REI INK

Risk Management

Risk Mitigation Isn’t Just For “Risk Managers”

Risk mitigation starts with originations, continues through relationship management and lending, and merely “plays out” if a loan starts going sideways. By then it can be too late … It’s often been said, “The time between economic recessions in the United States is like a baseball game, one inning for each year.” Whether you agree or not, it’s hard to argue the current economic recovery has gone into “extra innings” since the Great Recession technically ended in late 2009. That said, despite not just one but two yield curve inversions in 2019 (the classic “canary in the coal mine” for an impending recession), there are many key barometers indicating that the next recession—even if it’s just over the horizon—is not imminent. We continue to enjoy record low unemployment, positive wage and GDP growth, generally modest inflation (occasional spikes driven mostly by higher energy costs), strong housing demand and a record stock market. So why should we be more vigilant than ever about managing and mitigating risk? Shouldn’t we all be making hay while the sun shines? Yes, the last 10 years have been great for real estate investors—possibly the best ever. This, in turn, has attracted a lot of smart, innovative capital and new, tech-driven ways of delivering it, making this very much a “borrower’s market” today. The space has also witnessed a lot of new “efficiencies” that make underwriting, funding and servicing loans easier and more “customer friendly” than ever before. As a result, borrowers—especially those with experience, strong net worth and liquidity—enjoy a variety of attractive, convenient financing options. The problem is, it’s getting harder to find good deals with viable exit strategies. And no matter how efficient capital markets have become (we’ve already seen several unrated securitizations for REI loans in recent years), demand—and therefore loan liquidity—will always outpace the supply of quality deal flow. The U.S. housing shortage, driven by historically low interest rates coupled with a limited and therefore rising labor and material costs, has been well-publicized. Despite this, other than large “build-to-rent” master-planned communities and other portfolio or “consolidating” transactions, investors and lenders are naturally compelled to take more risk just to generate the same or even lower returns. All that indicates we’re in a market at or near its peak. The challenges investors face finding good deals combined with an abundance of aggressive (or, shall we say “less than acceptably risk-adjusted”) borrowing options is creating a perfect storm of narrowly profitable deals using higher leverage. All this is a recipe for “significant near-term dislocation.” Risk and reward will always find a way to rebalance, sometimes painfully so. Risk management (i.e., evaluating and forecasting risk) and developing tactics and strategies to mitigate risk must be everyone’s responsibility. Now more than ever, an ideal risk management culture starts further upstream during general marketing and originations and merely continues through underwriting and the end of the loan lifecycle. Marketing Actively manage solicitations and marketing/advertising (human, digital and everything in between) toward the most desirable regions, products or borrower types based on your long-term credit risk strategy. Do not focus on the highest potential immediate volume, lest you’re left “holding the bag” when the music stops. For example, if you want seasoned borrowers, don’t troll through “expert forums” and platforms where new(er) or lesser experienced investors are more prevalent. Make it clear you value client experience and financial wherewithal., Discourage riskier, less seasoned leads. This sounds easier than it is, for the lure of volume and what appear to be attractive gross yields often result in adverse selection—this is a time-tested truism. Originations Despite all that hard work generating new leads, don’t become so committed to “closing the deal” that you avoid red flags or spend too much time trying to fit the proverbial square peg into the round hole. If a deal doesn’t work (i.e., a borrower clearly isn’t qualified, property values look questionable or debt serviceability and recoverability/exit look challenging), it’s better to give a quick “no.” In that case, either introduce them to another suitable borrower or decline the opportunity outright.  Encourage them to keep looking for a better deal and to come back next time. No one likes to waste time and, rest assured, your erstwhile borrower will appreciate your candor and refer you to others who may be a better fit. Being thoughtful and direct “pays it forward” in numerous ways. Underwriting Stick to your underwriting standards. Don’t find ways to bend criteria or make exceptions just because you can sell them to your credit committee or financing partners. For example, if you’re traditionally a fix-and-flip lender who lends up to 90% of cost (or 75% of after-repair value) to borrowers with at least three successful transactions at 12% and 2 points, stick with that and focus on delivering a superior, consistent customer experience. Be responsive and collaborative, suggesting ways borrowers can become more profitable, better project managers or more efficient builders. Really dig into construction budgets to help ensure projects are viable and you are not otherwise funding into a default. Treat the borrower’s precious resources as if they are your own, and help position them for mutual success, even if that means less leverage or occasionally passing on an opportunity. All of this mitigates risk in the long run. Servicing Don’t give borrowers a reason—legitimate or not!—to blame you for projects going sideways. Poor loan servicing can often create an unrecoverable downward momentum that will only increase the risk of loss, let alone profits. Rather, help borrowers by promptly responding to requests or funding draws or simply “working with them” as unforeseen circumstances arise. Don’t burden them with artificial constraints (e.g., sticking to hard-and-fast construction completion dates even in the face of unexpected but understandable delays such as bad contractors and permitting challenges) when sensible flexibility can yield a much better outcome for everyone. Put differently, don’t be a source of frustration for good, honest, proactive borrowers working hard to harvest their investments and pay you back … they’ve

Read More

Raising Receivables Recovery

FCO’s 10 debt collection best practices for rental property managers Even in today’s healthy economy, the residential rent receivables that are written off as uncollectible remain at high levels. According to the National Apartment Association’s 2019 Income and Expense Survey, rents and damages sent for collections range from $79  to $103 per unit per year—or 0.5%-0.8% of Gross Potential Rent, depending on property type. Renters’ debt disputes are more complex and frequent compared to a decade ago. Savvy ex-residents rely on the Fair Debt Collection Practices Act (FDCPA) and Fair Credit Reporting Act (FCRA) to ask for evidence of the debt and to dispute the amounts owed. Consumer attorneys and credit repair organizations increasingly deploy technology to supercharge FDCPA and FCRA challenges to property managers’ debt claims. The Consumer Financial Protection Bureau (CFPB) provides a new avenue—and ally—for debtors to complain about lease charges. And, call-blocking technology enables consumers to duck debt-related contacts. To fend off these challenges, a well-tuned collaboration between a third-party collection agency and a property manager is essential to maximizing recovery of what is owed  and minimizing litigation risk. Liquidation recovery and litigation exposure can improve by a factor of six to 10 times between well-run property management firms and those with lax operations. Here are 10 collections best practices to help rental property managers increase recovery and reduce avoidable risks. 01 Integrate Integrating the placement of accounting detail and documents from client property management software(s) to agency regularly increases the number of opened accounts, speeds time to placement and reduces inaccuracy and incompleteness. All three factors contribute to better compliance and higher recovery. 02 Provide documentation at placement to support the balance sought Be sure to have a signed lease and application, identification of the debtor, final account statement itemizing charges, repair invoices to support claimed damages and move-in/move-out inspection reports and photos. The latter documentation is easiest to obtain right after moveout. 03 Meet with the resident at move-out to review charges A move-out review of the condition of the property and itemization of charges in the final account statement provided to the ex-tenant can ease sub-sequent recovery of unpaid balances. Of course, this isn’t always possible. If the tenant skips out, ensure that the final account statement is sent to the tenant’s provided address to give adequate notice for payment before placing the account in collections. Finally, consider a “handoff letter” to the debtor, making them aware their account is being placed in collections. 04 Damages demand documentation As a rule of thumb, the documentation a property manager must provide under state security deposit law in order to withhold from a security deposit (e.g., repair invoices) should also be available to support the damages in a debt claim. Generally, damages owed must be more than normal wear and tear. 05 Follow the lease For tenants who exit before the lease is up, ensure that the date of re-renting is included with the placement if the lease allows to charge for unpaid rent until the unit is re-rented. Where a liquidated damages provision is applied, make sure the property manager is not also charging actual damages at the same time when the lease provides for only one method at a time. 06 Operators’ charge-off policies matter  Is the property operator charging for full flooring cost replacement for a short-term tenant who moved into a property with aged carpet and tile? Are additional charges for HOA-required fees added at move-out, but not clearly specified in writing at move-in? These practices may well be challenged. Instead, consider prorating as appropriate, and make sure that fees to be charged are identified—in writing at the beginning of the lease—as a tenant responsibility. 07 Ensure tenant authorizations are broad enough A well-tuned application or rental agreement makes clear that the landlord has permissible purpose under the FCRA to pull consumer reports for lease-related purposes that include both collections and move-in tenant screening. Good leases also make clear that the tenant agrees to accept email, mobile and text communications and to update provided contacts. These authorizations become more important under proposed new FDCPA rules for debtor communications. 08 After placement, let the agency handle it Communications with ex-tenants and guarantors who are represented by counsel can be a problem. Where a property learns a debtor is represented by counsel, communicate this to the agency. Forward the agency the attorney’s letter of representation, if one has been provided, along with any attorney inquiries. Another area of concern is credit repair organizations, which take a fee from debtors to clean up their file. They may ask an unwitting property manager to delete credit reporting in exchange for settling the debt. Forward these communications to the agency to resolve as well. 09 Go legal selectively If you want to pursue garnishment or other legal action (where permitted by law) to secure what’s owed, make sure the debtor’s ability to pay and the amount owed are large enough to sustain court costs and delays. Also, be prepared for affidavits to sign and witnesses to send. Courts may ask the maintenance tech who walked the unit at moveout, for example, to appear to testify. 10 Respond promptly when asked A consumer’s dispute may be subject to tight response timelines by the collection agency and property manager, especially where a credit bureau is involved. Often, the agency needs only a property manager’s verification of the amount owed, or the confirmation of a prior resident’s identity. Sometimes this request may come a year or two after moveout, when the ex-resident is back on their feet and wants to make good on her obligations. Prompt client responses to these agency requests speed resolution and improve recovery. The road ahead? Technology will continue to be both sword and shield in rental collections; that is, it will create new paths for consumer challenges, but ease document transfer through no-cost collection agency integrations. Well-run rental operators in clear dialogue with their collection agency can optimize debt recovery and limit litigation

Read More

Automating Your Way to Fewer Renters Insurance Risks

Here’s what property managers must know to reduce the hidden risks in renters insurance platforms. Many property managers use fully automated renters insurance platforms. These solutions are efficient and effective. They deliver bottomline benefits to both property managers and residents. Most important, they help ensure 100% coverage of all leaseholders, 100% of the time. When implemented properly, a fully automated program eliminates time-consuming manual tasks for property managers and gives residents access to top-quality renters insurance. But there are several lesser-known factors to consider to ensure that property, residents and the business are each adequately protected. The following scenarios illustrate common real-world issues that, if not addressed, can prove costly. Scenario #1: Mind the Gaps After a grease fire damages two units and the hallway, the property manager verifies on the community’s internal system that the unit leaseholder carried renters insurance with adequate liability coverage. But, when the property manager files a claim, the insurance company says the renters insurance had lapsed a week before the fire. That doesn’t make sense. The property management company worked with a preferred insurance provider and had a gap insurance policy in place as well as third-party tracking to prevent this from happening. Unfortunately, the property manager learned—too late—that policy cancellation notifications can take 10 days or longer to travel through third-party tracking and to the community where the information is manually entered into the internal system. Unaware of the lapse, the property management company hadn’t added the unit to its gap insurance policy and was forced to pay for the repairs. Though the property management company sued the leaseholder for damages, it was unable to recoup the losses. What this property manager didn’t realize is that there are hidden cracks in most liability insurance tracking systems that leave property management companies vulnerable and exposed. Slow communication is just one of those cracks. The following scenario represents another. A resident accidentally leaves the bathtub water running to answer a phone call. The overflowing water seeps into the walls and drips through the floor into the apartment below, causing significant damage to both units and the first-floor tenant’s laptop. Internal records confirm the unit was covered for liability; however, the covered leaseholder was out of town when the incident happened. Although both leaseholders presented insurance verification at move-in, the leaseholder who left the water running canceled her policy after one month. Because the tracking system the community used tracked by unit rather than by leaseholder, the property management company was unaware of the policy cancellation. Once again, the property management company had to cover the cost of repairs. The first-floor unit leaseholder was able to file a claim with his renters insurance company to pay for the damaged laptop, and that insurance company’s subrogation department sued the property management company to recoup its losses. Most property management companies track coverage by unit rather than by individual leaseholder. A look at a map of the units may show 100% coverage when actual coverage is far less. As one property manager interviewed put it, “If my property had 100% coverage, I don’t even know what that would look like. I would be free to focus on other things like claims incidents and sales.” Scenario #2:  The Devil Is in the Details A leaseholder’s party gets out of hand, and one of the guests tosses a beer bottle from the balcony, hitting a passerby below. A witness calls 911, and the passerby is taken to the emergency room for medical treatment. Though the leaseholder had carried the required insurance, she failed to add the community to the policy as an interested party. When her credit card expired, the insurance company canceled the renters insurance. But because the community was not listed on the policy, third-party tracking was unable to notify the community. Once again, the property management company was left to pay the medical costs of the injured passerby, who later sued the property management company for pain and suffering as well as lost wages. According to one risk management director interviewed, “We have no way to cover gaps in insurance coverage if they don’t add us as an additional interested party. We’re not added on renewals about 45% of the time.” Scenario #3:  To Err Is Human Jill manually performs a weekly check to match insurance cancellations against the community rent roll, adding canceled units to the gap insurance policy and notifying leaseholders they will be charged a noncompliance fee until they provide proof of coverage. When Jill leaves, a new employee takes over the process but fails to follow through with the next step—adding the units to the gap insurance plan. When something happens in one of the units with lapsed coverage, the property management company is left without coverage. Unfortunately, any process that relies on people to perform one or more steps quickly and accurately is almost certain to fail at some point. An automated solution can eliminate that problem. And with the right automated solution, a property management company can avoid most coverage lapse problems. The Ideal Automated System To protect against the previous scenarios, an automated renters insurance tracking system should provide the following: Verification that the community is listed as an interested party on each leaseholder’s renters insurance policy Tracking of insurance coverage by individual leaseholder rather than by unit Third-party tracking and landlord protection with an automatic endorsement that adds the unit to a gap insurance coverage policy on the date the policy lapses, eliminating lag times and the need for human intervention in the process Before signing up with a preferred renters insurance program that offers third-party tracking, be sure to ask questions about each  of these points: 1) How do you verify that each new policy includes our community as an interested party? 2) Does your third-party tracking system track and record all changes and coverages, and not just the cancellations? 3) Does your policy provide coverage by unit or by individual leaseholder? 4) Do you automatically and

Read More

Tips for Controlling Your Insurance Costs in 2020

Following the trends of 2017 and 2018 (which saw five of the 15 costliest catastrophes in history), 2019 continued to see property and liability rates rise—and more stringent underwriting requirements. Some insurers’ once-strong appetites for risk in the habitational insurance market are waning. Investors with properties in catastrophe-prone areas are likely to continue to feel rate pressure into 2020, particularly those in areas susceptible to windstorms, flooding and fire. So, how do you control your insurance costs without jeopardizing coverage? If you experience increases in your property rates or are just looking for ways to maximize the ROI of your property portfolio, consider some of the following ways to control your insurance costs: Shop Around Shop your rates with multiple carriers. Work with an independent agent that is contracted with several carriers and programs and who understands your unique needs as an investor. This allows your property to be considered by several different carriers that may have a very different approach to the risk in question. Carefully review the differences between the cost options presented to you, as cheaper is not always better. Know what is and is not covered and what you are giving up for a lower rate. Never jeopardize coverage and peace of mind to save a few bucks. Be sure you know what type of loss settlement method you will be subject to in the event of a loss—replacement cost or actual cash value. Replacement cost can mean a 20% to 25% higher rate, but it gives you the opportunity to recover depreciation. Consider your plan for the property in the event of a total loss. If you would choose not to rebuild, you would be overpaying with replacement cost coverage. Just be sure you are adhering to any requirements from your lending institution. Deductibles Consider a higher deductible. Have you ever considered your deductible to be self-insurance? That’s exactly what it is, and the more you self-insure, the lower your insurance rate. Increasing your property deductible from $1,000 to $5,000 could save you as much as 25%. For a good gauge on the deductible you may be comfortable with, consider the minimum claim you would turn in, then double it. Look also at opportunities to increase the deductible on certain perils, such as wind/hail or water damage, especially if you have past claims for these types of losses. Carefully consider what claims you file. A property claim (regardless of size) can increase your premium for as much as five years following a loss. This means you may pay more in increased premiums over time than you would by just paying out-of-pocket for a $500 or $1,000 loss. Mitigate Losses Make your property more resistant to a loss. By properly managing your investment properties, you may be able to avoid preventable losses and demonstrate to your insurer that you are serious about risk management. Many carriers will provide credits on their rates for working hardwired smoke detectors, central station burglar alarms and sprinkler systems. Install carbon monoxide detectors and fire extinguishers. Upgrade old electrical systems, furnace and HVACs. Be sure that you or your property manager regularly visit the property to perform routine inspections and maintenance. Provide your agent with as much ammunition as you can to assist in reducing costs. Renters Insurance Require all tenants to carry renters insurance. Many rental property owners have a clause in their lease requiring the tenant to carry renters insurance. While this is a plus for your tenant, it also helps you save money in the long run. Tenants do negligent things. Having a renters policy in force allows a tenant-caused loss to  be paid for by the insurance company representing the negligent party. This will assist in stabilizing your property rates long-term. Don’t Cut Corners Although property damage represents more controllable or “known” expenses, do not skimp on liability coverage, where potential losses are unknown. Carry as much as you can afford with a minimum of $1,000,000 per occurrence and $2,000,000 aggregate annually. Lower limits save little money and can leave you and your business dangerously exposed in the event of a serious liability suit. If your policy has co-insurance, don’t be tempted to insure your property to a lower value to save on the premium. This can come back to bite you in a loss. Additional Coverages Cyber crimes like social engineering, hacking and wire fraud increasingly target small and midsize businesses. As a landlord, property manager or lender, you are exposed to cyber risk every time you send or receive an email, collect rent online, use an online tenant screening tool or engage in nearly any cyber activity. Cyber insurance can provide coverage for the cost to respond and recover from a data breach, including business interruption. Following the 9/11 attacks, insurers increasingly began excluding acts  of terrorism from a standard commercial insurance policy. Many are  now offering this coverage as a standalone policy, primarily for property damage and business interruption. If you own many properties in a concentrated geographic area, terrorism coverage may be a consideration  for you. Depending on the location of your rental properties, consider additional endorsements for excluded natural disasters. Flooding is the No. 1 natural disaster risk in the United States—and the risk is increasing. Earthquakes and sinkholes are also excluded perils you may consider getting a separate policy for, though that coverage is not always available in all states. Now is the time to work with your agent and take all necessary measures you can to control your insurance costs. Do not wait until your renewal is a few days out, and you are blindsided with a large increase in premium and no time to shop.

Read More

Am I Covered or Not?

Make sure you understand what you’re buying and what it covers. If I pay an insurance premium, does that mean I’ll get paid if something goes wrong? That question is difficult for the average insurance agent as well as the typical insurance consumer  to answer. Understanding some insurance basics—such as covered loss, exclusions, underwriting and the difference between a bond and insurance—will help with the answer. Bond Versus Insurance Most consumers do not understand the difference between buying a bond and paying an insurance premium. The textbook definition of insurance is transferring the risk from the consumer to the insurance company, also known as the carrier. In the case of true insurance, the consumer is out only the premium and possibly a deductible. The carrier will pay the limit of the loss if the loss was a named peril in the policy. The easiest way to explain this is to use life insurance as an example. If you paid the premium and the policy is in force when you die, your beneficiary gets paid. Yes, in the case of life insurance, the named peril, pure and simple, is death!  Personal (your auto and home) and commercial (business, builder’s risk, E&O) coverage works the same way: You pay a premium and the carrier pays for covered losses if the loss was caused by a named peril. A named peril could be collision, fire, theft, flood, etc. Bonds do not work in the same way. Bonds are not a transfer of risk. After the purchaser buys a bond by paying the bond premium, the purchaser could be out way more than the premium that was paid. Bonds guarantee a payment of an obligation of the purchaser. However, the bonding company will seek reimbursement. To illustrate this concept, consider a bail bondsman. Let’s say you party too much and get arrested. The judge sets your bail at a million dollars. You have $1 million in home equity, so a bail bondsman pays about 10% of the $1 million to guarantee that you will show up for trial. When you skip out on your court date, the bail bondsman takes your equity. That is a pretty steep price to pay. In the real estate world, performance bonds might be used to guarantee work. By now, you can imagine that someone will go after that contractor’s other assets  to get paid back if the performance is below the contracted requirements. Covered Loss Before going any further, let’s be clear: insurance is never used for speculation. Losses in the insurance world are measurable and accidental in nature. If there is a 100% certainty that something bad will happen, it is uninsurable. So, what does insurance cover? Named perils, like theft, fire, flood, etc. A covered loss is simply a loss covered by a named peril. Both commercial and personal policies state named perils. There is not one policy covering all known perils like fire, theft, flood and wind. Typically, a homeowner’s policy covers fire and storm damage; however, those policies exclude wind, flood damage and earth movement, also known as earthquake coverage. If you live in California, consider buying a separate flood and earthquake policy if you have lots of equity in your property. Likewise, if you own mortgaged property in Florida you must have a wind policy for the next hurricane and possibly a flood policy. Here’s why. Remember Hurricane Sandy? Coney Island was hit hard. Some people bought wind policies. When their roof tops were blown off, that loss was covered in the wind policy. What the residents did not expect was the storm surge that washed over the top of their walls and swept away their home and belongings. Only a flood policy covers mud slides and any water movement above the ground surface. Exclusions and Underwriting Combining exclusions and underwriting is easy. Lenders underwrite loans. Insurance agents and brokers underwrite risks. To properly underwrite insurance, the agent/broker should require you to disclose any material information about your business. Often an insurance company will deny a claim because the applicant or agent never disclosed the information to the company. If the applicant overdiscloses everything about the property/business, that is not necessarily a bad thing. The underwriting file  will be provided to the carrier. Here are the  possible outcomes: An issue disclosed to the insurance carrier is listed as an exclusion and not covered. The issue is covered by an endorsement/rider (a modification to the base policy) and possibly subject to additional premium. The carrier assumes the risk based on everything in the underwriting file. Basically, knowledge and information are power. Insurance is an actuarial science and has never been “rocket science.” The truth is in the numbers. Consumers, agents/brokers and carriers should all follow the rules of proper disclosure. The best advice: Buy the best insurance you can afford and hope to never use it!

Read More

Cyberattacks: The Quiet ROI Killer

Tips for minimizing risk in today’s digitally reliant world By Zach Fuller Market shifts, tenant issues, lawsuits and maintenance expenses are risks we think about and plan for regularly in our investment endeavors. Proper planning and safeguards help you keep the returns you’ve built, both in your business and investment portfolio. However, there is a “ROI killer” that happens quicker, hits harder and is more elusive than perhaps any of the others—a cyberattack. We hear about cyberattacks on Fortune 500 companies almost daily, leading many people to believe that big brands are the primary targets. But, most people do not realize that for every breach mentioned on the news, there are thousands more that go unannounced around the U.S. Victims range from mortgage companies to venture capital groups and, yes, even technology service providers. Small Targets, Big Payoffs The real estate industry is made up primarily of smaller organizations without significant IT budgets and rarely with an in-house cybersecurity team. As a result, these companies are easy targets for cybercriminals. Whether you have a personal portfolio of properties, are a regionally recognized title company, or are a nationwide lender, you are the perfect target for financially motivated cybercrime organizations around the world. You may ask, “Why would they want to come after me?” The answer is simple: You deal with sizable assets, are involved in complex transactions and rely on some level of trust in other parties to run your business. Most of all, technology is a required part of your daily operations. Cyberattacks are financially motivated and often successful in extracting significant amounts of money from the victim. For the individual investor, an attack may be escrow funds unknowingly transferred to an account controlled by a criminal rather than the escrow account. For the title company or lender, attacks can range from theft of large amounts of personal and financial records, to stopping business operations in their tracks until a large fee is paid to the attacker. Reduce Your Risk Knowing that most cybercriminals are financially motivated and looking for the quickest income, you can follow simple practices to make yourself and your company a harder target than others. When the cybercriminal’s potential gain is less than the resources required to achieve it, they move on to easier targets. Here are a few ways to reduce risk: For Companies  (title, lenders, PE  firms, retirement plan custodians, etc.) Align to a standardized cybersecurity framework such as NIST SP 800-151 or CIS Controls. Build a culture of  security, starting with leadership support. Deliver staff awareness  training quarterly. KnowBe4 is a great  platform for this. Conduct annual risk assessments and  penetration tests on critical systems. Ensure you have a complete set of IT and security documentation. These include documents such as an Incident Response Plan, password policy, acceptable use policy, bring your own device (BYOD) policy, etc. Carry cyber insurance. Although a reactive measure, cyber insurance is inexpensive and likely to be used. For individuals Have situational awareness. If a request doesn’t feel right, pick up the phone and make a call to verify. Just because an email appears to come from someone you know, it doesn’t mean it is legitimate. Use two-factor authentication. Use an authenticator application (e.g., Google Authenticator) when possible, instead of a pass code being sent via text message. Set up critical accounts with a separate and private email address rather than your daily business or personal account. Keep all software and firmware updated on your computer and network. Ensure your home and office router default usernames and passwords are changed, both for Wi-Fi and router administration. Use a virtual private network (VPN) service when working from any public Wi-Fi. Use hard passwords with a minimum of 12 characters and no common words (password managers are great for this). Implement lock screens on all devices and remote wipe capability on mobile devices. Back up your files regularly, encrypt the backups (there are many tools available for this online), and then “unplug” until next backup. Ensure your vendors (title companies, etc.) are following accepted security practices to reduce the chance of your own information being compromised in their breach (security questionnaires are available online). Dark Clouds There is a dangerous myth that has caused many cyberattacks among smaller organizations. This is the myth that cloud-based services will keep you secure. From Google G-Suite and Office 365, to Salesforce and Dropbox, we all use cloud-based services to support at least portions of our business operations. Using the “cloud” absolutely makes sense for most small-midsize businesses. It provides tremendous capabilities while reducing the required investment in IT infrastructure. However, even the services with the most sophisticated security measures can be compromised if users don’t configure their accounts properly. For example, recently an investment group experienced significant losses after an executive’s primary email account was hacked. This account was used for everyday communication, so it was publicly known. It was also used to register the company’s domain name, for cryptocurrency accounts and to access the cloud-based storage containing information about all the company’s high-net worth investors. The attackers were able to hijack the domain name, taking company communications offline (email accounts and website), steal cryptocurrency accounts and compromise the security of the investors by accessing their sensitive data. Trust is vital in the investment business. One can only imagine what a  company’s investors must feel when the company seems to have disappeared digitally. Suddenly, investors can’t reach their point of contact and the company website is down. To make it worse, the investors get notified that their personal information and even bank account numbers are now in the hands of criminals. Sometimes this notification comes from the  criminals themselves as  a form of extortion. Situations like these show how critical proactive cybersecurity is for organizations of all sizes  in today’s technology-reliant environment. Whether you take proactive measures yourself or hire professionals to protect your company, cybersecurity is a requirement of doing business. There are already enough variables and risks in the

Read More