Florida brokerage endures a nightmare and lesson in real estate cybersecurity

In August, the agents at Berkshire Hathaway HomeService Florida Properties Group found themselves under siege from fraudsters. 

“It began with the mother of one of our agents getting a call at two o’clock on a Sunday morning from a number that looked identical to her daughter, with her daughter’s photo,” Casey Bryan, the president of BHHS Florida Properties Group, said. “It was the middle of the night, so she frantically answered only to hear a male voice telling her that he had her daughter and if she didn’t send money right now, she [the daughter] wouldn’t live through the night.”

According to Bryan, the agent’s mother said she could hear what she thought was her daughter whimpering and crying out for help in the background. 

Ultimately, the agent’s mother sent the fraudster $1,000 only to discover later Sunday morning that her daughter was perfectly fine and never in danger. This one incident traumatized Bryan and her agents, but it wasn’t the only time it happened. The next night, it happened again with another agent.

Agents were targeted

“It wasn’t until it happened about three or four times that we realized that it was our agents specifically being targeted,” Bryan said. 

Bryan and her team have concluded that fraudsters got ahold of her roster of agents and then systematically went through the alphabetized roster finding family members of each agent to call and try to swindle. 

“We saw it happening to the A’s, then the C’s and eventually we could warn the D’s that they needed to tell their family member what to potentially expect,” she said. “It got progressively worse over time. When they reached the middle of the alphabet the tone of voice and word choice got more aggressive, and they began threatening sexual assaults on the agents.”

In total, Bryan said 36 of her agents were impacted. While most were female, a few male agents were also targeted. 

“I’m going to pat ourselves on the back for a second, because I think we did a really good job of overcommunicated what was happening. As we saw trends and knew what letter would be next, we were able to inform our agents so they could talk to their families and prepare them,” Bryan said. 

Cybersecurity wake up call

Of the 36 agents targeted, just a few families ended up falling for the fraudsters scheme, according to Bryan, who acknowledged that things could have been much worse. Despite the outcome, Bryan said the incident served as a major reminder of the importance of cybersecurity and identity verification especially in the large financial transactions her agents are involved in on a daily basis. 

“We are already super vigilant, and we have an IT department that ensures any type of attack or breach is mitigated before it even happens, but then stuff like this happens and I think the only way to combat it is through knowledge,” she said. “There is no way we are going to stop bad people from doing bad things, but we can be aware that they exist.”

Cybersecurity experts agree, and they are grateful that Bryan is willing to share her experiences, especially in an age where the speed of technological advancement is allowing fraudsters to create more sophisticated and believable schemes. 

“There used to be very obvious signals that someone had found your data and was impersonating you and it was easy to catch, but what we are seeing in this new age of technology not only with machine learning but AI agents is that fraud is becoming more prevalent everywhere, and it is getting scary because they can make it feel so real,” Arpitha Gadag, the director of fraud and risk products at CertifID, said. 

Fraud in the AI age

Part of the reason it’s happening more frequently, Gadag said, is how easy it is to gain access to inexpensive tools to create deep fakes and to impersonate phone numbers and contacts. 

“The bad news is that deep fakes are way more pervasive than people think,” Pat Kinsel, the CEO of Proof, said. “Even Sam Altman, the CEO of OpenAI, has come out and said that generative AI has now been able to break through all forms of identity verification used by financial services.” 

According to Matt O’Neill, the former head of financial cybercrime investigations at U.S. Secret Services and a co-founder and partner at 5OH Consulting, deep fake tools have become table stakes for fraudsters. 

“Over the last six months these applications have become even better and more widely available,” O’Neill said. “We’ve gone from it taking 40 minutes to an hour to render a voice to make it say what you want, to now it is a matter of minutes.”

Prevention and preparation 

Real estate cybersecurity experts agree that when it comes to ensuring real estate transactions don’t become victims of deep fake enhanced fraud attempts, it is important to regularly check the identity of the people you are conversing with.

“What you can do is implement a series of checks throughout different parts of the customer’s lifecycle that allow you to analyze their identity, behavioral data, device analytics, contextual signals and biometric information, like how they present themselves through selfies, to verify their identity,” Gadag said. 

Or, more simply, O’Neill suggests verifying information communicated in one channel through a different communication channel. 

“The real estate industry is generally not as caught up on cybersecurity as other industries as far as implementing the necessary controls. We still see a lot of business email compromise and agents are still using email as a primary means of communication regarding very sensitive information,” O’Neill said. “Make sure that you are not using just email to send communications. Ideally, you are using a secure platform to communicate, but never send money based on an email alone, always call a number you know is correct and verify directions and information.”

Additionally, O’Neill said consumers should consider adopting voice passcodes within their families, so if ever someone’s identity is in doubt you can ask them for the family word. 

“It is so easy to fake voices and now we are seeing fake video calls, so it really makes you think especially as we are seeing these late-night family emergency extortion attempts,” he said.

As Bryan and her agents move forward, she said they are keeping all of these risks in mind, and while they are grateful no one was physically harmed, they are still recovering from a harrowing month.

“The trauma it created in our offices was pretty significant,” Bryan said. “We had agents in tears. And even when we got further into the alphabet and an agent and their family knew it was coming, it was still very upsetting.”