Protecting Transactions from Cyber-Crime

By Glen E. Armes

Vice President, Chief Information Security Officer

Privacy and security are high priorities at Old Republic Title. We work with title agents, lenders, real estate professionals and consumers to adhere to industry cybersecurity standards, regulations and legislation, which protect sensitive data and the real estate settlement transaction itself.

Identity theft, financial fraud and other cyber-crimes are on the rise in the financial services and insurance industries. Settlement services transactions have become a target for fraudsters, and these types of cyber-crimes continue to grow. To reduce the risk of cyberfraud, everyone involved in a real estate transaction needs to know the threats and be armed with knowledge to combat them.

Know the Threats

When fraudsters become interested in a transaction, they're looking to gain unauthorized access to nonpublic personal information (NPI) or use business email compromise (BEC) to perform fraud.

NPI is personally identifiable financial information provided by a consumer to a financial institution resulting from any transaction with the consumer or any service performed for the consumer. In the hands of fraudsters, this information is valuable and can be sold or used to commit cyber-crime.

BEC is a process fraudsters use to access emails containing NPI or conduct cyber-crime. This could lead to wire transfer fraud, where a transaction participant wires funds to an unauthorized person. Organized crime groups typically follow a process such as this:

  1. Identify targets within the transaction
  2. Reach out to the targets with phishing emails, telephone calls and, in some cases, in-person visits to collect useful information such as transaction dates, accounts, participants, amounts, etc.
  3. Exchange information with the targets and participants
  4. Change wire transfer instructions to have funds sent to an account controlled by the organized crime group

Protecting the Settlement Services Transaction

Each participant in a transaction is responsible for ensuring fraudsters don't collect data, interrupt or insert themselves into a transaction. These are some ways parties to a transaction can help prevent interference:

  • Know the transaction process from start to finish
  • Use a contact log created at the beginning of the transaction to reference contact information for the title agent, lender, real estate broker or agent, attorney, seller and buyer
  • Keep a level head and eliminate urgency
  • Ask questions if you don't understand something or if you feel uncomfortable
  • Scrutinize emails that contain or collect NPI or request that funds be transferred
    • Verify the authenticity of any request to wire or send money
    • Do not use phone numbers and links within the email; use the contact log set up at the beginning of the transaction
  • Avoid using public wi-fi even if the wi-fi is protected by passwords
  • If you can't avoid public wi-fi, utilize a virtual private network (VPN) to encrypt data
  • Keep your computers, mobile devices and applications patched and updated with the latest versions or releases to help close security vulnerabilities
  • Verify fund transfers immediately

Whatever your role in the real estate settlement services transaction process, stay vigilant to help reduce the risk of cyber-crime. Use the following tips to help protect transactions:

Title Companies

  • Transmit data using encryption (Web applications, databases, file transfer, email)
  • Use two-factor authentication for remote access to your network resources
  • Maintain a contact log for all participants (phone numbers and email addresses)
  • Implement a multi-step funding process that eliminates urgency for transferring funds
  • Educate all participants to understand the threats to the settlement services transaction process
  • Perform a risk assessment to identify security gaps within your organization and develop a plan to close the gaps

Real Estate Brokers or REALTORS®

  • Avoid using free email services to conduct business
  • Use secure email whenever possible
  • Use two-factor authentication for email
  • Transfer files and data using encryption
  • Don't store data that's not required by regulation or legislation
  • Change passwords on a periodic basis
  • Educate customers on BEC, wire transfer fraud and the settlement services process


  • Learn about the settlement services process and what you should expect
  • Confirm the authenticity of all communications
  • Only transfer NPI in an encrypted format (If you aren't sure if the method is encrypted, question the requestor)
  • Understand wire transfer fraud
  • Scrutinize wire transfer instructions, and don't accept changes in instructions unless you're 100% sure of the authenticity of the change

Old Republic Title is committed to working with all participants of the settlement services transaction to help ensure that information is kept as secure as possible. By knowing the threats, asking questions and practicing good security hygiene, we can work together to protect transactions.

The Old Republic Title Blog is not intended and should not be construed as legal advice. The information in this Blog is intended for general information and educational purposes only. Old Republic Title does not guarantee, and assumes no responsibility for, the accuracy, timeliness, correctness, or completeness of the information herein. Any conclusions readers draw from the information contained herein are their own and are not to be attributed to Old Republic Title. Always seek the advice of competent counsel with any questions you may have regarding title insurance or any other legal issue. The information on this Blog may not be quoted or referred to in any manner without the prior written consent of Old Republic Title, to be given or withheld at our discretion. To request reprint permission for any of our publications, please contact us. This website may contain hypertext links to information created and maintained by other entities. Old Republic Title does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside web sites.