Scammer hijacks real estate agent's email, steals $3K from buyer
Nova Scotia Association of Realtors warns members to check for signs of being hacked
The Nova Scotia Association of Realtors is warning its 1,500 members to check their email settings after an agent was duped by a complex phishing scam that left her feeling "invaded."
The scammer posed as someone interested in a property before hijacking Anna King's email account and tricking a legitimate buyer into sending them $3,000.
"I've been very upset about it all," King said. "It's scary."
The problem started at the beginning of November when King was contacted by a prospective buyer through Realtor.com. She didn't think twice, as she receives random inquiries about her listings nearly every day.
After exchanging a number of emails, he sent her an attachment.
The attachment led her to Dropbox, which didn't raise any suspicions as King said she often sends information that way.
It wasn't until Monday that King realized she'd been duped. That's when she asked a different buyer for a deposit that they thought they had already paid.
"They were like, 'Yeah, you emailed us and asked us to send $3,000 to put it in trust.' And I was like, "No, I didn't. Can I see this email?'"
The scammer had taken over King's email account and changed her settings — secretly filtering messages and replying to clients on her behalf. All the while, her clients thought they were talking to her.
"The [scammer] knew how much the deposit was. They knew who the listing brokerage was that the trust money would go to their brokerage. They knew what time we were going to the inspection."
Scott Grace, the owner of Exit Realty in Lower Sackville, N.S., said he's since learned of several other agents being approached by the same method.
He was amazed by the complexity of the scam.
"Our job is to represent our clients, try to sell their listings. So when a request for information comes in on one of our listings, we have to respond to that."
Grace and King are warning agents to be on alert.
They're also recommending that clients speak directly to their agents before transferring any money online. The experience has shaken King.
"I've reset all my passwords. I've spent probably at least 10 hours changing passwords, running diagnostics, getting all my electronics checked and configured and making sure there's nobody on it."
The RCMP are investigating. In the meantime, King said she'll cover the money that her clients lost.