Academic study reveals just how lucrative cyber crime can be, with top-level cyber criminals out-earning government leaders and university graduates.
Cyber criminals are acquiring, laundering, spending and reinvesting about $1.5tn in profits a year, research has revealed.
Mid-level cyber criminals make up to $900,000 (£639,000), which is more than double the US president’s salary, while entry-level cyber criminals make about $42,000 (£30,000), which is significantly more than the average UK graduate, the research noted.
The findings on how much cyber criminals earn from their illegal activities and what they spend their profits on are part of an 11-month study into the macro economics of cyber crime and how the various elements link together. It has been led by Michael McGuire, senior lecturer in criminology at Surrey University.
The report highlights how cyber crime has become a booming economy, and reveals cyber criminal links to drug production, human trafficking and even terrorism.
The use of ransomware, crime-as-a-service, data theft, illicit online marketplaces and trade secret/IP theft are helping cyber criminals generate huge revenues with relative ease, the report said.
The research also revealed that there are large organisations in the burgeoning cyber crime economy that closely match the structures and business plans of companies such as Uber, AirBnB, Facebook, Twitter and WhatsApp.
These platform owners are acting more like service providers than criminals, leading to a shift from those who commit crime to those who enable and profit from it, the report said.
“Cyber crime is a lucrative business, with relatively low risks compared to other forms of crime,” said Bromium CIO Gregory Webb.
“Cyber criminals are rarely caught and convicted because they are virtually invisible. As criminals further monetise their business, allowing anyone to buy pre-packaged malware or hire hackers on demand, the ability to catch the kingpins becomes even more challenging.”
According to Webb, the cyber security industry, business and law enforcement agencies need to come together to disrupt cyber criminals and cut off their revenue streams. “By focusing on new methods of cyber security that protect rather than detect, we believe we can make cyber crime a lot harder,” he said.
Data gathered by the research team through first-hand interviews with 100 convicted or currently engaged cyber criminals, law enforcement agencies and financial institutions, combined with dark web investigations, reveals that 15% of cyber criminals spend most of their money on immediate needs, such as paying bills.
One-fifth of cyber criminals focus their spending on drugs and prostitution, 15% spend to attain status or impress, but 30% convert some of their revenue into investments. Some 20% spend at least some of their revenue on reinvestments in further criminal activities, such as buying IT equipment.
The proceeds of cyber crime fuel other crimes, such as terrorism and human trafficking, the report said, much like a legitimate business reinvests profits to expand while also contributing towards core philanthropic values.
The research showed that cyber criminals are reinvesting their money to grow their own business, but also to promote other types of crime. Terrorism, human trafficking, drugs manufacturing and firearms trading have all been beneficiaries of cyber crime.
The report noted there is a growing market catering to cyber criminals by allowing them to buy things with virtual currency. Sites such as White Company, Bitcoin Real Estate and de Louvois offer luxury products priced in bitcoin, which is becoming a concern for financial analysts, the report said.
“The range of spending habits among cyber criminals is fascinating,” said McGuire, who will present the full findings of the Web of profit study at the RSA Conference in San Francisco from 17-19 April.
“A lot of cyber criminals spend their money on increasing their status, whether that be with peers or romantic interests.
“One individual in the UK, who made around $1.7m (£1.2m) per year, spent huge amounts of money on a trip to Las Vegas, where he claimed to have gambled $40,000 and spent $6,000 hiring sports cars so that they could ‘arrive in style’ at casinos and hotels.
“Another UK cyber criminal funnelled his proceeds into gold, drugs, expensive watches and spent £2,000 a week on prostitutes. It’s alarming how easily cyber criminals are able to spend their illicit gains. There is an ever-growing market that is almost tailor-made for cyber criminals to make these ostentatious purchases with little to no regulation or oversight.”
Other, previously released findings from the report revealed that cyber criminals are using a combination of new cryptocurrencies, gaming currencies and micro-payments to launder up to $200bn in ill-gotten gains.
According to McGuire, the report’s aim is to examine revenues to gain a true picture of cyber crime, to help the cyber security industry and law enforcement identify opportunities to disrupt cyber criminal revenues and prevent social harm.
Published in Computer Weekly.
PCN Network announced a new service offered through its technology-based disbursement solution to securely manage mortgage funds help protect against cyber theft and fraud.
Called SafeValidation, the solution confirms payoff accounts and authenticates payees for outbound wires. Both are incorporated into SES Technology and are included in the Safe Escrow service.
“Two thirds of title agents believe that not enough is being done to control escrow security,” said Pritam Advani, CEO of PCN Network. “And our technology solutions are likely to control escrow fraud better than current processes. Safe Escrow, built on proprietary SES Technology, supports this tighter security through central escrow management, while still providing local execution by agents.”
Joyce Lombardo, owner of Fast Tract Title, added “I frequently hear stories of thefts of escrow funds. I worry that I could be targeted next. Safe Escrow and SafeValidation give me confidence that my funds are secure and are being sent to the right payee.”
PCN Network’s Safe Escrow has launched a new solution that increases protection again cyber theft and fraud.
SafeValidation confirms payoff accounts and authenticates payees for outbound wires, PCN Network said. Both are incorporated into SES Technology and are included in PCN’s Safe Escrow service.
“Two thirds of title agents believe that not enough is being done to control escrow security,” PCN Network CEO Pritam Advani said in a release. “And our technology solutions are likely to control escrow fraud better than current processes.”
“Safe Escrow, built on proprietary SES Technology, supports this tighter security through central escrow management, while still providing local execution by agents,” Advani added.
Fast Tract Title Owner Joyce Lombardo said the solution gives her confidence that funds are secure and being sent to the right payee. “I frequently hear stories of thefts of escrow funds. I worry that I could be targeted next,” Lombardo said.
“Safe Escrow allows me to retain control of the disbursement process in areas that are important to me — like printing specific types of checks or making last minute changes,” said Hope Kahn, owner of The Closing Table of Florida. “I also get peace of mind by effectively reducing my risk while maintaining compliance. It’s the best of both worlds.”
Pittsburgh-based PCN Network was granted The American Institute of Public Accountants’ Service Organization Control (SOC 2) Type II certification for its Safe Escrow System and related service. Safe Escrow utilizes its proprietary technology to provide a managed disbursement solution for title agents, underwriters and mortgage lenders.
The examination also included the suitability of design and testing the operating effectiveness of controls to meet ALTA’s Best Practices Pillar No. 2 (escrow trust accounting).
A SOC 2, Type II examination represents the elite standard of detailed examination of suitability of design and testing the operating effectiveness of controls to meet criteria for security, availability and process integrity, as set forth by the AICPA, Trust Services Principles and Criteria. It is a widely-accepted auditing measurement indicating strong controls in, among other things, the integrity of processing of and protection of confidential data with respect to escrow accounts managed by Safe Escrow.
In 2011, The American Institute of Public Accountants created Service Organization Controls (SOC) reporting standards. The SOC 2, which replaces the SAS 70, reports the evaluation of an independent auditor as to the effectiveness of controls at a service organization relative to security, availability, processing integrity, confidentiality and privacy.
The SOC 2 designation implies that Safe Escrow meets or exceeds Pillar No. 2, which urges settlement services-related firms to adopt and maintain strong written procedures and controls for escrow trust accounts and includes the electronic verification of reconciliation.
“While many settlement services firms or title agents perform limited reviews or self-assessments, Safe Escrow has submitted itself to an independent evaluation and detailed testing of its service, and has met the requirements of ALTA and the AICPA’s rigorous SOC 2 standards without exception,” Safe Escrow President and CEO Pritam Advani said in a news release. “Lenders and underwriters are seeking to mitigate risk associated with escrow funds. The Safe Escrow System and related service is designed to improve the present state of escrow funds management. Our title agent clients have also informed us that our system is easy to work with, while achieving a degree of control and security standards that they could never attain on their own. Safe Escrow willingly incurred the expense and effort associated with a detailed SOC 2, Type II examination, as it conclusively demonstrates the value of our Safe Escrow System and related service.”
North American Title Insurance Co. (NATIC) has entered into a partnership with PCN Network for its newly released Safe Escrow Services, which provides title agents, title underwriters and lenders a compliant, secure and flexible managed disbursement solution for mortgage loan funding.
“NATIC continues to look for vendors that our agents can depend on, especially those who can assist our agents with solutions that satisfy ALTA Best Practices,” said Emilio Fernandez, NATIC president. “Safe Escrow can assist agents who don’t have the personnel, banking tools or the experience to implement adequate separation of duties and internal controls on escrow trust accounts.”
Safe Escrow is ideally targeted to smaller title agencies that handle 50 deals or less each month and can also be a useful solution for larger agencies that wish to outsource the funding process. Because of new regulations promulgated by the Consumer Financial Protection Bureau, lenders are being held accountable for certain standards of quality for their vendors. Lenders are therefore looking to ensure that vendors will not create unexpected liability. The companies said in a release that one of the biggest challenges for title agents is adopting the ALTA Best Practices recommendation concerning the separation of duties in funds transfer and escrow management.
“Many agencies, particularly smaller independent entities, simply don’t have the infrastructure to establish appropriate accounting controls, because of their size, and technology alone cannot solve this issue,” said Pritam Advani, chief executive officer of PCN Network. “Our partnership provides NATIC agents a compliant and cost-effective solution for escrow account management.”
According to PCN, agents transfer a portion of the process burden, cost and risk associated with owning trust accounts, yet retain control of the entire workflow process by utilizing a managed disbursement system. By eliminating much of the process overhead, they also gain additional time to focus on quality of service and a positive customer experience, the company said in a release.
“NATIC has performed due diligence on Safe Escrow’s processes and we recommend the service’s value and capabilities,” Fernandez saud. “NATIC’s ultimate goal is to make our agents’ lives better and make us the easiest underwriter to work with.”
eLynx, a portfolio company of American Capital and PCN Network LLC formed a strategic partnership to provide a secure way for lenders to ensure the safe and proper disbursement of escrow funds at the conclusion of a mortgage closing.
Safe Escrow is a managed disbursement service that gives lenders greater assurance that escrow misappropriation can be prevented more effectively and helps large and small settlement agents meet ALTA’s “Title Insurance and Settlement Company Best Practices.”
The proper handling of escrow funds is one of the highest risk areas for lenders and title underwriters in the closing process. Unfortunately, it is also one of the areas where they have the least control. In establishing its set of Best Practices for settlement agents, ALTA emphasized the importance of escrow fund management by requiring “appropriate written procedures and controls for Escrow Trust Accounts allowing for electronic verification of reconciliation.” Unfortunately, many agencies, particularly smaller, independent ones have neither the infrastructure nor the level of training and expertise needed to comply with this Best Practice, the companies said in a release.
“That’s why we created the Safe Escrow managed disbursement service,” said Pritam Advani, founder and CEO of PCN Network. “By replacing agent-owned escrow accounts with centrally managed ones, using innovative technology to allow for agent involvement and authorization, and providing sound financial processes in the central facility, we ensure even the smallest agent can meet the standards required by both ALTA and lenders.”
“Settlement agents are experts in title and in taking the consumer through the closing process. They shouldn’t have to be experts in escrow account management and bank reconciliations,” said Andy Crisenbery, eLynx senior vice president of business operations.
Safe Escrow provides a secure and flexible way for settlement agents to manage the escrow process, while complying with the second pillar of ALTA’s Best Practices. Among the key benefits provided by Safe Escrow are:
- Independent management and reconciliation of escrow accounts by an experienced third-party with over 100,000 escrow transactions completed on behalf of settlement agents
- A complementary workflow design that maintains the settlement agent as an integral participant in the escrow process while ensuring that the integrity of controls is never compromised
- Lower risk for all parties, from settlement agent to title underwriter to lender
In partnering with eLynx, the process of managing escrow disbursements is enhanced even further for greater efficiency. eLynx’s Electronic Closing Network (eCN) contains profiles on nearly 100,000 settlement professionals as a result of lenders who use our network to send closing packages to settlement agents. eCN automatically triggers certain Safe Escrow processes when the closing package is delivered ensuring that the funding conforms to the lender’s instructions.
“Adding Safe Escrow to our Electronic Closing Network was an easy choice,” Crisenbery added. “We help initiate certain escrow management procedures immediately upon closing package delivery, which makes the process even more efficient for both lenders and settlement agents. Both participants in the closing process benefit greatly as a result of this connected workflow.”
There are plenty of factors that have contributed to the title agent defalcation problems in the title industry, as has been discussed in the pages of The Title Report and elsewhere, but at the center of it all is the title agent — the visible faces that have misused escrow accounts and committed fraud. Because of that — because of the bad apple title agents — people inside and outside the industry are looking for solutions at the title agent level to fix the industry’s most glaring problem.
Title agent defalcations are a big deal because millions of dollars are at stake, along with the financial lives of consumers and the businesses of lenders and underwriters. The size of the title agent defalcation problem has caused people to look for a solution of equal size, aimed at either radically improving the escrow processes of title agents across the country or surgically removing that duty from an agent’s workflow.
Nelson Lipshutz, president of the Regulatory Research Corp., is one of those people. In his view, the escrow and disbursement responsibilities of an agent should be centralized in order to reduce the risks across the industry for everybody involved. The concepts he proposes involve a consortium of underwriters or another third party taking control of the disbursement activity.
“An underwriter consortium is the most natural type of solution,” Lipshutz said. “Elements critical to a large number of jurisdictions, like title plants, have been done as consortium rather than individual entities and worked out pretty well. The only difficulty is the amount of information the other individual underwriters would have in the consortium, but protecting confidentiality inside a system like that is a pretty straightforward task. It’s not terribly different than what goes on with medical records. I just think keeping control of the money is an increasingly important issue.”
Lipshutz believes that title agents are not fans of dealing with the escrow accounting side of their business anyway, making this sort of solution safer for the industry and friendlier for the agents.
“I don’t see any competitive disadvantage for a regional underwriter being a part of such a system, and there’s a real risk reduction,” he said. “You could build a system with much better controls. There are certainly fewer people to watch, and that’s the huge issue.”
Lipshutz’s concept isn’t an indictment of the title agent, it’s an indictment of the decentralization of such an essential and big-money duty. He feels it is the same for escrow states as non-escrow states because that process is just as decentralized — the more hands in the cookie jar, the riskier the system is.
“The only real solution is central control, controlled by the underwriters because they’re ultimately on the hook,” he said. “Behavior in the industry has changed. The size of escrow accounts and the amount of money in there is enormous compared to what it was 20 years ago, and I don’t think the system overall has adapted to the increased risk that this scale of exposure indicates.”
Third-party escrow solution
Lipshutz has some thought-provoking points on preventing title agent defalcation, but an underwriter consortium would be a huge departure from the current setup. Even if underwriters are ultimately on the hook, they don’t necessarily want the escrow accounting responsibility any more than an agent might. That line of thinking is behind a new solution from PCN Network.
“We understand everyone is frightened by their escrow accounts and we understand that when we have a boom, there’s enough to flow through the accounts to cover a lot of bad things that might be in there,” said Pritam Advani, president and chief executive officer of PCN Network. “When the industry goes through a down cycle, all of those get exposed. That’s typically when you find the defalcations.”
In Delaware, the law requires attorneys to handle the responsibility out of their own escrow accounts, and that is what led PCN to create a disbursement solution to more efficiently manage that duty. Since implementing the idea four years ago, the system has become more technologically advanced, and has been used in other states. Currently, the company handles about 1,000 transactions a month, and with the spotlight of the industry on the recent high-profile defalcations, Advani believes now is the time to take a solution like this into the mainstream.
Advani pointed out the audit processes underwriters use to find these accounting problems are fairly inadequate. There are too many agents, few auditors, predictable schedules and low audit coverage — about 2 to 3 percent of all transactions. Most fraud is found through customer complaints. The idea behind PCN’s service is that underwriters of all sizes would use it to manage all of the disbursement functions of their agents. Title agents would maintain every single aspect of their workflow the exact same way, but when it came time to handle the money, that duty would go directly to PCN.
“The agent never touches the money. They don’t have control of the money; but they have control of the transaction,” Advani said. “They submit the HUD-1 and all the supporting documents to us and we would be doing the funding.”
When the lender approves the HUD-1, the process would be for the bank to send the approved HUD-1 to PCN and a copy back to the agent. The agent then sends the disbursement instructions to PCN and the bank would send the funds to PCN’s escrow account. The main change in the workflow is that the agent never receives the funds and would not be responsible for the disbursement process.
PCN then runs all transactions through a centralized account. That centralized account then becomes a single audit point for underwriters, which could improve their auditing processes. The PCN disbursement system then uses a combination of manual and automated controls in order to provide the most protection. The technology accomplishes tasks like: detecting defined automated risk points in a transaction, sending out risk alerts, reconciling accounts daily, using positive pay that automatically rejects any check that doesn’t match the approved disbursement file. The 14-point manual process is needed for quality control. Two people are involved in every part of the transaction.
“The independent third party provides a checkpoint and eliminates any chance an agent could misappropriate the funds. Also, the agent is being paid from the central disbursement process and is interested in making sure it is functioning properly, making the agent an auditor,” Advani said. “They don’t have the money but they have responsibility for the transaction, no incentive to steal, and every incentive to make sure we don’t steal.”
Agents and underwriters could look at the data in the system, see the federal wire numbers, check numbers, mailing labels and so on through a web portal. The web portal will also integrate with the top title production systems so the data can be retransferred back into the system. PCN would implement various audit and cross check protocols in collaboration with lenders and underwriters to ensure that key data on the HUD-1 was verified and that funds were always transferred to the correct account.
As simple as Advani can make the solution sound, there is a lot that would have to change about the title industry for it to become wide spread. For one, it seems unlikely any underwriter would step out and become the first to adopt a third-party escrow account solution for fear of losing agent business. That fear isn’t without reason, as an informal poll on The Title Report website showed 62.5 percent of respondents believed escrow responsibilities were an essential part of their duty. However, about 33 percent believed it was nonessential in some way — 12.5 percent said every state should be an escrow agent state, 10.5 percent said underwriters should handle the responsibility, and 10.5 percent said there should be a third-party technology that handles it to minimize risks for everyone. Four percent were unsure.
One respondent noted how well escrow works in North Carolina, which runs through attorneys instead of title companies. Another noted that large title companies can use bundled pricing for their centralized closing services which put smaller operations at a disadvantage. Others mentioned the increased costs of a third-party for either themselves or the consumer.
“The true value of what we deliver from a service perspective, and the primary manner in which we can differentiate ourselves from our competitors, is in the escrow/settlement/closing arena,” remarked one respondent.
“The handling of the closing process does not need to be complicated by adding an escrow agent or the underwriter to the current closing process. Title agents need to raise their standards of protection to the consumer, or the underwriter should be responsible for their agent’s escrow actions,” stated another respondent.
“I worked as an escrow agent alongside a title agent for many years. Many people said my one trait was I was too honest, but many are not. Take the responsibility from that girl or guy who is handling the large monies and make it a three-person obligation,” said another.
PCN acknowledged the competitive concern on the part of underwriters but believes the tone in the industry is starting to change and that some of the notable lenders might start pushing everyone in this direction. Advani also made a point about the advantages independent agents might see because, suddenly, direct shops might not be the safest option.
“A lot of large underwriters are cutting back on smaller agents saying it’s too expensive because there is not enough volume. Now, an option might be to use a smaller agent, if they agree to this platform, because the underwriter doesn’t have to send an audit team out,” Advani said.
There could also be cost savings for agents by not needing a staff to do disbursements or manage escrow accounts or by not needing the extra insurance coverage for escrow responsibilities.
“The solution doesn’t have to be across the board,” said Tom Frunzi, president of the Phenix Group Inc., who is working with PCN to expand its efforts. “Look at your book of agents and segregate it based on risk category. If you have 1,000 agents and you know 150 of them had some type of reconciliation problem in the past, then those are the prime candidates. Or you could take any loan over a given amount and disburse those through an independent third party.”
Continue improving agent controls
The biggest concern for agents in hypothetically giving up their escrow accounts is giving up that relationship with the local bank. Even if such a solution could solve other headaches, it could be a huge business risk in an already unforgiving market place.
Another solution to help prevent title agent defalcation just entering the industry from a company called ATS Secured attempts to keep the escrow responsibility with the agent but more securely lock down the disbursement process with a streamlined digital check delivery system.
“Agents have the fiduciary responsibility to make sure funds go out appropriately but they don’t actually have all of the systems in place to manage that process,” said Wes Miller from ATS Secured. “They get paid to close loans, and having spent many years as an originator, I understand the pressures they’re under to make sure the loans close on time. But it seems once the loan is closed, it’s time to move on to the next one. In that process, I think there’s a big chance for errors to happen and for things to get misallocated.”
The software Miller is introducing serves several functions: it will be a communication portal for all stakeholders in a transaction, it will monitor the escrow account, it will handle the funding and disbursement functions by creating digital checks directly from the agent’s escrow account, and it will automatically reconcile the account each time a check is created.
Agents submit HUD-1s within the system, lenders view them within the system and approve funding instructions within the system. Based off those documents, agents then create those checks — within the system.
“A lot of offices have dual signatures on checks, and we can accommodate that in a couple different ways. We can have them actually do digital signatures on the checks,” Miller said.
Miller said his company has a lengthy on-boarding process to ensure that the escrow account used within the system is legit, and the company is currently set up with about 90 percent of the lending institutions in the country.
“The agent has to create the physical checks, and they do that through a digital check technology where we have them sign their checks and it runs through the same kind of bank process,” Miller said. “With it being a check, it’s much more difficult to get that money. There’s more control over where it’s going, who deposited it, and which account it went into. And you can get it back. When a wire goes out, you can’t get that back.”
The dual digital signature process is meant to provide that added layer of security for the agent and also, possibly, the underwriter because an underwriter can be given the second authentication signature on every disbursement. It’s a way for the title underwriter to control the secure disbursement of escrow funds but still leave the responsibility in the hands of the agent.
“This system allows for the agent to maintain those banking relationships, be in control, and also for the underwriters to have control, visibility and transparency as to where those funds are at all times, if they want to,” Miller said. “And by reconciling before money ever leaves the account and looking to make sure the money is going where it’s supposed to go, you’re avoiding those post-closing errors and problems. It allows the agent to focus on what they need to do — closing loans.”
Title agent defalcation, even if it’s just one agent, hurts the entire industry, and ATS Secured and PCN Network are just two contending big-picture solutions attempting to rethink the industry’s processes to solve the problem. Whether it’s one of these two concepts or something else, it’s apparent the industry needs some sort of change in order to better protect consumers, customers and itself from the inherent risks of handling escrow responsibilities.
“Controversy isn’t the worst thing in the world,” Lipshutz said of the radical solution he’d like to see adopted. “Any time you want to do something new there is controversy. I think this pulls a lot of very serious risk out of the system, and from the point of view of stability of real estate finances, it’d be a great advantage.”