What would you do if you got an email message like this:
Subject: Re: Offer
Attached is the copy of my clients offer, I wait to hear from you.
Regards,
James Jones
James Jones Appraisal, Inc.
Crestwood Advisors, Inc.
Crestwould.com
100 Cargil Rd. #202
San Diego, CA 92123
555.555.8101 (office)
555.545.0009 (cell)
555.555.8102 (fax)
——-
Attached PDF copy:
James Jones sent you Counteroffer.pdf via our secured web server, As part of our security measures.
Click the link below to view the pdf secure file.
Click here to view file.
If you have further question, please contact the sender of this message.
Imagine you know James Jones and have worked with him. Would you click the link automatically? Would you respond differently if you didn’t know the sender?
Either way, you need to be cautious. In a real email, received recently by a broker, a similar link was live, but it didn’t go where you might expect. It was a phishing scam, which is where cyber criminals use emails to attempt to get the recipient to give out private data such as passwords, financial or banking information.
Cyber criminals are crafty. You need to be aware of many kinds of real estate cyber attacks. Seemingly innocent messages may ask you to transfer funds, request to list a property, or seek to work with an out-of-state buyer who is looking for an agent to help find expensive homes.
These messages target brokers with specific real estate language, leading you to believe it’s legitimate. Criminals are embedding links to virus/phishing websites inside PDF files. These links can then bypass filters and rules designed to protect you from cyber attacks.
So what should you do?
Start with a protocol for opening attachments and clicking links.
If you get a PDF file that claims to contain a “Secure Link,” don’t open the file – delete it instead. If you open the attachment by mistake or get suspicious after opening it, do NOT click the link in the attached PDF.
If you get a message and do not know the broker or were not expecting the e-mail, the safest course of action is to delete the e-mail. In addition, you can take three steps to see if an email is legitimate:
- Hold your cursor over the email address or link and look at the popup text showing where it is actually going. Don’t click the link until you’ve verified it is safe.
- Hit reply and request contact info or a phone call.
- If the request appears to come from somebody you know, check in with them by phone or email. For email, don’t hit reply, instead start a new message using your contacts.
The trick about phishing emails is that they often look and sound real. Criminals target brokers and use specific real estate language to make the emails sound legitimate. That’s why strong systems and vigilance are necessary to thwart real estate cyber attacks.
Preventing cyber attacks and phishing scams is a critical step for all real estate professionals, as is coverage for data breaches. CRES typically includes coverage for data breach notification in our real estate E&O insurance policies. We also encourage you to purchase additional coverage for Cyber Liability Damages — losses resulting from data breach that you could end up responsible for.
