A Minnesota couple lost more than $200,000 in a sophisticated email scam authorities say is sweeping the country.
Email records reviewed by KARE 11 reveal the scam may have connections overseas.
“People in other countries are using our system – our banking system – to rob U.S. citizens,” says Steve Tadevich.
Authorities say what happened to Tadevich and his wife should be a warning to anyone who uses email or does some of their banking online.
Shopping for a new home
Steve and Claudia Tadevich moved to the Twin Cities to be closer to their grandchildren.
“We get to see band concerts, we get to see sporting events,” said Claudia. “It’s really been a blessing.”
After renting at first, they were just days away from closing on the purchase of a Twin Cities area townhome. That’s when they received an email with details about the real estate transaction.
“This is the email that came from Courtney,” said Steve Tadevich as he pointed to his computer screen.
It looked like it was from Courtney Pennington from Edgewater Title, the company handling the sale.
“Attached is the buyers closing statement,” the email read. Steve says he opened it and reviewed the financial details.
“And the numbers looked right,” he said.
Also attached was a document with instructions about how to make the final payment by a modern bank-to-bank wire transfer. The instructions said the payment needed to be sent before the scheduled closing.
“I thought it was going to be so simple,” Claudia said. “And it turned out to be a nightmare, really.”
They trusted the email, followed the instructions, and showed up at Edgewater Title for the closing.
“We’re sitting in a little room with the sellers. And the closing person goes to check on the check, and she’s gone, and she’s not coming back, and she’s not coming back, and she’s not coming back,” Claudia remembers. “And she finally comes back to the room and says she’s not finding it.”
Turns out, the email and the wiring instructions were fake.
Instead of sending their money to the title company’s account at Venture Bank, the money had been wired to the crook’s account at Bank of America. From there, the money was immediately transferred again.
“By then, the money was gone,” Steve said.
They lost $205,000. “That’s a big hunk of our retirement, gone,” Steve told KARE 11.
The Tadevich family is not alone. The FBI says they are seeing similar email scams nationwide targeting real estate and other financial transactions.
“Over the past three years, we have tracked approximately 14,000 victims in the United States with a fraud loss approaching one billion dollars,” said Jeffrey Van Nest, associate division counsel of the FBI’s Minneapolis office. “And so it’s becoming a very big issue for us.”
How could it happen?
The FBI can’t comment on ongoing investigations. Neither can the Lakeville Police Department, which took the first report and continues to investigate.
So, to find out how schemes like this work, KARE 11 took the emails to Mark Lanterman, a private expert in computer crime.
“This is very sophisticated,” Lanterman said.
On the surface, the email Stave Tadevich got looks legitimate. But Lanterman says the coding information hidden inside the email tells a different story.
Remember that email Steve got supposedly from Courtney in Minnesota?
“The originating IP address does not come from Minnesota,” Lanterman discovered. Digging deeper into the code, Lanterman traced the email halfway around the world.
“The email originated using a server that’s located in Romania,” Lanterman told KARE 11.
Bucharest, Romania, to be exact. For years, Romania has been known as a hotbed for hacking.
But Lanterman warns that the thieves might not actually be located there.
To find out who’s behind an overseas Internet address – or an off-shore bank account – authorities need search warrants. And that’s where investigators say they often hit a roadblock when the money trail leads to foreign countries.
“Other countries don’t necessarily care about an American search warrant,” Lanterman said. “And the criminals know that.”
Authorities are still trying to figure out how the thieves even knew about Steve’s real estate closing.
Did they have an insider feeding them information? Or did they hack into someone’s computer and read other emails about the sale?
“Somebody’s computer got hacked somewhere along the way,” Steve Tadevich believes.
“Just unbelief that this actually happened to us,” says his wife, Claudia.
The couple still struggles with one nagging question. Why didn’t anyone involved in the real estate closing warn them about the possibility of fake email instructions? After all, real estate publications had been carrying alerts about similar scams long before Steve and Claudia were scheduled to close on their home.
The warnings are simple. Authorities say before you trust any instructions you get in an email, verify them first.
“A simple phone call. A simple phone call, and everything would be fine,” Steve told KARE 11.
Without that warning, as it stands now there’s little hope the money the Tadevich family lost in the email scam will ever be recovered.
“Unless something changes, we’ll never see a penny of it. It’s gone,“ Steve said. “Gone in a keystroke.”
How to protect yourself
Although real estate deals are often involved, the FBI warns that similar scams also target other financial transactions.
Authorities recommend:
- Don’t automatically trust the information you get in emails – even if they look legitimate.
- Verify the instructions you get independently by phone or in person.
- If you use the phone to verify the information, look up the number yourself. Don’t use the number listed on the email – because that could be fake, too.
- Don’t just hit “reply” to answer an email dealing with your finances. Scammers can make an email address look real, but direct replies to themselves. So, take time to type in the proper email address yourself.
- Act quickly if you suspect fraud. If you contact your financial institution and law enforcement immediately, they may be able to freeze the funds before they reach the thieves.
- File a complaint with the FBI, regardless of dollar loss, at www.IC3.gov.
This investigation began thanks to a viewer tip. If you want to blow the whistle on something, email us at: Investigations@kare11.com.