Hacked! How finding my dream home almost led me to a financial nightmare

This is a story of how one email almost cleared out my life savings.

Finding my dream home

My husband and I had relocated to a new city and had been renting for two and a half years. We were finally ready to buy our own place and stop throwing money away on rent, and we had a deadline - the end of our lease. But, unfortunately, right at the time we started to look last year, the housing market started going absolutely bonkers.

Very few houses on that market were what we were looking for, and everything was moving so quickly that houses were selling before they even hit the market. It was an exciting time, but also really frantic. We really felt the pressure. We knew we had a deadline so once we found something, we just needed to move. It felt like there was no room for error or even time to process.

Thankfully we eventually found a house we really loved, and we started the process. Almost all communications happened over email. We were communicating about contracts, titles and insurance. Everything was moving along quickly and on schedule to hit our needed deadline. And then I got on one email chain that really frustrated me, and it could have destroyed everything.

Cracks in the foundation

If you've ever bought a home, you know there's a multitude of email threads, documents and phone calls involved. In the middle of all of this, I got an email from the escrow officer with instructions on how and where to wire money prior to closing. I replied back saying I would rather bring a physical check. We went back and forth for a week until I finally texted my realtor frustrated. I was uncomfortable there were no options other than wiring money. I basically said to the realtor, if I am required to wire money like this, I don't know if we can move forward.

My realtor told me that he did not know what I was talking about. I told him that he was on all of the emails. He searched his inbox and could not find any of them. He picked up the phone to call me instead of continuing via text message. I read out loud all of the emails, and he decided to call the title company directly. Ten minutes later he called me back and told me no one at the title company had emailed me or been in contact with me via email. Everything had been a phone call.

The whole time I was thinking about how if I hadn't been so stubborn and so sure I didn't want to wire money, I could have given away my life savings including the loan I took out from my retirement funds.

Sarah*

So at this point, I opened up the emails and started digging further. I expanded the information in the cc line to see the full details, while the contact names matched with my realtor and everyone else involved, the emails were all slightly off. Each email was a couple characters off from the actual emails of the people I was working with. But the person impersonating the title company knew my name, my personal information, and even the address of my new house from the initial email.

I went back through the whole thread to see what additionally I had revealed. Thankfully other than getting confirmation on personal details they already knew, the only new piece was what bank I used. The bank had not shared any personal information like account numbers. But I was really scared.

A new lease on internet security

Right away we stopped replying to the email thread. I called every person involved with the buying of the house and let them know about the theft attempt and asked for all communication to happen over the phone or in-person going forward. The whole time I was thinking about how if I hadn't been so stubborn and so sure I didn't want to wire money, I could have given away my life savings including the loan I took out from my retirement funds.

I've had my identity stolen before. When I was younger I used to keep my social security card in my wallet. Years ago, I left my wallet on a plane and all of the credit cards were in the recovered wallet but my ID and social security card were gone. I have had tons of issues for years because of that, my credit stays locked at all times. But this felt so much worse.

We are so accustomed to email communication and trusting the digital ecosystem that we are in. I was very cognizant of phishing from work training and knew the security we had in place (I was using my work email for all of the communications about my new house). However, I did not worry about the security protocols of the companies helping with the move, or that my personal information and the names of everyone involved could still get leaked even if I followed the right steps.

Truthfully, it could have been so much worse. Since I didn't wire money or give any of my account information, we still had all of our funds and were able to move forward. This story has a happy ending where we moved into our dream home just a little bit more aware of how to stay safe online going forward.

Here are some tips to keep yourself protected online:

• Always inspect the email addresses, even if the contact names look accurate, on emails where you are sharing any personal information.
• Pick up the phone and make phone calls to verify everything in the email is right.
• Sign up for Firefox Monitor so you know if your email has been part of a breach and you have extra reason to be on high alert.
• Trust your gut. If something feels off, like being forced to wire money, pause so you can dig in deeper before moving forward.
• Use good locks. When you move into a new place, you wouldn't reuse the old locks and keys, you'd get new ones. Protect your accounts like you'd protect your house, with strong, unique passwords and good security like two-factor authentication (2FA).

*Ed note: The subject's name was changed and location removed to protect their privacy.

At Mozilla, we work towards creating a safe and joyful Internet experience every day. That's why this year for Cyber Security Awareness month, we'll be featuring privacy and security experts as they weigh in on personal stories of cybercrime and more. Check back each week in October for a new story and expert advice on how to protect yourself online. In the meantime, kick start your own cyber security journey with products designed to keep you safe online including: Mozilla VPN to Firefox Monitor and Firefox Relay.

The post Hacked! How finding my dream home almost led me to a financial nightmare appeared first on The Mozilla Blog.