Commercial real estate | June 2024 CRE prepares for rising fraud and cybercrime threats

Fraud attacks from payments continue to intensify; in 2023 alone, nearly 80% of organizations reported attempted or actual payment fraud, up from 65% in 2022. While a quarter of businesses reported losses of less than $25,000, 19% exceeded $100,000. Nearly one third did not recover any amount of the loss.^{Disclosure 1}

Checks remain the method of choice for fraudsters, who used checks in 65% of payment fraud events or attempts.^{Disclosure 1} Though organizations increasingly use alternative payment methods, check fraud is still prevalent at many commercial real estate businesses. There's been a recent resurgence in check washing fraud. Perpetrators often intercept checks from incoming or outgoing mail, and then wash away the payee’s name—and sometimes the dollar amount— giving them a signed and dated “blank” check.^{Disclosure 2} Thanks to sophisticated desktop publishing software, counterfeit checks are becoming more prevalent too.^{Disclosure 3} Despite the many risks associated with checks, 70% of organizations have no immediate plans to stop using them.^{Disclosure 1}

ACH debits and credits account for a combined 52% of payment fraud. Criminals deceptively obtain business checking account and bank routing numbers to make unauthorized ACH payments (19%) or ACH credits (33%).^{Disclosure 1} ACH credits are involved in 47% of business email compromise (BEC) fraud events, replacing wire transfers as the most common tool for BEC fraud.^{Disclosure 1}

Wire transfers are targeted in 24% of all payment fraud events. This represents 39% of incidents in which criminals use BEC or another form of social engineering to transfer funds to a fake or unauthorized bank account.^{Disclosure 1} With access to an email account, an imposter then poses as a key employee or third-party partner and communicates false payment instructions.

Commercial credit cards account for a fifth of the total payment fraud events and attempts sustained by organizations.^{Disclosure 1} Sometimes employees misuse their corporate credit cards for personal transactions, but business credit cards are also vulnerable to use by criminals outside an organization, who may use lost and stolen cards or account information to make purchases or withdraw cash.

Business email compromise represents the greatest vulnerability for companies, with 63% experiencing some form in 2023.^{Disclosure 1} It usually happens through social engineering attacks in which criminals successfully guess or steal email credentials. This allows them to deceive employees, leading them to make fraudulent payments, provide sensitive information, or open email attachments that deploy malware. Accounts payable departments, the target of 59% of BEC attacks, are especially susceptible.

Imposters can also compromise a business's email by creating an email address or website that appears to be legitimate. Customers are deceived to share passwords, reveal bank information, or make payments to a scammer. Fraudsters who target your customers in this way create reputational risk and damage the relationship of trust your business has worked so hard to build.

Most fraud—everything from forged checks and stolen credit cards to more complex outsourcing schemes—comes from external sources. Our CRE clients tell us that, while BEC continues to be a serious threat and is favored for direct attacks, third party partners—like title companies, law firms, brokers, and financial institutions—also create risk exposure for organizations when information they retain on your business or its customers is compromised. 

The steady stream of high-profile data breaches in the news reflects a steep increase in cyberattacks, and commercial real estate organizations make ideal targets. Not only do they often collect and store sensitive customer data, but they can be involved in high-dollar transactions and may lack the strong, state-of-the-art security systems found in other industries. What’s more, CRE businesses often work with multiple third parties who may have insufficiently robust or outdated cybersecurity protections.

Data breaches, when hackers steal and sell or expose sensitive personal and financial information, leave a business’s customers at risk of identity theft and financial loss.

Ransomware attacks, where criminals encrypt an organization’s data and hold it for ransom, halting business activity and financial processes, are among the most feared threats. They can make normal operations impossible until the hackers get what they want and, hopefully, restore the data.

Third party cyberattacks happen when cybercriminals gain access to your company by compromising a partner organization. Recognize that each third-party partner represents a unique cyber risk to your organization based on their security measures and their level of access to your systems. 

Preventing damage to your real estate business demands a comprehensive strategy supported by actions that address people, processes, and technology. While risk reduction strategies often overlap, distinct security measures tailored to the most common threats can reduce your business’s risk.

People form the foundation of your fraud defense. Implement these steps to lower your overall risk of fraud.

Efforts to thwart check fraud, the #1 source of payment fraud, will likely yield the highest return in risk reduction. Take these steps:

Cybercriminals continue to devise bolder schemes to attack businesses. Take these protective measures to help protect your company against the operational disruptions, reputational risk, and financial consequences that a cyberattack can bring: