Sophisticated scam targets lawyers and wire transfers.

Never trust a last-minute email that changes the original wiring instructions for transferring client funds.

Instead, pick up the phone and call the contact person who provided the original instructions to personally verify the routing and account numbers to be used.

That's the advice from John Fisher, CEO of First American Bank in Naples, who reports that twice in the past few months, lawyers involved in real estate transactions have been swindled into wiring money to fraudulent accounts.

"By the time the receiving party realizes they did not get the money, the money is gone," Fisher said.

Here is how the scam works, according to an alert issued by the National Association of Realtors:

"Criminals are hacking into the email accounts of real estate agents or other persons involved in a real estate transaction and using information gained from the hack to dupe a party into a fraudulent wire transfer. The hackers often send an email that appears to be from an individual legitimately involved in the transaction, informing the recipient, often the buyer, that there has been a last-minute change to the wiring instructions. Following the new instructions, the recipient will wire funds directly to the hacker's account, which will be cleared out in a matter of minutes. The money is almost always lost forever."

While banks do a good job with authentication and validation, Fisher said, if you provide the bank with a wrong account number, the funds will be wired to the wrong account.

"As long as you are the authorized person and you have the codes and you complete the process, the bank is going to send the money to wherever you tell it to," said Fisher, adding that if that wrong account is controlled by the hacker, the funds will quickly disappear.

"In two instances now for our bank, that is exactly what has occurred. It tells me the fraudsters are monitoring emails for weeks if not months and, right at the last second, they send an email that looks like it is from a legitimate party--but it is not--and they change the account number. So it goes to the correct bank, but the wrong account number."

To be safe, Fisher said, always assume your emails have been compromised.

"If I'm the buyer or the attorney of the buyer and I'm going to send that wire, I want to know the name of the banker and I'm going to independently look up [the bank's] telephone number and ask to be connected to speak to that banker to verify the instructions are correct," Fisher said...