Close with Caution: Cyber Threats Lurking in Real Estate Deals #43

And welcome to the Security Guy and CIA Spy Pod broadcast.

I am Robert Siciliano, the Security Guy, and this is By default, I'm the CIA guy, Peter Wormka. How are you doing, Robert?

I'm doing pretty good, Peter.

Good to hear your voice. Uh, how's everything up there in the north?

It's good. I'm putting the boat in the water tonight.

It's getting even too hot down here to put a boat in the water. You gotta go out like at 5 in the morning, 90 degrees and high humidity. Oh my God, I'll take it, I'll take it, I'll take it any day.

That, that is boating weather as far as I'm concerned. That is boating weather.

Oh yeah, when you're not stationary, you're not going to be fishing out there. He's going to be— you're going to be cruising.

So here's the deal, right? Like, when it comes to boats, like, my girls need hot weather to get in the water. And whether it's sitting there or moving, they're fine as long as it's hot weather. Okay, it actually is going to be chilly. It's going to be like in the, in the, in the 60s. Nice. Well, so yeah, we're going to be dressed like head to toe on the boat at night and there's fireworks in Boston Harbor.

Hmm, I don't know, but you grew up in it. You grew up in Massachusetts, right?

Yeah.

I would think that you— the cold weather, you would love cold weather. I grew up in Wisconsin, and I, I mean, the colder the better. I just hate the hot, the heat and the humidity, but cold, I love it.

Yeah, no, you're a different breed, man. People around here do not like the cold. Like, that's just— we, we like the change of seasons. That, that is the thing. We like to change the seasons. But like, we like a snow, okay, then we're done. Uh, and then the ongoing chill in the air, no, we could, we could do without that. Like, it wears on you. And, and my girls, like, that, like, especially my wife and her sister, forget about it. They're like all done with it. They can't even deal. My, my sister, so much so that she moved to Australia. She's like, I'm done. Wow.

Maybe we should just change residences. You, I'll live in your house and you come down to Orlando, live in mine, and then we'll be, we'll be happy.

Yeah, but you got no change of season. You guys don't— you got no change of season.

Well, it's hot and hotter. What do you mean?

Oh yeah, but fireworks in Boston Harbor tonight. I'm really excited about that. We get like right under them, like you can smell the sulfur, like that's how close we get. It's pretty cool. Oh wow. Yeah, yeah, yeah, yeah, yeah. Lots of fun. Yeah, lots of stuff going on, man. Uh, so I just came back from New York. I spoke in front of, um, 100, uh, 100 real estate agents, uh, provided them a 6-hour CSI protection for continuing education, right? And so, you know, these are service professionals. They are, you know, uh, small businesses, independent contractors, and, uh, they have data to protect, right?

A lot of data. A lot of data because they have the data on their clients, right? And they've picked up a lot of information about the clients to be able to find that perfect house for them, right? I mean Tremendous amount of data.

Yeah. And, you know, the, the real estate agents themselves may or may not— usually not— handle Social Security numbers. Usually not. Usually the most sensitive information is going through the mortgage broker, right? The bank. Yeah. They, they may or may not handle, uh, wiring instructions, meaning like they may or may not be privy to all the communications and dialogue when it comes to escrow and moving money for deposits and so forth, right? They may or may not be privy to any of that. Like, when I say may or may not, meaning like state-to-state rules and regs are a little bit different. Um, like in Massachusetts, we have what's called an attorney-based state, which means like the closing attorney handles all of that data. Right? In some states, it's the title company. So it's a little bit different here and there.

You know, I put my— immediately, I've always got my human hacker hat on, right? And the first thing I think about was, I think about, wow, you get into the database of one of these realtors and you have the, you have the names and the contact information for their clients. The clients trust that realtor. A lot. And can you imagine having an email looking like, like it's coming from that realtor, or some other, some other approach to one of the realtor's clients, and then believing that it's the realtor? I mean, perfect in—

yeah, you're a good hacker, Peter. Yeah, you know, I mean that, but that's how you're supposed to think, and that is essentially how I instruct as well. You know, I, I reverse engineer these processes for these agents to get them on the same page to understand how to recognize risk means understand how the scam works, right?

Yeah.

And that's really what goes on. So, so like, for example, uh, in New York, the real estate agents don't handle that type of sensitive information. They don't deal with escrow, they don't deal with wiring instructions. But it doesn't matter because if the real estate agent's email is compromised then what that means basically is compromised is either the agent was phished.

Yeah.

Or the agent's credentials were on the dark web and bad actors grabbed those credentials and just logged into the agent's email remotely. Right. So one way or the other, you know, the, the, the bad guy gets access to the transaction by getting inside the real estate agent's email or the buyer's email. Same thing— buyer got phished, buyer's credentials were on the dark web, or escrow's email got compromised, or the attorney's email got compromised. There's like 5 points of contact that could have essentially been breached at any given point in time. All they need or the bad actor needs is the email address of the, um, buyer, any info at all on the transaction, wiring instructions, anything at all. And the bad actor steps in, creates an email address that looks like the real estate agent's email or communicates from the real estate agent's or title's or attorney's email, right? Any of those scenarios can take place. And once they do so, now they're communicating with the buyer who believes— the buyer believes they're speaking to this service professional who's there to essentially facilitate the transaction of them buying this house. The buyer has no idea that they're actually communicating with the scammer. And, uh, when wiring instructions are sent across to the buyer, they're like, okay, yeah, we'll do that. And they complete the transaction sending money to a bank controlled by a criminal.

Yeah, so fast, so easy. And the, and the realtor wouldn't even know that it's happening until later on. Maybe the buyer said, hey, what's happened here? Right?

Sometimes the, the The realtor or the escrow or whoever, they don't find out about this until the buyer mentions something in passing days or weeks later.

Meanwhile, there's been other clients of the realtor, let's say, or the escrow, that, that have been hit with the same thing, probably. Yeah.

And, and when I get in front of these real estate agents, which is, you know, 40, 50 times a year, either virtually or in person, the way I start my presentations with every one of them, it doesn't really matter what group it is, this is what I do. Like, I'm like, okay, so how many of you of you can honestly say that you use a different passcode for each and every critical account you log into? How many of you?

Zero.

Well, if— actually, people are getting better at it. If I get 15% of the room to raise their hand saying, yes, I use a different passcode for every critical account, if I get that, that's a lot. If so, 10, 5, 10, 15% is usually it, not much more than that.

And those people probably, I mean, if they're being honest, probably they're using a password manager, right? Because then that, it's a lot easier to be able to have a different, different one if different for each login, right? But if you're trying to do it manually, uh, and you're not writing anything down, I mean, that's, it is next to impossible to be, you know, today we have what, 30, 40, 50 different accounts that we log into.

Easy.

Yeah.

And the other question that I ask them is, okay, so if you are— so, okay, so, so, so whether or not you're using, you know, a different or the same passcode across each critical account, how many are using two-factor authentication for all your critical accounts, including email?

Very few.

If I get 20%, that's a lot. And so, yeah, so which, which boils down to between 80 and as much as 90% of the audience— and this is quite frequently— is not using a different passcode across each account, is not using two-factor authentication, which makes 80 to 90% of the audience vulnerable. And when you are a service professional engaged in a real estate transaction and your client is forking over a million dollars for a home and they're told to wire a significant amount, 6, even 7 figures, they're just gonna do it. They're not even gonna question it. And when you have 80 to 90% of the audience who— and again, the New York agents may not even handle wiring instructions. But that doesn't even matter because the buyer doesn't know the difference. The buyer is going to do what they're told, even if they're told by the real estate agent who doesn't actually handle wiring instructions. The buyer's going to do what they told— what they're told, and they do. That's a huge problem.

I got a question for you, if you know the answer to this. Uh, let's see, let's say that, that this happens to the realtor, right? Uh, that the bad actor was able to get into the, to the, uh, realtor's database and then approach clients and then bilk the clients out of millions of dollars. Is there any liability, legal liability, that the realtor could face?

Oh man, they're all getting sued. Everybody's getting sued. Everybody in the transaction is getting sued. Everybody. Because, uh, Look, even, even if the, um, real estate agent's email was tight, even if, uh, they have some form of liability insurance, okay, even if. And so when the buyer is, is, is breached or compromised and wired that money, they're going to be looking at— they're going to be looking for compensation. The first thing they can do is contact their attorney, right? And their attorney is going to start the process of due diligence by, um, you know, uh, filing suit, but at the same time, um, making an effort to determine who, who essentially is liable here, you know. And, and, and the, the, the buyer's attorney may jump in, sue without actually knowing the full story. Full story being, okay, so if you were to bring in a forensics expert to make the determination as to where the vulnerability was, was it the buyer? Was it the real estate agent? Was it escrow? Was it title? Was it the attorney? And so forth. Um, somebody at some point who is being targeted in a lawsuit is going to want to get to the bottom of this. Yeah. So, and we've seen in a number of different directions the buyer ultimately being responsible. The real estate agent ultimately being responsible, title or escrow ultimately being responsible. Uh, when forensics gets involved, they're going to be able to determine liability, usually, usually. So it's a sticky situation. But when you have an industry like real estate that— and one of the questions I ask them all the time is, how many of you, you know, show of hands, the 100 agents in the room, how many of you have been engaged in, um, what's called phishing simulation training? Raise your hand. In an audience of 100, if I get 5 to 10 people to raise their hand, that's a lot. And then I say to them, okay, so besides real estate, or in addition to real estate, what other profession might you currently or previously been involved in where you got that phishing simulation training. And when I ask that question, it's always, um, government, healthcare, finance, and so forth. It's never real estate.

Well, maybe they think that— maybe that's the reason. One of the reasons is that typically they're small companies in regards to personnel. You know, if they only have, let's say, 5 or 6 agents working with them, they're gonna think, well, why are we gonna invest in simulating, you know, simulation training for just such a few people, you know what I mean?

Yeah, but the franchises aren't doing it. Your Keller Williams of the world and your RE/MAXs and your Century 21s and your Coldwell Bankers, like, they're not even, as far as I know, uh, at least for the independent contractors and their brokers, making any effort to do it. If anything, they might be doing it in-house on a corporate level at their headquarters, you know, but I don't know that they're doing it or suggesting it even for their franchises. And And that is an industry that is a, that is a target. And we're seeing these wire fraud transactions occur. Like, every presentation that I do, I ask the question, how many of you have been intimately involved in some type of a wire fraud transaction where either you or your client or somebody in your office or in your franchise locally was a victim or was touched by this? And I usually get at least 3 to 5% of the audience raises their hand. So it's a problem. And that's enough, you know.

Yeah, you know, another target I think that's even more severe, I think, um, automobile dealers. Because think about the data that these dealers have when they're especially collecting all this information to be able to finance the vehicle. They got every— it's almost like, you know, buying that, you know, getting a loan from a bank. You're getting— giving them a lot, tremendous amount of data that they, you know, are that they're collecting and holding on an individual. And, uh, they can also be easily, easily targeted for similar scams.

Automotive dealers and marine dealers as well.

Yeah, yeah.

So that brings me to password management. Like, it's such a 101 thing, but like, still— and I don't know if we're ever going to figure this whole thing out. I know like passkeys are probably going to be what solves this problem. But we're not there yet. Uh, so password management is still a major issue. And of course you mentioned password managers, but check this out, like May 28th, 2025, data breach exposes passwords from Google and other tech giants. Uh, the paper says a cybersecurity researcher has discovered online database containing 184 million account credentials for Google, Microsoft, Facebook, Instagram, and other major platforms. His report reveals that usernames, passwords, emails, and URLs of many social media apps and websites were stored in a file alongside users' credentials for bank and financial accounts, health platforms, and government portals. Like, are you kidding me? Users need to protect their credentials, but how can the user protect their credentials when it's others that might be responsible for that breach? The file found was unencrypted, and it was determined that The sensitive data was captured by a kind of info-stealer website.

Hmm.

This kind of website is popular among cybercriminals as it is designed to grab sensitive data from breached sites and servers, making it easier to plan an attack or give away the information on the dark web, which we've seen. The file was since removed from public access by the hosting provider, which is not sure if the database was created legitimately and exposed accidentally or intentionally used for malicious purposes. Let's just assume malicious purposes, right? Because that's the worst-case scenario, which is the crux of the issue, uh, and the fact that it was exposed at all. And then from there, while people behind the breach are to blame, users are also part of the responsibility. The report's author suggests that users should not keep documents containing sensitive information on their email accounts and treat them like free cloud storage, as it could create privacy risks if criminals were to gain access. Sure. Okay. So, you know, if you go to my website, P-R-O—

hold on—

if you go to P-R-O, uh, right there, and, uh, scroll down on the home page. So here we are at protectnowllc.com, and you scroll down here where it says Cyber Security Awareness Check. Has your personal or organizational security been breached? Check if your email has been breached. Check if your password has been breached. Right. We click on email checker right here, Peter. I'm sure you're familiar with this tool. So right here it says check if your email has been breached. So we type in Robert Siciliano, a common email address that I use, and I don't care, like Try to hack me. Good luck, right? And we click on search. It's been breached dozens and dozens and dozens of times. You know, uh, Yahoo breach, Forbes breach, Bitcoin breach, LinkedIn breach, Tumblr breach, MySpace breach, Dropbox breach, Last.fm breach. Like, all of these breaches where my email address has been compromised along with user— along with the passcode for all these various sites, you know.

Yeah, I mean, I'm getting probably 3 times a year, maybe even more now, myself and/or my wife, notifications of, you know, that our data has been breached, right? It's the same old form, the same template, same form letter they send out, and they're going to offer you— they're going to provide you for 1 year free credit monitoring, whatever, identity, you know. But it's like, these breaches are just, you know, we're getting so accustomed to them, so used to them. All our data is out there now, Robert. It's just like, how do we protect— how do we protect our data when no one else is protecting our data? And all of it's out here. All of it's out there.

Yeah. Yeah. And to cap it all off, Peter, right here, you know, Security Boulevard, May 29th, 2025, 19 billion passwords leaked. Protect yourself from cyber threats. Right. So in one of the most significant cybersecurity breaches, researchers have uncovered a massive repository containing over 19 billion compromised records, the largest publicly indexed trove of stolen credentials ever recorded. This collection, dubbed RockYou 2024— and I've seen this same RockYou 2024 listed as 10 billion passwords, so this is like an update to that, I guess— aggregates data from more than 200 recent breaches over the past year making it a potent weapon for cybercriminals. What was leaked? Usernames and email IDs linked to passwords. And this is the worst part about it, Peter. This is like the worst part about it. Only 6% of the entries are unique, indicating a catastrophic level of password reuse.

Yeah, that's, that's really a major, major issue. Why even have a password? I mean, why even have a password?

Yeah, so this same tool, Peter, right? Check if your password hasn't been breached, right? Click on check and watch this. This is so ridiculous. I'm going to type in— so this tool that we have access to right here indexes about somewhere between 15 and 20 billion records. Okay, so we're able to scan and search about 20 billion usernames and passcodes, basically, right? So let's search out 1, 2, 3, 4, 5, 6. So let's just say out of 20 billion credentials, 1 through 6 is used— hold on— 130,075,037 times.

Really? I knew it was bad, but not that bad.

That's— oh my gosh. Let's add number 7 to that, Peter. 1 through 7 is being used, uh, 9,044,027 times.

1 million too many. Yeah.

1 through 8 is being used 40— what is that? 40,074,000— uh, 740 million 74,000 or something to that effect. Is that— what is— how many is that? Yeah, no, 4— is that 40 million or 4 million? Yeah, my brain's broke. So, and look at this one. So when, when, when doing my own, uh, research and finding these data dumps, right? Because I, I do my own like dark web searches and I find stolen records. I found a trove of records. I found I found 21 million stolen credentials on a particular data dump on the dark web. So I downloaded it and I have those records, Peter, right? So I go through these passwords myself and I see them, right? And one of the passwords I saw was— check it out— I-L-I-K-E-S-E-X. Yeah, so I found that one and I searched it. It's being used 13,836 times. People like sex is their passcode.

Well, maybe it's one person that has a tremendous amount of accounts.

Yeah, I know. Like, look at this, this is just so ridiculous, Peter. Like, like, it's, it's when it shows that 6— only 6% of the credentials were unique. Which means 94% were like people using the same credentials across multiple accounts. It tells you that like we're just so simple as humans when it comes to technology and cybersecurity.

Well, you know, and I, I usually like a lot of things I talk about awareness, you know, we need more awareness. But in this particular case, P, there shouldn't be anyone out there that hasn't heard this message thousands of times about password hygiene, right? And they still don't— doesn't seem to matter, doesn't seem to resonate, doesn't seem to— they don't care.

It's like they don't care. Yeah, you know, so I do a quick search on password manager and you'll see like Google has their password manager, NordPass is a paid-for password manager, LastPass is another one that's had some data breaches, but I'm sure they've learned from their mistakes. There was, there was no raw unencrypted data stolen in the LastPass breach as far as I'm concerned. And then PC Magazine has this article that shows up on the first page of search, the best password managers for 2025.

Yes.

So right here, like, you just, you see, you know, the best password managers of 2025. Stop using the same login credentials everywhere. The best password managers create a unique and strong password for each of your online accounts and alert you to potential data leaks.

Yeah, and a lot of these have free versions, or even if you pay a premium, it's very, you know, not very much at all.

So, so, so, so right here you see NordPass, RoboForm, ProtonPass. Like, the password manager for free to a small fee, $3 a month, you know, $20 a year, whatever the case is I think is the best use of your time and money when it comes to your information security.

Absolutely. I agree with you 100%.

And one of the first questions that people ask me is when I point this out to them, they're like, well, what if the password manager gets hacked? And I'm like, okay, yeah, but like, you know, these are security companies. And yes, they've had some vulnerabilities in the past, but none have been hacked in such a way where the data was compromised in plain text. And I say, like, but the low-hanging fruit is you using the same passcode across multiple accounts and 19 billion of those records being exposed in a singular, like, record. So hacking the password manager is a heavy lift. Just downloading stolen data is not.

Oh, you're absolutely right. Every— everything is hackable. It's a matter of how many resources time that the hacker wants to invest. And I think password manager, you're looking at, you know, at an extreme there about time and resources that would be required to do so.

Exactly. You know, so like, we've talked password managers a bunch of times in the past, we've talked passwords 1,000 times in the past. Apparently, we still need to do it.

Yep. Yeah, our job, our job will never be done.

Peter, where can people find you?

They can find me at counterintelligence-institute.com, as well as on my LinkedIn page. And of course, if they're interested in picking up some interesting reading material, I got two books: Confessions of a CIA Spy, The Art of Human Hacking, and the book more written for our seniors population, Why Are You Messing With Me?

Yeah, good stuff. And I like— watched, uh, the Grandparent Scam video that, um, Peter has on his website. It's excellent, it's fun, it's perfect, it's done well.

And, uh, presentations as well.

Yeah, yeah, absolutely. And so, and y'all can check me out at protectnowllc.com. Scroll down on the, on the, on the home page and you'll see the Cybersecurity Awareness Checker, uh, to see if your email or password has been breached. Uh, other than that, Peter, last words?

Hey, stay safe. Look out for each other, and, uh, until next time.

Yeah, and be good, behave, and be careful. Talk to y'all later. Very good.

Hey, you know, you want