E&O Insurance Frequent Claim Scenarios: Case #6

E&O Claim Scenario: Agent and Broker Sued for Failure to Take Reasonable Measures to Protect Against Criminal Cyber Activity

This risk manager article from our E&O provider was originally published several years ago. With the runaway increase in cybersecurity claims in the real estate industry, this classic scenario is worth revisiting:

The Situation: A real estate agent was contacted by an out-of-state couple who were searching for a waterfront condominium to enjoy as a vacation getaway. With the agent’s help, the clients were able to find a condominium that met their needs. They entered into a purchase and sale agreement, which included a condition that $35,000 would be wired to an account at a local bank. During the escrow period, numerous emails were exchanged between the agent and her clients, including details relating to the date and time of the closing. 

The Problem: Three days before the closing, the buyers received a communication from the agent’s email account instructing them to transfer the $35,000 to a different bank. The email was a scam – the agent’s email account had been hacked, and a third party had actually sent the fraudulent message with directions to make the deposit to an account under their control.

The Mistake: The buyers transferred the money as instructed in the fraudulent message.

The Result: During the closing, it was discovered that the original transfer had not been processed, and the sale could not be completed that day. Sometime thereafter, the agent had to inform her clients that due to an account breach, they would not be able to purchase the property. The buyers responded with a lawsuit against the agent and broker-owner, alleging they failed in their duty to keep personal information confidential and failed to use reasonably practicable measures to protect against criminal activity. 

Prevention: Emphasis should be placed on avoiding the email breach which allows unauthorized email access. Mandating minimum password standards and requiring two-factor authentication across all email accounts makes a real estate brokerage significantly more resistant to these scams.

Numerous other preventative steps could have been taken, but at a minimum, brokers and agents should consider alerting buyers to call their sales agent and/or closing attorney before acting on corrected wire instructions, which may appear to come from a real estate agent, closing attorney, or lender. Consider including a written alert with a contact number when you email wire instructions stating any change should be verified by phone.