The Fraser Valley Real Estate Board is alerting REALTORS® to exercise heightened awareness in view of recent lockbox breaches which have come to light. While any property could be at risk, perpetrators appear to be targeting vacant Estate Sale properties. In one recent case involving a property in Abbotsford, a lockbox was fraudulently breached by identity theft of a member, and items of significant value were stolen. The high level of industry knowledge employed by the perpetrator(s) highlights the need for a collective and equally stringent degree of vigilance on the part of our members.
Point of breach is email and damage is swift
On March 23rd, we learned of a member from another Board who was working on his computer when he was suddenly locked out of his email account. When he attempted to sign back in, he noticed his password had been changed. He called his service provider (Shaw) and they assisted with regaining access. Once back into his email, he saw ‘password reset messages’ for SentriLock. Whomever hacked his email made changes within a short 5-minute period. He contacted SentriLock and his Board, who assisted, further ensuring that his emails were not being forwarded to other parties. No access codes were generated for any properties.
In this case, the member was very fortunate to have caught the breach as it was happening. This incident clearly demonstrates how swiftly and adeptly access to email and other accounts can be gained with ill-intent. In response to these incidents, the Board strongly recommends members take immediate action to implement added layers of protection through multi-factor or two-step authentication. Your internet service provider can assist with this.
The Board further recommends that, for the foreseeable future, members NOT provide ‘One-Day’ access codes to anyone. All members should have their own SentriKey® access. Members who need assistance with this are welcome to visit the Board Office – the MLS® Department will assist you. This process is quick and is part of the services bundle included with your membership. For the time-being, if a member comes from out of town to show properties, meet them at the location. Do not take the risk of providing a ‘One-Day’ access code to anyone.
What action has the Board taken to mitigate risk?
In view of an increase in lockbox breaches in recent months, the FVREB and its counterparts established joint measures to protect members and reduce potential threats. The actions taken include:
- Suspension of reciprocal lockbox privileges. Automatic reciprocal lockbox privileges have been temporarily suspended for all BC Real Estate Boards except CADREB, FVREB and REBGV. Access to properties in the other Board jurisdictions can be obtained only by calling your Board Office, prior to planning a visit to show properties outside the Lower Mainland. While we regret the inconvenience, the security of our members and their clients outweighs the convenience as we continue to assess the threat.
- Touchbase updates/changes. All phone number changes made by members on their Touchbase accounts are being verified with members by the Helpdesk.
- One-device policy. Boards which had not already done so have instituted a one-device policy, so that only one device can be registered. FVREB has had this policy in place for many years.
- New devices. Members who need to register a new device must do so by contacting their Board office directly to undergo identity screening and authentication to set up the device.
- Account updates. No changes or updates can be made to account settings without prior identity verification by the Board Office.
- Multi-factor authentication. Discussions continue with SentriLock and Clareity to incorporate multi-factor authentication measures for account access.
Security threats affect all Realtors and their clients, regardless of jurisdiction, so we urge all members to exercise added vigilance when sharing information with colleagues. If you experience a lockbox breach, please:
- Immediately contact your local law enforcement authorities
- Notify the Managing Broker of your brokerage office
- Notify your Real Estate Board Office, providing all details of the incident, including any police file number
- Notify SentriLock
Thank you for your attention to this urgent matter.