Wire transfer scam via hack of contractor's email

[NeilDH]

I was a click away from being taken for about $3,500 when my contractor's email account got hacked by someone who made it appear that the contractor suddenly wanted payment by wire transfer, rather than Zelle or check.

We had work done in our house, got the final bill by email with the payment methods including Zelle. I’ve Zelle’d with this contractor in the past. Then suddenly yesterday I get another email from the company’s same email account asking to do a wire transfer instead. A message with account numbers follows. I see a typo in their company name within the bank info and ask about it by email.

Then they (we now know the scammers) clarify the name but send me -new- bank information. Weird, but OK. I confirm by email again. I was about to put it through on my Chase account, but Chase had its pop-up advising to confirm the recipient by phone, especially wire transfer info. Thinking the bank switch was odd anyway, I did halt last night and called the contractor this morning. The contractor indeed had not sent out wire transfer instructions and reiterated the Zelle or check payment methods.

So we both learned that indeed the contractor’s email account was hacked. I thought I was being a dork for double-checking. The contractor is consulting with his email vendor’s security personnel. Chase's annoying pop-up was right!

 

[Al18]

Good call. I've read that wire transfers are not reversible.

 

[CaliKid]

Thanks for sharing. Good post!

ALWAYS double check by phone and always make sure you're calling a phone number you obtain from a reliable place (i.e. not from the email or text)! This is a huge problem in today's world!

 

[Koolau]

Yeah, trust nothing that comes by email - especially when it "asks" for money to be sent.

 

[NeilDH]

Good call. I've read that wire transfers are not reversible.

The contractor was suggesting that a wire transfer scam could have been reported with the FTC and a refund obtained (when the government isn't shut down). I didn't research it, but I suspect it would have been an ordeal.

 

[NeilDH]

Thanks for sharing. Good post!

ALWAYS double check by phone and always make sure you're calling a phone number you obtain from a reliable place (i.e. not from the email or text)! This is a huge problem in today's world!

This is a good point about finding the vendor's phone number independently. I was careful to do that.

 

[Al18]

FYI, 183 million Gmail accounts were recently hacked Everything we know about the Gmail password hack as millions of accounts breached

 

[Koolau]

FYI, 183 million Gmail accounts were recently hacked Everything we know about the Gmail password hack as millions of accounts breached

Just another in a long list of hacks that "couldn't happen." After all, those folks have really, really good security.

 

[Jerry1]

When we bought the condo this summer, there was a significant wire transfer involved. The title company had a number of steps to verify that everything went well. They were well aware of these types of scams and how they do it through email and warned us several times how careful we needed to be during the process. We had to get the final account numbers verified by calling the title company directly at their office phone number.

 

[Teacher Terry]

I actually won’t pay any contractors or vendors by Zelle or a wire transfer. I’m very paranoid about getting cheated so I either write a check or put it on a credit card.

 

[freedomatlast]

When I bought my last property, I found a settlement (title) company to do the paperwork that would accept a check rather than a wire transfer. No way I'm accepting risk of payment just to make it easier for someone else. This was one of the contingencies of the deal. This was a cash deal and a significant sum of money was involved.

 

[COcheesehead]

Yeah, trust nothing that comes by email - especially when it "asks" for money to be sent.

My landscaper sends me his bill via email from Quicken and I have a choice of payment methods, I always put it on a credit card so I have recourse. A wire, Zelle, Venmo are tough if not impossible to reverse.

 

[skyking1]

What I did with my DC lighting package too, to get Visa's recourse. My heat pump has been delay delay delay and I still have VISA in my court should I need to.

 

[aja8888]

Paper checks are making a comeback in some instances!

 

[COcheesehead]

Billpay too.

 

[Sunset]

I was a click away from being taken for about $3,500 when my contractor's email account got hacked by someone who made it appear that the contractor suddenly wanted payment by wire transfer, rather than Zelle or check.

.......... called the contractor this morning. The contractor indeed had not sent out wire transfer instructions and reiterated the Zelle or check payment methods.

So we both learned that indeed the contractor’s email account was hacked. I thought I was being a dork for double-checking. The contractor is consulting with his email vendor’s security personnel. Chase's annoying pop-up was right!

Wow... so close to losing the money.
Contractor should obviously change his email password it might have been very simple or used someplace else.

 

[Sunset]

I actually won’t pay any contractors or vendors by Zelle or a wire transfer. I’m very paranoid about getting cheated so I either write a check or put it on a credit card.

I'm also reluctant to use these transfer mechanisms.

I do use Zelle for our mowers, but to limit damage, I use a separate checking account at a separate bank from my main bank, and it is a small amount $140 -> $175 per month.

I use it because writing checks is too hard when we are traveling, I would write the checks in advance and have a relative mail the envelope. Zelle has made it easy.

 

[tulak]

I’m ok using Zelle and Venmo, but I have it connected to a checking account that always has a low balance. It’s tame account I use for auto-pay when I can’t use a credit card.

Good catch by the OP. Luckily my contractor uses checks. I’m guessing that most (all?) contractors don’t use wire transfers. It seems an odd way of getting paid for that type of work?

 

[audreyh1]

I have been warned for years how hackers will jump in at a house closing with “new” fraudulent instructions. You really have to watch it.

Paying the contractor - that’s a new one on me. But I would have been suspicious of any last minute change in payment instructions and immediately called the contractor.

Wire transfers to pay a contractor $3,500? That’s a new one on me. No wire transfers!

 

[Koolau]

Paper checks are making a comeback in some instances!

What's old is new again.

I (almost) feel like I'm losing my Luddite status. Naaahhhhh!

 

[ERD50]

When I paid a contractor by Zelle, I sent them $10 first, to verify (by phone), that they got that. Then I sent the rest.

 

[KarenF]

When we bought the condo this summer, there was a significant wire transfer involved. The title company had a number of steps to verify that everything went well. They were well aware of these types of scams and how they do it through email and warned us several times how careful we needed to be during the process. We had to get the final account numbers verified by calling the title company directly at their office phone number.

We went through the same process when we bought our house.

 

[sengsational]

When I paid a contractor by Zelle, I sent them $10 first, to verify (by phone), that they got that. Then I sent the rest.

You should have sent them somewhere between 5 and 10 dollars and asked them how much you sent

 

[Retired Expat]

My investment folk at UBS won’t accept any email instructions unless I follow up with a phone call and I am working within the banks “secure” system. You simply can’t be too careful these days

 

[Spock]

Recently bought a house there the title company's infrastructure involved a separate system for authenticating wire instructions. Huge and repeated banner warnings of "don't accept any changes from what these instructions state".

Well.. the last minute email from the escrow officer had instructions that didn't match.
When I called to verify they sounded very annoyed and just snapped "use the instructions I gave you"... pretty much violating their own system.

I sent the money using the original instructions and the transaction completed fine.

What I don't understand is the laser precision with which the scammer are able to target real time real estate transactions. It's not a transaction that you can just spam a billion addresses and generate a few hits. There has to be a current real estate transaction (short time window) and the scammers have to impersonate the same realtor/title company you are using for your transaction. There has to be a leak somewhere... I suspect it's with the local gov recorder/assessor/treasurers office. They're the only common link in all of the real estate transactions in a given county. They also sell your info after the deal is closed.