It’s a time full of uncertainty, stress, physical exhaustion and changes to your basic need for shelter. That’s on top of your already busy life! Some of the most difficult decisions you make will be during this process – who to use for an agent? How much to list for? What to fix? Will you sell first or make offers first? Oh yeah, where will you sleep tonight?
Simply put, the homebuying process in today’s climate isn’t an easy one.
Layer on that the inherent risk of selling and buying a home, plus the exchange of highly sensitive data the process requires. As a cybersecurity professional and public awareness evangelist, I was more prepared than most to spot risks and mitigate them along this journey. However, I found it more difficult than I even expected. It made me think that the average person would have a tough time recognizing stages of the process where scammers can insert themselves and that we should talk about it so others can learn.
Scammers can insert themselves in processes like mortgage applications, real estate listings, escrow transactions, down payments, and closing cost payments and disbursements of seller funds or mortgage payoffs. Always verify wire instructions carefully and independently!
Money.
In most cases, they are after dollars exchanging hands in real estate transactions. And there are many. Home prices are at record highs and there are several entities involved with the process who all must work together. Everyone involved must be vigilant to ensure the right money goes to the right place. You also need to protect your identity and carefully proceed when providing sensitive information, like a tax return. Keep your credit frozen until the mortgage company is about to run your credit. Freeze your credit again after closing. Your broker can help with timing on this.
Yes, some do sell as a “For Sale By Owner” or unrepresented seller. But you must be careful if you go this route. Real estate agents are constantly required to stay up to date on trends, real estate law, and the market insights of your area. They know what buyers are looking for and can ensure you do not misrepresent your home. It is important to vet your agent with referrals, reviews and accreditation and an association with a real estate brokerage. Independent agents should be scrutinized more heavily than those that are part of an established firm.
Once you have chosen a broker, establish the terms of their commission or compensation for selling your home. Make sure you feel comfortable working with them! This may not be the best time to use a family or friend who does real estate.
In filling out paperwork, be aware of the information you give to the agent. You are allowing them to publicly list information about you and your home. All real estate transactions are public record, so ensure you are aware of what information becomes public when you buy or sell. Also think about the way you are providing the necessary information and giving permission to make transactions and decisions on your behalf. A good agent can explain this well to you.
Opening up your house to the world to come in? Lock up your valuables! That includes things that could provide information about your online life, such as computers, tablets, routers, cameras, and other tech. Best practice is to pack up and move out any personal photos, awards, degrees, portable technology, and anything a tech-savvy “home buyer” could use to commit cyber fraud. Ditto for blank checks, old credit cards and ID’s, passports, and other sensitive papers.. Just having a for-sale sign in front of your house will bring extra eyes to your property, so be aware of this attention and proceed carefully.
Once you accept an offer, potentially after negotiating your offers with the agent, you will set a closing date and finalize where the money will go. Most transactions involve a title or escrow company that holds money from the buyer for the seller and the agents, tax collectors, insurance and other entities like utilities.
It’s the escrow company’s responsibility to direct the money where it needs to go. However, scammers will often impersonate escrow officers or your real estate agent, so be aware of instructions your agent and escrow company has on what to expect and how they need to be communicated with. They should follow up with second methods of verification for providing info such as bank accounts, routing numbers, and other very sensitive information. Much of this information is now exchanged online, but they need to provide a secure method to share wire instructions. They should also provide phone numbers you can call to ask questions and validate instructions. If you are ever unsure, lean on your title or escrow agent for advice.
If you have enough cash to buy your next house, you can skip this step! Lucky you. If not, you will join the 66% of buyers who take out a mortgage. Mortgages, like most large ticket items, should be shopped around for. Once you have a quote and mortgage broker you like, then you can apply. I would not apply to multiple agencies unless you don’t get approved by a lender.
The application process will ask for a LOT of sensitive personal and financial information. Everything from your bank account numbers, statements, employment history, outstanding debt, sources of income, credit scores, income tax returns, and more will be asked for and reviewed. Most of the time they will ask for these documents to be uploaded. That means you must find them, download them, save them somewhere, and then upload to a service from the lender. This is a good time to be extremely careful about where you are connected to the internet. This is not the ideal time to work from a coffee shop without a VPN). Check the site for certifications like ISO27001, SOC2, or PCIDSS. Ask the mortgage broker how they secure the data you are sending them. They should have good answers for these processes and if you don’t get them, you might need to consider another lender. You can also do it the old-fashioned way – print the documents, sign them with a pen, and hand them over in-person.
Once you are approved and shopping for homes, you can relax until closing time…
If you need to fund a downpayment for your mortgage, you will have to make a wire transfer to the escrow account. The mortgage broker will communicate with the escrow officer to send them the loaned money, but you are responsible for sending money to the title or escrow company if needed. Make sure they provide a secure method to provide wire instructions, such as tools like CertifID which is built for real estate transactions. Ask for a phone number to confirm wire instructions. Check with your real estate agent to ensure they are involved in the process. Watch out for fake emails saying to change wire instructions. You should proceed with extreme caution and call to verify that funds are received when expected.
You’ll be left with copies of your wages, tax returns, income, credit reports and various sensitive documentation. When your mortgage closes, delete or store it in a very safe place (offline hard drive in a safe!). Chances are you don’t need it again and you can create it again later if you had to. This is something many of us struggle with.
Also, at this point you should contact the three credit bureaus and refreeze your credit!
I found myself breaking my own rules quite often during this process. I was up late fixing holes in walls, calling contractors to fix odds and ends, physically packing up my house, chasing kids around with no toys because all the toys are packed! Being displaced by a move is hard for a family. I should have done more scrutiny of the websites I uploaded documents to and people I emailed information to as well. Now I have some clean-up to do, but the house is closed, and we are safe.
The biggest takeaway is knowing who you are talking to and asking about security along the way. All of these companies are aware of fraud and scams. They should always have a secure option if you are nervous about the current process.
For the industry, I’d suggest making it as easy as possible for the applicants to do things securely and safely. Double check your process – have someone go through it with an eye on security to identify steps in the process that are creating friction and prompt unsecure behaviors (emailing documents without encryption, for example). Title and escrow, real estate, and mortgage companies should have strong security posture and train their employees on the latest tactics of scammers. Realize the level of sensitive info you are working with and asking for, and work to minimize this. Data retention policies should be short. Once the loan is approved or disbursed, some documents can likely be deleted. Enable multifactor authentication wherever possible. Give the option to download redacted copies of signed documents (that block Social Security numbers, birthdates, etc.) rather than full versions. Follow industry best practices such as outlined by the American Land Title Association (ALTA) for wire verification.
If you are going through the homebuying process, ask to make sure you understand the security practices of your title/escrow agency, and ensure you are aware of who is receiving your sensitive data. Most importantly, freeze your credit when you are done! Scammers can’t steal your identity if it’s locked. Never email account numbers or transmit documents without proper encryption. If your email is ever compromised, the scammer has found basically a blank check.
Good luck with your new home and stay safe!
