Even one of the most astute real estate investors was not spared from phishing scams. To be fair however, the loss was not directly attributed to her. It was her bookkeeper who mistakenly thought that it was for a company invoice to fund another real estate investment. This was sent via email, supposedly from Corcoran’s assistant. Regrettably, it came from an unknown IP address from China.

The attacker had the right ingredients for the deception to succeed:

• The fraudulent email was sent from a trusted source, Corcoran’s assistant
• Such source had the authority to green light a transaction
• Corcoran regularly invests in real estate
• The bookkeeper had access to the requested funds
• No further checks were made to verify the authenticity of the request

It was only after the bookkeeper sent a reply email to Corcoran’s assistant that the trickery was discovered.

By that time, the fake USD388,700 invoice had already been paid.

The fraudster clearly knew what they were doing. They knew the email address of the bookkeeper as well as of the assistant. To gain access to the former, they merely misspelled the email address of the latter by one letter. This was enough to bypass the scrutiny of the bookkeeper who had for all intents and purposes, no reason to doubt the sender.

Phishing scams like these happen all the time. They just take different forms but their purpose is essentially the same: to exploit the probable trust of their victims. Similar successful rackets have been pulled through the use of banking institutions, government agencies and healthcare organisations in the past. These email frauds rake in excess of an estimated USD 2 billion a year. Barbara Corcoran was but one of many instances when an online predator managed to prevail.

This expensive situation could have been avoided had better checks been in place. Always check your emails, especially when it deals with monetary transactions or requests for personal information.

Peerkey can help prove the legitimacy of invoices.