As part of this scam, social engineers have been sending emails to professionals in the real estate industry that display the name of a legitimate contact, but are sent from an email address other than the contact's. These emails are usually urgent in nature and ask you to click a link, download a file, text a number or take some other action.

You can identify these emails by hovering your mouse cursor over the name that the email is shown as coming from. On a mobile device, tap the name. This will show the address that the email actually came from. It should match the name you hovered over. One such email we were made aware of looked like it came from Alan Tennant, CREB^® President and CEO, but actually came from an illegitimate Gmail account.

“Social engineers are always looking for new ways to execute scams. They combine the use of technology with emotional messaging that expresses a sense of urgency and pressure to act fast in order to manipulate potential victims,” says Douglas Carr, IT Manager at CREB^®.

“We understand that connection and authority triggers trust and that trust triggers action. This can cloud our judgement. If you see a suspicious message, please slow down to verify that it’s the right email or account. When in doubt, reach out to the person the emails are claiming to be from through another communication channel before responding.”

How to protect yourself:

• When you get an email, corroborate that the email address is correct. If in doubt, reach out to the person who contacted you through another communication channel.

• Be cautious of unexpected email invitations with suspicious links, especially if they express a sense of urgency regarding a request.

• Report any suspicious messages, emails or links to the person in your brokerage who manages the email system.

If you clicked on a suspicious link:

• Stop using the device and disconnect it from the internet.

• Do not enter any login credentials. If you have attempted to log in on a malicious site, immediately change your password on the impersonated site and any other sites where you may use the same username and password.

• Contact your IT support technician.

As we work on keeping our members informed about new cyber security risks, we encourage you to stay vigilant and report any similar incidents to support@creb.ca.