Tighter Vendor Management is Needed as Wire and Cyber Fraud Risks Grow

In our last blog, we discussed the business case for centralizing refinance closings with a core group of preferred title and closing vendors and how this approach enhances operational efficiency, customer experience and compliance. Now in the second blog in the series, we’ll focus on how centralization provides better protection against wire fraud and cybersecurity risks.

In every mortgage transaction, title agencies move large amounts of money at closing. If you are doing your refinance closings on a de-centralized basis, this means you are entrusting dozens, maybe even a hundred,  local title shops with your and your customers’ money. But how well do you know these companies? If you use these companies infrequently or on a one-off basis, does your vendor management group have the bandwidth to vet their fraud prevention practices? Are they even checking to see what levels of insurance these smaller shops are carrying?

Last fall, a leading wire fraud prevention company surveyed more than 48,000 settlement service professionals about their experience with wire fraud and cyber fraud. Twenty percent of the respondents said they themselves had been victims, or potential victims, of wire fraud and/or cyber fraud to intercept bank proceeds in the past 12 months. Despite the growing incidence of business email comprise (BEC) and phishing, only 24 percent of the respondents said that they had been asked to provide evidence of cyber insurance by their lender partners.

Money isn’t the only thing that you are entrusting these agencies with: think of all the personally identifiable information that is shared with your title/closing vendors?

How many of these small local shops can afford to invest in the technology, security infrastructure and the cybersecurity insurance needed to achieve SOC 2 level certification? Our company, like most large title agencies, is SOC 2, Type 2 certified. Maintaining this level of IT sophistication and security requires a significant annual investment that many smaller firms are unable to justify.

By centralizing refinances with a core group of vendors, regional and national lenders have the ability to perform in-depth due diligence on their policies and practices and require higher levels of IT security and insurance coverage from them.  To qualify as a core title provider, a high standard of care against wire fraud should be in place and include the following:

• Social engineering coverage as part of cybersecurity insurance; social engineering is the most common source of lost funds, but is not covered by standard cybersecurity insurance
  
  
• Yearly penetration testing and monthly vulnerability scans, both from a qualified third party
  
  
• Monthly employee cybersecurity training
  
  
• Monthly employee phishing testing
  
  
• Ongoing tracking of employee performance on training completion and failed phishing attempts, with additional training provided as needed
  
  
• Use of a third-party software (CertifID) to securely provide wire instructions, to verify outside wire instructions, and to verify seller identity for vacant land transactions
  
  
• Communications via a secure online portal, Docusign with Multi-factor authentication (MFA), or direct lender integration, never unencrypted email
  
  
• MFA login for all employees
  
  
• Researching and responding to the latest fraudulent schemes

The risk of wire and title fraud hit an all-time high at the end of Q4 2023, according to FundingShield. In that period, 51.2 percent of all closing transactions reportedly had at least one possible fraud-related issue. In that same period, several large industry players were also sidelined by cyber-attacks.

Working with “known” title vendors won’t shield lenders from every threat, but it is at least a start, and the starting point is closing centralization.

In the final blog of this series, we will look at how one large bank successfully centralized its refinance closing operations.