Posts Tagged ‘phishing’

a businessman point at an email with the word "now" in the foreground in red.

Beware CEO Fraud

You just received an unusual email from your boss. Better answer it, right? Not so fast.

As an internet user, you likely have some awareness of cyberattacks, and chances are, you may have already been impacted by a cyberattack in one form or another. This is particularly likely considering some of the massive data breaches that have affected large companies over the past few years.

One cyberattack you may be less familiar with, however, is called CEO fraud. CEO fraud is a targeted type of email attack where the scammer poses as the boss and tricks an employee into taking a detrimental action. CEO fraud can affect any type of business, from a large corporation to a small agency. Essentially, if you have a job or work for a company that is larger than just yourself, you are vulnerable to this type of malicious behavior. Here’s how you can be prepared to stop CEO fraud and avoid jeopardizing your company.

The Internet Weaponized

Let’s say you work for a small title agency. There are only a few employees in addition to you and the CEO. A cyber attacker will use the internet to research who your boss is and then create an email pretending to be them. What makes these types of emails especially dangerous is that they don’t contain any malicious links or infected attachments that your average email filtering software will catch. Instead, they appear like your average, ordinary email. 

A Fraudulent Sense of Urgency

One of the most defining features of a fraudulent email is urgency. They will urge you to take a specific action right away. These requests are often fiduciary, like handling an invoice, changing payment information, or instructing you to send documents that contain sensitive information.

Two Different Scams

It’s important to take a more granular look into how these scams often work. The first way is wire fraud, a particularly pertinent subject for anyone working in the field of real estate or title insurance. When a cybercriminal is attempting to pull off a scam like this, they will usually spend time identifying those who handle accounts payable and then send them an email pretending to be their boss. The email will direct them to change something about an upcoming money transfer, typically the account where the money will eventually go.

The second way this scam occurs is in the form of tax fraud. In this instance, a similar process will play out, where the criminal will again send someone within your business or organization a fraudulent email pretending to be a superior. The difference this time, however, is that the email will urgently instruct its recipient to send employee tax documents, sensitive information that could be extremely damaging if it fell into the wrong hands.

Stay Vigilant and Stay Safe

Faced with the possibility of such threats, what can an average worker do to practice due diligence and protect themselves or their company from becoming victimized? Most of the time, exercising common sense will be sufficient. But there are also some common signs that can alert you to an email not being on the up-and-up.

Fraudulent emails will almost always be short, with the message consisting of only a few lines of text. They will also mention that the email was sent from a mobile device. They will include instructions that run contrary to your business’s policies, basically conveying that you should ignore standard procedure for the sake of urgency. The actual email address that the message was sent from will also be a dead giveaway. Be on the lookout for any email ending with a common domain name like “@gmail.com” or “@yahoo.com” instead of your company’s email domain name. If you’re in charge at your organization, encourage your employees to give you a call to double check any emailed request from you that may seem out of the ordinary. Practicing these easy steps will go a long way toward helping avoid any potentially dicey situations. Even better, they will alleviate unnecessary stress and let you focus on far more important professional priorities.

Magnifying lens examining computer bug with network circuit stock illustration

What is Malware?

What exactly is malware, and how can you safeguard against it?

You’ve heard the term. You’ve seen the warnings. You may have even been unlucky enough to experience an attack. But what exactly is malware, and what can you do to safeguard against it?

Malware: A Catch-All Term

Malware is an umbrella term for any type of malicious software. This can include anything from computer viruses, worms and Trojan horses (a malicious piece of software disguised as a legitimate program) to ransomware, spyware, adware or scareware.

Typically, anything that secretly works against the interests of a computer user can be classified as malware. Malware can infect almost any type of computer or digital device. Some but not all machines that are vulnerable to malware include: Windows computers, Macs, iPhones, iPads, Android devices and network servers. Viruses and worms are the most common types of malware, and both are spread by becoming embedded in executable software.

Why it Matters  

Malware is used by hackers to gain access and pilfer the personal, financial, business or governmental data of unsuspecting individuals or organizations. Once this information is acquired, cybercriminals frequently seek to exhort money from their victims – either directly through ransoms (where the criminal blocks access to files or programs until the victim pays them money) or by engaging in identity theft.

Recent studies indicate that cybercrime is on the rise. A 2019 report revealed a 67 percent increase in security breaches over the past five years.[i] The cost of these attacks is truly staggering. According to the White House, “malicious cyber activity cost the U.S. economy between $57 billion and $109 billion in 2016.”[ii] The average cost of a data breach is $3.9 million according to IBM.[iii] While it may be tempting to think that only large multinationals are the targets of these attacks, 43 percent of breach victims were small or medium-sized businesses.[iv]

What Can be Done?

As with other industries, identity theft, fraud and other crimes are increasing throughout the insurance and financial services sectors. Still, there are numerous actions you can take to better safeguard your data.

A great first step is to purchase high-quality anti-virus software and install it across your devices. It is essential to purchase one from a well-known and trusted provider, and to have it consistently run scans on any machine that may be vulnerable.

You should diligently update both your operating systems (Mac/IOS, Windows, Android, etc.) and internet browsers (Internet Explorer, Google Chrome, Firefox, Safari and Microsoft Edge). Not only do these updates patch security holes, but they also better protect your data and offer enhanced features that can make your work life easier and more enjoyable.  

When safeguarding your devices through the previous steps, it is always a good idea to back up your data and store it on an external hard drive where it will be retrievable in the future. By taking this precaution, you will ensure that you do not lose access to your most valuable data even if you are unlucky enough to experience a malware attack and have to consult a professional to repair your device.

Avoiding Phishing Scams and Ensuring Safe Title Transactions

One of the most common threats that occur during real estate transactions is a phishing scam, where criminals seek to gain access to nonpublic personal information (NPI), place malicious code on your device or convince you to change wiring instructions. To protect yourself from these scams, agents should be mindful of the following warning signs within a suspicious email:

  • Poor spelling, grammar and generic greetings
  • Requests for personal information
  • An unusual sense of urgency
  • Instructions to change wiring information
  • Questionable-looking attachments or links that encourage a click.

Additionally, agents can reduce risk by transmitting data through encryption, using two-factor email authentications, maintaining a contact log for all transaction participants, eliminating the need for urgency and performing a risk assessment to identify security gaps.

Commit to Safety

Considering the fiduciary responsibilities that title agents possess, data security is of the utmost importance. Of course, no system is foolproof, but by knowing the risks and taking necessary precautions, agents can make significant progress toward protecting the integrity of their clients’ transactions.


[i] https://www.accenture.com/us-en/insights/security/cost-cybercrime-study

[ii] https://www.whitehouse.gov/wp-content/uploads/2018/03/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf

[iii] https://www.cyber-observer.com/cyber-news-29-statistics-for-2020-cyber-observer/

[iv] Ibid

FRAUD WATCH: What is the business email compromise?

Wire fraud attempts are very common in the title industry. A typical wire fraud scheme, encountered by some of our agents, is known as a business email compromise (“BEC”). In this scheme, the fraudster has hacked into a party’s email account.

The fraudster then lies in wait, they read the outgoing and incoming emails waiting for a sales transaction to occur.

Let’s Connect

Discover more stories and conversations on our social media networks,
or drop us a line on our contact page.


The Independent Underwriter for
the Independent AgentSM