How fraudsters target mortgage lending

Compromised credentials and phishing are the most common methods of cyberattacks, Cunningham said. “And those are so prevalent that it’s an everyday, every hour thing.”

Phishing, or transmission of emails made to look like they are from reputable businesses in order to steal victims’ personal data — as well as the text-message equivalent of smishing — are a common entry point leading to theft of personal information. Once fraudsters can obtain personal credentials, that person’s contacts are immediately threatened as well.

“When they infiltrate a victim, they record everything that’s going on in their browser,” said Oleg Kolesnikov, vice president of threat research and detection at security analytics and operations management platform Securonix.

“The browser has special session-related cookies. So they could impersonate the person browsing to their bank or their mortgage provider. Then, following that, they basically leverage those to apply for mortgages and they can as part of doing that they can impersonate the browser of the user.”

The consequences of the initial breach commonly can lead to wire fraud, a trend that Todd Keller, chief information security officer at Cherry Creek Mortgage, has seen increase over the past few years. But it also opens the door to possibly more serious outcomes, including ransomware attacks.

“The bad guys get access to your system, and then, once they have a foothold on the network, they move laterally,” Keller said. “They start to own other systems, find out what’s happening on the network. Where’s the data? Where’s the crown jewels? How can I get that out?”

The mortgage industry is particularly vulnerable to infiltration due to the common use of email usage for business.

“Email continues to be ubiquitous in the mortgage industry for transacting a loan,” Keller said. “So you’re working with a lot of third parties — whether it’s title, real estate, the borrower themselves — and a lot of that information about specifics around the loan will be communicated via email. So the bad guys realize this, and that’s an easy target.”