FinCEN published its Final Anti-Money Laundering Regulations for Residential Real Estate Transfers on August 28, 2024 (鈥淔inal Rule鈥�), throwing the entire real estate industry into a state of high anxiety. What does it all mean? How do we meet its requirements? Will the expense of compliance be a financial drain 鈥� or even put us out of business? Title agents 鈥� who most often also fill the role of settlement or closing agents and would be the first elected reporter under the Final Rule 鈥� have been asking themselves these questions. While law firms and industry associations, as well as news outlets, have discussed the black letter text requirements set out in the , no one knows exactly how this is going to play out. Of course, our biggest fear is always the great and looming unknown.

So, what can we say and do to allay those fears? First of all, the Final Rule does not become effective until December 1, 2025. This gives the industry time to become prepared and adapt to the new requirements. Secondly, ALTA has stated in its , that it 鈥渨ill develop and provide several education and training opportunities to prepare the industry for the rule鈥檚 requirements.鈥�

Moving forward to operationalize the Final Rule, FinCEN released the unpublished version of its  on November 12, 2024 with the formal published version to follow; thereafter the collection form is open for a 60 day comment period. Additionally, FinCEN agreed to provide  as it goes through implementation. If saying 鈥渉elp will be on the way鈥� doesn鈥檛 quite do it for you, then think about the things that you can do now 鈥� including strategic planning 鈥� to take control, empower, educate and prepare yourself.

What kind of strategic planning are we talking about? Here are a few ideas: 

• Consider setting up a workflow to help you identify reportable transactions and direct the information, documents and forms to the appropriate personnel for processing the required report; including providing a secure intake portal to accept and store documents and forms containing non-public personal information
  • This would include identifying any order regarding a purchase of residential real property by an entity or trust/trustee for cash (without a traditional lender that has a required AML program and who must file SARS) as the term 鈥渞esidential real property鈥� is defined:
    • 1-4 family occupancy residential units (e.g. a stand-alone, such as a single-family residence or townhouse; or even a unit within a multi-unit complex, such as a condo or shares in a coop; or even a residential unit in a mixed use building; as well as entire buildings designed for occupancy by one to four families)
    • Vacant land upon which the purchasing entity or trust/trustee intends to build a structure that is designed principally for occupancy by 1-4 families building such a residential real property

So, if you have an internal IT team or outsource your IT needs with a particular vendor, having a conversation with them now about how they can help you accomplish the work discussed above would not be premature.

• Consider the Final Report鈥檚 required information, identifying what you already have and what you need to obtain from other sources 鈥� i.e. from the bank, from the purchaser鈥檚 representative, the seller or seller鈥檚 representative, and from the signer for the purchaser.
  • The Final Rule requires bank account information for the bank from which the source of funds originated. A title agent does not typically get that information on the wire confirmation or receipt that it receives from its own bank when an incoming wire or certified check is received or deposited.聽However, you can talk to your bank manager and inquire if the bank would be willing to provide you with that additional information on the documentation that it sends to you.
  • While the Final Rule only requires retention of the Purchaser鈥檚 Certification of Beneficial Ownership Information (and of any Designation Agreement that you may enter into), it is still both important and smart to retain all of the data in writing that is provided to you by others.聽 If a question regarding your compliance should ever arise, then you would have documented evidence to show what you relied upon. This would apply to even an analysis of whether or not you have a reportable transaction under the Final Rule.聽For example, if the transaction is a purchase of vacant land, you may want to have the buyer鈥檚 representative state its future intent for the land in writing (because if it doesn鈥檛 intend to build a structure that is designed principally for occupancy by 1-4 families, then you don鈥檛 have a reportable transaction under the Final Rule).
• Consider the cost of compliance with the Final Rule and how you can make your process be the most efficient and effective in terms of the expense 鈥� and perhaps even recoup some of the expense depending upon what your state law and regulator allow.
  • The biggest cost driver is going to be the administrative personnel鈥檚 time for those who will be working on collecting the data and reporting it. Here are some tips that may help:
    • 贬补惫别听two聽well-trained staff members whose education, experience, workload and market rate are appropriate for the time and tasks required to comply with the Final Rule.聽 In case one staff member is unavailable to do the reporting, you will have ready coverage by having a backup person. Remember that there is a due date for compliance 鈥� which is the later of either:

(i) the final day of the month following the month in which the date of closing occurred; or

(ii) 30 calendar days after the date of closing.

In other words, if November 1^st is the closing date, then December 31^st would be the last day for submitting a timely report to FinCEN.

• If you have very few transactions that would be subject to reporting under the Final Rule, perhaps it does not make sense for you to have your own staff members trained to take on the task. In that event, you may want to investigate your options for designating another reporter as identified in the Final Rule. In this event, you would want to do your due diligence and vetting in advance of December 1, 2025.聽Be aware that if you see a vendor advertising to provide this service, unless it is identified as an optional designated reporter within the Final Rule, it cannot relieve you of your reporting responsibilities.
• This can鈥檛 be stressed enough:聽collect the data from the respective parties or people聽before聽the closing date.聽Our experience with FinCEN鈥檚 Geographic Targeting Orders has shown that if you wait until after closing, then you will be wasting a lot of time (and money) chasing after the needed information.
• If you have repeat entity or trust customers who typically purchase residential real estate for cash, educate them in advance of the effective date of the Final Rule regarding what to expect.聽 This may help your customers to have their information ready for data collection while at the same time building their trusted relationship with you.聽 The Final Rule does not require confidentiality as to its contents.
• Since the Final Rule does not discuss recoupment of cost, there is no federal prohibition against it. Your state laws and regulators will be the ones who ultimately determine what kind of recoupment, if any, is allowed for the expense you will incur to comply with the Final Rule.聽Start having conversations with your state land title association early, as they are your advocates and may be able to provide you with guidance from your state regulators.
• Stay abreast of developments (e.g.聽any amendments to the Final Rule or FinCEN FAQs) by subscribing to聽聽(sent to you via email or text messages). Also, keep an eye out for ALTA鈥檚 publications and resources as they become available.
• Read informative articles from trusted sources. One such recent article that is worthy of mention is聽, published September 9, 2024.
• Review the聽聽which has 111 distinct fields; get familiar with the form and write down your questions for future discussion.

Tags: crime, finCEN, fraud, real estate

The post FinCEN鈥檚 Final Anti-Money Laundering Rule For Real Estate Reporting appeared first on 星空传媒 星空传媒 Title Insurance Co..

The post Good Cop/Bad Cop appeared first on 星空传媒 星空传媒 Title Insurance Co..

The post Would You Get Chocolate or Vanilla? appeared first on 星空传媒 星空传媒 Title Insurance Co..

The post What Goes in the Blanks When Showing a Contract to a Buyer? appeared first on 星空传媒 星空传媒 Title Insurance Co..

The post Techniques to Gain Credibility and Appreciation from Your Clients appeared first on 星空传媒 星空传媒 Title Insurance Co..

It may seem like 鈥淭itle Insurance 101鈥� 鈥� but small mistakes can be signs of fraud or misuse of funds or outright intentional undoing of a clear road to closing on a real estate deal.

Not everyone knows everything all of the time; a thousand items have to fall into place and 鈥渁dd up鈥� in order to make the process smooth and completely unencumbered.

A power of attorney showing up in the middle of a transaction (or at the end) should be scrutinized. So should cashier鈥檚 checks drawn from geographical areas that don鈥檛 coincide with the seller鈥檚, buyer鈥檚 or property鈥檚 locale.

Take a look at the potential red flags below; being aware is half the battle.

Preliminary Title Report/Title Search

Red flags鈥� involving the preliminary title report and title search may include:

• Ordered by, prepared for, or mailed to a party other than the lender.
• Property seller is not in title (possible purchase disguised as a refinance or improper property flip).
• Seller owned property for a short time with a cash-out on the sale.
• Notice of default is recorded (possible cash-out purchase with a straw buyer or foreclosure rescue).
• Report indicates delinquent property taxes.
• Report indicates modification agreement on existing loan(s).
• Title documents show the borrower or Seller on a purchase is not the owner of record.
  • For a purchase transaction, the seller should be the owner of record.
  • For a refinance transaction, the borrower on the loan application should match the owner of record on the title documents.

Escrow/Closing Instructions

鈥淩ed flags鈥� involving escrow and closing instructions may include:

• 鈥淔ill in the blank鈥� or generic escrow instructions.
• Change of sales prices to 鈥渇it鈥� the appraisal.
• Odd amounts paid as a deposit/down payment.
• Significant or unusual buyer credits or fees.
• Unusual amendments to the original transaction.
• Seller on Closing Disclosure different than seller on preliminary title report.
• Evidence of 鈥渨hite-outs鈥� or alterations without initials.
• Payoffs to third parties whose lien was not listed on the preliminary title report.
• Reference to another escrow.
• Down payment is paid into escrow upon opening.
• Cash is paid outside of escrow to property seller.
• Sale is 鈥渟ubject to鈥� property seller acquiring title.
• Entity acting as the property seller is controlled by, affiliated with, or related to the applicant or another party to the transaction.
• Buyer is required to use a specific broker/lender.
• Sale of subject property is not subject to inspection.
• Power of attorney used with no explanation.
• Power of attorney is not properly documented/recorded.

Funds to Close

鈥淩ed flags鈥� involving funds to close may include:

• Remitter on cashier鈥檚 check or source of the wire is not the borrower.
• Cashier鈥檚 check issued from a bank that is inconsistent with the depository information on application.
• Cashier鈥檚 check issued from a bank branch that is out of the buyer鈥檚 geographic area.
• Dollar amount is incorrectly encoded on check.
• Sources of funds are questionable

Closing Disclosure/Settlement Statement

鈥淩ed flags鈥� involving the closing disclosure or settlement statement may include:

• Names and addresses of property seller and buyer vary from other loan documentation.
• Seller鈥檚 mailing address is the same as another party to the transaction.
• Excessive real estate agent commissions paid.
• Real estate commission paid, but no realtors listed on the purchase contract.
• Sales price differs from sales contract.
• Reference is made to undisclosed secondary financing or double escrow.
• Rent prorated on owner-occupied transactions.
• Zero amount due to/from buyer.
• Closing Disclosure or escrow instructions contain unusual credits, disbursements, related parties, delinquent loans paid off, or multiple mortgages paid off.
• Payoffs for items not consistent with liens listed on title commitment.
• Excessive seller paid marketing, administrative, assignment or trust fees.
• Payouts to unknown parties.
• Terms of the closed mortgage differ from the terms approved by the underwriter.
• Date of settlement is delayed without explanation.

The post If Something Doesn’t Smell Right, It’s Probably Not appeared first on 星空传媒 星空传媒 Title Insurance Co..

Appraisals can also prove to be undependable, as parties involved can have less-than-legitimate agendas.

Who wants to learn of a crooked contract 鈥� that鈥檚 already been signed, notarized and filed?

No one. Below, we take a look at what agents can do regarding all of the above and how to avoid pitfalls before they happen.

What Agents Should Do If Wire Fraud is Suspected

After the Exchange of Funds (regardless of the dollar amount of the loss)

• Contact your bank.
  • Speak with someone who has authority to reverse or 鈥渞ecall鈥� the wire. This contact may be in your bank鈥檚 fraud department. Note: A best practice is to identify this contact and establish a relationship with him or her before a wire fraud incident occurs. 
  • Make sure the bank understands you have been the victim of a Business Email Compromise (BEC) scheme.
  • Request a Wire Recall or SWIFT Recall Message.
  • Ask your bank to fully cooperate with law enforcement.
• Contact your local FBI office (). The FBI has a number of protocols aimed at freezing and retrieving funds. They will activate appropriate protocols based upon the circumstances of the loss. The American Land Title Association has  on the FBI鈥檚 protocol for reversing fraudulent international wires.
• Complete and submit a  to the FBI鈥檚 Internet Crime Complaint Center (IC3). Be prepared to provide all details related to the transaction including date, amount, the name of your bank and the beneficiary bank, account numbers, contact information, etc.
• Contact the fraud department at the beneficiary bank to notify them about the wire-recall request due to the fraud. Provide details and request that the account be frozen.
• Contact local law enforcement ()
• Contact your Secret Service field office ()
• Contact the 星空传媒 星空传媒 Claims Department by first calling the Claims Manager at (303) 682-9800, ext. 425, and then follow up by emailing applicable information to Claims@alliantnational.com.

When the Money Goes Out, Minutes Count

The 48-hour period following a fraudulent wire transfer is critical; immediately contacting your bank, the local FBI office and submitting a complaint to IC3 as described above will increase your chances of recovering the funds. 

Special Handling of International Wires

Since international wire fraud has a very low chance of recovery or reversal of the wire, special precautions are advisable, such as requiring 鈥渋n-person authorization鈥� from only those authorized signers on an out-going international wire, and having such precautionary requirements agreed upon with your bank.

Appraisals

Appraisals and appraisal reports may contain 鈥渞ed flags鈥� indicating potential fraud. 鈥淩ed flags鈥� may include, but are not limited to:

• Owner of record listed is inconsistent with other information disclosed in the loan file.
• Occupant is identified as a tenant on an owner-occupied refinance application.
• Owner-occupied refinance transaction, but the property is vacant.
• Occupant of subject property is listed as 鈥渦nknown.鈥�
• Appraiser uses public record, exterior inspections, or property seller/builder as sole data sources.
• Illegal zoning is checked on first page of the appraisal.
• 鈥淧hysical deficiencies or adverse conditions that affect the livability, soundness, or structural integrity box鈥� is checked 鈥淵es鈥� on the first page of the appraisal.
• Subject property has increased in value in a stable or declining market.
• Land value is atypically high for the area.
• Excessive adjustments in urban or suburban area where marketing time is under six months.
• Timeframe between sales does not allow enough time for reported renovations made to property.
• Loan file contains a note with a predetermined value.
• Ineligible Condition (C5, C6) or Quality (Q6) ratings.
• Blank spaces on the form (borrower, client, occupant, etc.).
• Missing photos or maps.
• Photos do not match description of property.
• House number in photo does not match property address.
• Photos do not match the floor plan sketch (i.e. location of garage, fireplace, etc.).
• Photos of subject property taken from odd angles or with no depth of field, or have been cropped or otherwise altered.
• Photos reveal items not disclosed in appraisal (e.g., commercial property next door, railroad tracks, another structure on premises, etc.).
• Weather conditions in photo of property are not appropriate for the date of the appraisal (i.e., July photo shows snow on the ground for a property in Illinois).
• 鈥淔or rent鈥� or 鈥渇or sale鈥� sign in photo of subject property on owner-occupant refinance application.
• Most recent sale(s) and/or listing information on subject property and/or comparable properties are missing.
• Use of unverified comparable sales (i.e., not verified through traditional data sources such as MLS, sales office, Closing Disclosure, real estate agent, etc.).
• Use of inappropriate comparable properties (e.g., that are not similar to the subject property when comparable properties are present).
• Excessive distance between comparable properties and subject property.
• All comparable properties are from different town(s) than the subject property.
• Lack of bracketing with comparable sales used (e.g., all sales are significantly larger in living area than the subject).
• Appraisal is ordered and/or prepared prior to date of sales contract or loan application.

Appraiser is located outside of the county in which the property is located.

Sales Contracts

Sales contract 鈥淩ed flags鈥� indicating potential fraud may include, but are not limited to:

• Multiple sales contracts exist.
• Sales contract is dated after the appraisal date.
• Sales contract is subject to an existing lease on an owner-occupied transaction.
• Sales contract includes personal property or prohibited sales concessions.
• Sales price is significantly above or below market value.
• Purchase contract addenda adjusts the sales price.
• Applicant is not shown as purchaser.
• No real estate professional involved.
• Real estate agent(s) used, but not paid a fee; or no real estate agent(s) involved at all.
• Seller is a corporation or LLC and the subject property is not new construction.
• Seller is an affiliated real estate agent, trust, relative or employer.
• The parties to the transaction are related by family or commercial enterprise.
• The contract is not dated.
• Names are deleted from or added to the purchase contract.
• The contract is an 鈥渙ption contract.鈥�
• The contract was assigned or is assignable.
• Earnest-money deposit is an unusually high amount, consists of the entire down payment, or is an odd amount.
• Contract has a very short inspection period and upon satisfactory inspection, the buyer is to notify the settlement agent who is then supposed to transfer a large portion or all of the deposit to the seller (scam is that 10 business days later, it is discovered that the cashiers鈥� check is counterfeit after the money has been sent, and the escrow account suffers a shortage).
  • Recommendation is to contact the bank or entity issuing the cashier鈥檚 check to confirm that the cashier鈥檚 check number and amount is valid prior to depositing the item in the account. Most banks will confirm this by telephone. Due to the increasing occurrences of counterfeit cashier鈥檚 checks, most banks have instituted mandatory holds on cashier鈥檚 checks. It is not uncommon for a hold to last up to 10 days (check with your bank to confirm their policy).
• Name and address on earnest-money deposit check is different from that of the buyer.
• Earnest-money deposit checks have inconsistent dates, for example:
  • Check #111 dated November 1
  • Check #113 dated September 1
  • Check #114 dated October 1
• Earnest-money check is not cashed or is not reflected on the Closing Disclosure.

The post Wire Fraud, Appraisals and Fraud appeared first on 星空传媒 星空传媒 Title Insurance Co..

Email can be sinister. It can encourage changes (not authorized, not legitimate), it can 鈥渨arn鈥� recipients of dire circumstances if instructions are not followed, it can be shaped and branded to look like an institution all parties are familiar with, and it can assist in fraud that involves any number of untoward outcomes 鈥� like clients鈥� and institutions鈥� funds being pilfered.

The U.S. Government has a phrase for such criminal action: Business Email Compromise/Email Account Compromise (BEC/EAC). That wordy title speaks to two crimes.

BEC scams are carried out by compromising legitimate business email accounts. The EAC component of the scam refers to the targeting of consumers and the lenders, real estate professionals, attorneys and others who serve them.

It can be daunting to try to wrap one鈥檚 brain around every single possibility and scenario that could trip someone up 鈥� and trick someone into giving away information that affords a thief the opportunity to steal funds.

Below is a list that, while not necessarily 鈥渃ompletely memorizable鈥� 鈥� even if studied, can serve as a red flag for knowing when something is awry.

It can serve as warning to be wary of the many and various paths that crooks can take to defraud legitimate people conducting real estate transactions.

• Exercise extreme caution when weighing any request to change wire instructions. Encourage all parties to do the same.
• Be wary of any email, phone call or other communication that involves threats, high pressure language (e.g. markings, assertions, or language designating the transaction request as 鈥淯rgent,鈥� 鈥淪ecret,鈥� or 鈥淐onfidential,鈥�) or warns of 鈥渄ire consequences鈥� if immediate action isn鈥檛 taken.
• Be wary of emails with missing or unusual subject lines.
• Be wary of any request to change wiring instructions, especially any last-minute requests.
• Be wary of emails that include poor spelling or grammar, are overly formal or that are written in a style uncharacteristic of the purported sender. Also, beware of emails that misuse industry terminology, for instance, references to the 鈥淗UD鈥� instead of the 鈥淐losing Disclosure鈥�.
• Be wary of any unexpected emails or requests, including internal requests purportedly from executives or others.
• Be wary of emails sent at odd hours.
• Be wary of any communication seeking to confirm information the purported sender should already have.
• Beware of sudden changes in business practices. For example, if a current business contact suddenly asks to be contacted via a personal email address, it鈥檚 best to verify the legitimacy of the request via other channels.
• Review monthly escrow statements from the Receiving Bank (the one holding the agent鈥檚 escrow account) as soon as available to verify that all expected funds have actually been received.
• Have a written agreement in place with the Receiving Bank (the agent鈥檚 bank which holds the escrow account and receives the agent鈥檚 payment order) that the Receiving Bank will match all names, addresses, account numbers, routing number and beneficiary bank name on the payment order with where and to whom the funds are actually sent. Or put instructions on the payment order for the Receiving Bank to verify authorization by matching all of this information.
• Emailed transaction instructions directing wire transfers to a foreign bank account that has been documented in customer complaints as the destination of fraudulent transactions.
• Emailed transaction instructions directing payment to a beneficiary with which the customer has no payment history or documented business relationship, and the payment is in an amount similar to or in excess of payments sent to beneficiaries whom the customer has historically paid.
• Emailed transaction instructions delivered in a way that would give the financial institution limited time or opportunity to confirm the authenticity of the requested transaction.
• Emailed transaction instructions originating from a customer鈥檚 employee who is a newly authorized person on the account or is an authorized person who has not previously sent wire transfer instructions.
• A customer鈥檚 employee or representative emailing financial institution transaction instructions on behalf of the customer that are based exclusively on email communications originating from executives, attorneys, or their designees when the customer鈥檚 employee or representative indicates he/she has been unable to verify the transactions with such executives, attorneys, or designees.
• A customer emailing transaction requests for additional payments immediately following a successful payment to an account not previously used by the customer to pay its suppliers/vendors. Such behavior may be consistent with a criminal attempting to issue additional unauthorized payments upon learning that a fraudulent payment was successful.

Review and revisit this list of tips when handling suspicious wire requests, before the exchange of funds takes place.

• Verify all wire instructions with an alternate method of communication.
• Check emails to ensure the sender鈥檚 address has not been altered. Fraudsters typically use email addresses that closely resemble a seller鈥檚 (or any party鈥檚) actual email address.
• Do not open unknown or unverified hyperlinks or downloads. Tip: Hovering your mouse over the sender鈥檚 email address may reveal a different email address. Caution: Do not hover over unknown links within the body of a suspect email. Security experts formerly recommended hovering as a way to determine the validity of such links. However, newer strains of malware may infect a computer when the user merely hovers over the link.
• Delete unsolicited emails from unknown sources.
• In the case of an invoice, verify any changes in vendor payment location and confirm requests for transfer of funds.

The post Business Email Compromise/Email Account Compromise – Part 2 appeared first on 星空传媒 星空传媒 Title Insurance Co..

Some warnings are common sense: delete suspicious-looking emails, don鈥檛 give away banking information or social security numbers, never wire anyone money without triple checking 鈥� and then checking again.

We鈥檙e committed to ensuring that all independent agents have every new (and standard) information source available, even as the rules and the threats multiply and expand almost every month.

In this first installment of a multi-part series on Flagging Fraud, we take a look at some of the red flags involving parties to a real estate transaction.

Red Flags

Learn or at least become familiar with red flags that could well indicate something is awry in any real estate transaction.

Some title fraud may be detected by agents before the transaction closes.

Rather than memorize, regularly reviewing this list will help you and all those involved in your transactions be aware of potential fraudulent components:

1. Releases of prior mortgages recorded before or independently of the closing of a new loan with no source of payoff funds.
2. Many recent transactions and/or re-recordings.
3. Recent change in title, especially one without concurrent financing.
4. Releases recorded out of sequence.
5. Sale of property subsequent to or concurrent with a divorce.
6. Quitclaim deeds with no consideration.
7. 鈥淚ntra-family鈥� deeds.
8. Parties to the transaction are affiliated.
9. Document not prepared by an attorney or title company.
10. Document looks non-standard.
11. Power of attorney with Grantee signing as Attorney-in-Fact.
12. Prior signatures indicate failing health or physical deterioration followed by a healthy, strong signature.
13. Bargain purchases鈥攑olicy amount much higher than purchase price.
14. New mortgage amount much higher than purchase price.
15. Property seller is an LLC/entity/corporation.
16. Appraisal looks questionable (e.g. indicates recent sale/listing activity at significantly lower price; comparable sales are previously flipped properties).

The post Flagging Fraud (Part 1): Know These Indicators of Transaction Fraud appeared first on 星空传媒 星空传媒 Title Insurance Co..

A cyberattack is a malicious and deliberate attempt by and individual or an organization to breach the information system of another individual or company, seeking benefit from the disruption, ransom, or theft of data.

This electronic threat is increasing in frequency and complexity and has become very expensive to remediate or to recover from.

Here鈥檚 the surprise 鈥� almost 90 percent of cyberattacks are caused or allowed by human error from the internal staff of the entity attacked.

This includes failure to follow security rules and protocols, sharing passwords, using weak or default settings, and falling victim to social engineering.

Even the large events such as the hacking at Equifax and Target, were caused by failure to follow the rules regarding administrative password settings, human error.

So whether your business is large or small, you need ongoing, strong training and testing to counter the threats.

Recent survey results of a survey of title insurance professionals by the American Land Title Association show a surprisingly small amount of agents are conducting ongoing staff training, and most do it once when they hire an employee.

This is a recipe for eventually becoming a victim of electronic fraud.

There are simple yet effective steps to take to counter the increasing threats by taking a strong defense, and it starts with regular training and testing to remove or reduce the human error element.

Here is what to do to put a training and test plan into action:

• Ensure new hires are introduced to and educated on information and data security policies and procedures as well as how to protect nonpublic personal information (NPI) and sensitive information. Emphasize to them the 鈥渨hy鈥� so they fully understand the shared responsibility nature. This should be a core part of their orientation and on-boarding.
• Set and schedule ongoing training for all employees at every level commensurate with the size of the staff and complexity of your business. This should be monthly, quarterly or semiannually.
• At a minimum, cover controls over access (passwords; pass phrases; multi-factor authentication), network and data distribution (including never using non-secured networks for conducting business such as those in cafes/hotels/airports), phishing and spear-phishing, and never use a general email service like Yahoo or Gmail when sending NPI or sensitive information; social media and social engineering.
• Require security measures for smart devices (smart phones, and in particular Androids, account for a large percentage of data breaches).
• Explain the implications of data loss, which includes reputational hits and potential fines and penalties and law suits.
• Focus on all media forms 鈥� hardcopy as well as electronic 鈥� and include proper handling and protection from receipt through handling to secured destruction.  
• Training may be done with internal documents or you may use a third party to conduct the training (i.e. Data Shield; KnowBe4).
  
• After the training, use a quiz to gauge how well your employees understood the material.
• Develop or use a third party to conduct ongoing, regular internal testing such as phishing or spear phishing testing (i.e. KnowBe4 is one vendor who can provide you this tool). Depending on the results, you may then make appropriate changes and re-focus your training to deal with any weak or weaker topics or areas.
• Provide a single point of contact the employee may turn to with questions or to report any suspected suspicious attempts to obtain information or data (electronic or by phone).
• Keep records of the training and attendees and testing results. This will be needed to demonstrate good faith, to meet many state requirements 鈥� and it鈥檚 a best practice.

Last, keep up-to-date on emerging threats and vulnerabilities and provide updated training to employees to be sure they understand new risks or new controls and why they are important; employees must know how to recognize and report threats to stay vigilant.

This will keep your training and testing current and fresh and serve as a continual reminder to your staff. Remember, this is a marathon, not a sprint. Threats are constantly evolving and your training and testing must also evolve to counter these threats and keep your defense robust.

The post Increased Risk Means We Need to Increase Training appeared first on 星空传媒 星空传媒 Title Insurance Co..