Christian Thauer, who currently lives in Nevada, wanted to buy a three-bedroom, one-bathroom home in Millinocket for his family, but digital thieves stole thousands of dollars from him, he said. Credit: Sawyer Loftus / BDN

Last summer, Christian Thauer and his wife, who live in drought-stricken Reno, Nevada, with their two children, decided to buy a second home somewhere more temperate, where the sky wasn’t red from wildfires. After visiting friends in Maine, they settled on a three-bedroom house in Millinocket, where the summer climate is as mild as the price of real estate.

Thauer wired $78,430 to purchase the house on Nov. 26, the day after Thanksgiving. It was supposed to go to an account belonging to Bangor law firm Treworgy & Baldacci for a Monday closing.

But the money never arrived. By Tuesday, Thauer realized that years of savings were gone, stolen by cyber criminals.

“It’s devastating for us,” he said.

Thauer and his wife are now part of a growing number of would-be homebuyers who have been victims of an increasingly sophisticated kind of cybercrime called real estate transfer fraud. The schemes target the very end of the home purchase process, when buyers are eager to close a deal.

Meanwhile, a flood of out-of-state buyers has incentive to close quickly in Maine’s red-hot  housing market. And closing fast often means sending funds via wire transfers, instead of paper checks, which are slower but more secure.

Here’s how the scam works: Hackers break into the emails of parties to real estate transactions and monitor the conversations. Just before the transaction is completed, the scammers jump in and pass wire transfer instructions to the buyer that look real. But the money goes to an account controlled by the hackers, who are usually offshore and beyond the reach of U.S. law enforcement.

The FBI doesn’t have data on real estate wire transfer fraud, but it does track the broader category of crime in which cyber criminals manipulate people into sending wire transfers to accounts they control, like they did with Thauer. And in Maine, the value of those crimes has jumped nearly 400 percent, from $554,976 to $2.8 million between 2019 and 2020. Over the same period, the number of victims grew only slightly from 62 to 67.

Nationally, the numbers have stayed flat over that same period. There were roughly 20,000 victims who lost $1.8 billion to such scams in 2020, slightly fewer than in 2019.

Scammers typically target the email accounts of real estate professionals, but it’s the would-be homebuyers who pay the price, losing significant sums that are only sometimes recovered. It also creates complicated issues of liability for real estate professionals, who can face lawsuits from buyers if they are shown to have inadvertently enabled the scammers. Thauer has hired a lawyer but has not taken any legal action.

Thauer, a financial analyst for the state of Nevada whose wife Zoe Bray is an artist, said his bank, Bank of America, informed him that its fraud unit closed his case on Wednesday after returning just $9,000 of his money to him. The rest was unrecoverable, he said.

Typically, banks have only a day or two to reverse a wire transfer. After that the money is often already in the hands of cyber criminals, who are getting more and more sophisticated, according to Madeline Hill, president of the Maine Association of Realtors.

“They’re getting really good at it, and the frequency is increasing,” she said.

The email that deceived Thauer, which was reviewed by the Bangor Daily News, seemed legitimate enough. The sender was listed as Kelly Brodeur, a processor at Treworgy & Baldacci, who had already emailed closing documents and wire transfer instructions. Thauer thought Brodeur had simply resent the documents and instructions, since they were working through closing issues.

But a closer look showed the email actually came from a new address, identical except for one crucial difference: The name “Baldacci” in the address was spelled with one “c” instead of two.

The scammers seemed to have recreated Brodeur’s email and altered documents to change the account number in the wire transfer instructions to one they controlled. They also appeared to time their fraudulent emails to piggyback on real ones.

The fraudulent instructions came one minute after real estate agent Jay Peavey sent an email telling Thauer that Treworgy & Baldacci had sent the closing documents.

“We thought it was a kind of verification,” Thauer said.

Thauer said he tried to verify the account numbers with Treworgy & Baldacci, but he couldn’t get anybody on the phone the Friday after Thanksgiving.  

That was likely by design. Scammers often target long weekends and holidays specifically because transfers are less likely to be recovered the longer it takes the buyer to notice the hack.

 

By the time Thauer got through to Treworgy & Baldacci on Tuesday, it had no record of the transfer, he said. He read the account number over the phone to Brodeur, who told him that account was not associated with the firm, he said. As panic set in, Thauer finally noticed the one-letter discrepancy in the email addresses.

“I didn’t know what to say,” Thauer said. “It then became clear to me that we had been attacked, and successfully.”

So he contacted the FBI, which wouldn’t confirm or deny an investigation into Thauer’s case.

Peavey, of Realty of Maine, did not respond to questions about the fraud. But Julie Sleeper, the firm’s co-owner and chief operating officer, said in an email that “Realty of Maine and its agents do not publicly disclose personal confidential information pertaining to real estate transactions.”

She also noted that real estate agents typically warn buyers about cyber fraud and that “in general, the role of a real estate agent does not include preparation of the closing documents or communication of the wiring instructions to fund the purchase of property.”

Lawyer Robert Treworgy, owner of Treworgy & Baldacci’s Bangor branch, declined to comment on the specifics of Thauer’s case, citing attorney-client privilege. However, he said that if his firm was responsible for enabling a hack that lost a client money, he would pay to make that client whole.

The firm’s default and preferred position is to make sure all wire transfer instructions are sent across a secure software program called E-Closing, he said. He declined to discuss why the closing documents were instead sent outside the system to Thauer over email.

Thauer said he never had any discussions with anyone involved about how the documents should be transmitted and didn’t understand why the system wasn’t used in his case.

Some real estate professionals consider all transfers dangerous. Len Foy, a Nashua, New Hampshire, lawyer who also practices in Maine, refuses to accept wire transfers from buyers, with few exceptions, due to the prevalence and ingenuity of scammers. He also sends all clients a flier in the mail with “Fraud Alert!!!” in large print across the top that informs them that any emails purporting to be from his office requesting a wire transfer should be treated as fraud.

Real estate professionals often “‘head for the hills’ when the thefts are discovered — each worried about their own liability,” Will Lund, superintendent of the Maine Bureau of Consumer Credit Protection, said.

Lund has been aware of five cases of real estate transfer fraud in Maine over the last two years, which he described as “heartbreaking.” But there have likely been many more during that time because of a lack of central reporting mechanism, he said.  

The best course of action for victims is to hire a lawyer and sue the parties who were part of the hacked email chains, Lund said. That can also lead to a judge ordering all electronic communications be saved in order to determine the source of the hack, he said.

Even though the money appears to be gone, Thauer did not give up on buying the house in Millinocket, and last week he and his wife purchased it using a loan.

“In the end, I decided if I let this thing stop me from doing what I planned to do, it will hang over me for a long time,” he said.

When it came time to close, he sent a paper check.