Hacker News Reader

Comment by nyanpasu64 | Hacker News Reader

https://www.cnbc.com/2019/10/05/homebuyers-are-falling-for-t...

> Here’s how these scams usually go down: A thief hacks into a real estate or title company’s computer system and then studies the transactions, from the language used to the format of the wiring instructions. When the scammer strikes, he or she will often pose as someone from the real estate or titling company to instruct the buyer to wire funds to them.

View on HN

Can't this be avoided simply by making sure the property owner gives you wiring instructions in person?

or use public key cryptography, and have a verification signature that can only be signed by knowing a secret.

Hey you know that and we know that, but the real estate industry is barely able to handle email, let alone secure it.

lol yes, because signed and encrypted email hasn't been tried.

The scam here relies on someone having compromised the network of the company sending the instructions. In that situation, wouldn't you have to assume the intruder found the secret key?

The scam relies on absolutely insane system of financial institutions sending critical key information over email, instead of any controlled channel.

I'm not saying that cryptography wouldn't help in general, or that it's not incredibly stupid that we're not using it. What I'm saying is you can't just slap crypto on this particular scam to make it go away. These people have insider access to the machines that would likely be used to sign the email. If that is the threat model, it's a mistake to trust anything not delivered in person, signed or not.

You aren't (usually) wiring the money to the property owner. It goes to the title or escrow company processing the transaction. They get the money, execute the paperwork, and then transfer the money to the owner after everything is squared away.

What is the incentive to use an escrow instead of dealing with the owner directly? How do I know the escrow won't run away like a crow with my money and the house?

The escrow company is supposed to be more reputable than the owner. They also handle this type of transaction, and know how to get it done properly, how to check the seller actually owns the house etc.

Not all the money goes to the home owner. Typically some goes to the bank for the mortgage, some to the buyers agent, some to the seller's agent, some to taxes/fees, and so on. The escrow/title company calculates all of this and ensures everyone gets their money.

In the US at least, you typically don’t even meet the owner. (Never mind that it’s not easy to make sure you’re paying the real owner without the aid of the various intermediaries. Nolo Press has good books about buying and selling homes and all the potential pitfalls involved.)

It's avoided by the companies involved taking 5 minutes to talk to each other when comuniticating instructions, and then holding the funds in escrow for a day before disbursing them.

But they don't care and they are not computer literate.

Reply on news.ycombinator.com