill (SB) 3533, the Securing and Enabling Commerce Using Remote and Electronic Notarization Act of 2020 (otherwise known as the SECURE Notarization Act), is pending. If passed in 2021, the SECURE Notarization Act will permit RON across the nation and provide for minimum standards and interstate recognition. To track the progress of the SECURE Notarization Act, click on the link provided for SB 3533.
During this time of rapid transition, it is important to keep abreast of the latest RON developments, to “boldly go” forth and not end up like another classic science fiction show: “Lost in Space.”
Patrick Hagler Receives the October Research 2020 Philanthropy Award at NS3.
Denver, Colo. – (Sept. 2, 2020) Patrick Hagler, State Council-Georgia, Alliant National Title Insurance Co., has received the 2020 Philanthropy Award from October Research, LLC. The award was presented today at the 2020 National Settlement Services Summit (NS3).
The Philanthropy Award honors professionals in the title, underwriting, lending and settlement services industries for exemplary accomplishment in the area of philanthropy.
“It’s an honor to recognize Patrick Hagler for his philanthropic work outside of the office,” October Research CEO and Publisher Erica Meyer said. “We were impressed at his dedication in helping the homeless, specifically the youth, in his community.”
Currently, Hagler runs a non-profit called Loving Hands of Hope, which focuses on providing homeless teens and young adults with essential items such as clothing and hygiene kits. He is a long-time supporter of Lost and Found Youth Atlanta, an organization that facilitates counseling and other services for homeless young adults. He also volunteers with their 24-hour hotline that helps children find places to sleep and access to hot meals.
Other non-profit work includes volunteering at the Dr. Anise Mabry Foundation’s diploma program, Chris 180, the Leukemia and Lymphoma Society and Backpack in the Park. Lastly, Hagler is a Toy Party volunteer for the Kid in All of Us organization.
Receiving this award is incredibly meaningful to me,” says Hagler, commenting on the accolade. “I was deeply affected when I started doing this work five years ago. You see people who are just looking for a little bit of compassion. Devoting some of my time to spreading warmth, love and hope is the least I can do, and I am humbled to have that work acknowledged by October Research and others in my field.”
NS3brings together more than 700 professionals from across the country for an educational experience unlike any other. For three days a roster of expert speakers and noted industry veterans share their experience with their partners across the real estate transaction.
NS3 2020 offers multiple educational tracks focused on innovation, compliance and cybersecurity. Attendees return year after year to earn CE/CLE credits, learn about the latest strategies to advance their businesses and to stay current on regulatory developments.
Alliant National distinguishes itself from competitors by combining strong underwriting capability with independent agents’ in-depth knowledge of local markets. The result is a nationwide network with deep roots in local communities, and a wealth of expertise that is flexible, nuanced, and continuously growing.
Cathie Beck Capital City Public Relation e : cathie@capitalcitypr.com p : 303-241-0805
ABOUT ALLIANT NATIONAL TITLE INSURANCE COMPANY
The Independent Underwriter for The Independent Agent® – Alliant National believes in empowering people to thrive.
The company protects the dreams of property owners with secure title insurance and partners with 500+ trusted independent title agents as a licensed underwriter in 25 states and the District of Columbia, with annual revenues exceeding $126 million.
