The most common scams around home buying are wire fraud - contact the buyer pretending to be the title company and steal their money. The data in a mortgage is exactly what you need to enable these scams and you're getting people to hand it to you and at the same time tell you they are about to wire money.
back
3 comments
Yep. When we closed on our house we got a whole lecture from the title company about how frequently data breaches lead to wire fraud and to not trust anyone. Mortgage originators are constantly under attack to try to get at the information that OP is asking people to just casually upload.
Their aggressive dismissal of the concern is not a good look.
I am not dismissing the concern, I was stating the tool solves an even larger concern. I'm doing everything I can to setup it up to be secure, private, and worthy of trust and addressing the feedback points.
If you have suggestions more than "don't trust this random internet tool even if it gives you free advice, regardless of the value it offers", please let me know [thanks emoji]
With all due respect, that is the fundamental problem here. Your tool may provide value to your users but uploading mortgage documents to random third parties is de facto dangerous and encouraging users to act irresponsibly.
A great analogy would be a website that asks users to provide their usernames and passwords for sites to see if it’s a strong password or if it’s been compromised. “Sorry, the credentials stouset / hunter2 were found in our database for Hacker News.”
Sure maybe you’re a saint and don’t store or misuse this data. But such a site would in the best case be training users to do a very wrong and dangerous thing. In the worst case you get breached by attackers who do use the collected data to do evil.
> A great analogy would be a website that asks users to provide their usernames and passwords for sites to see if it’s a strong password or if it’s been compromised. “Sorry, the credentials stouset / hunter2 were found in our database for Hacker News.”
This is actually a really good analogy because it does illustrate that it's not a completely crazy ask—people do trust Troy Hunt to run such a site. But OP should be much more understanding of how dangerous the concept is and offer options to resolve concerns (Troy allows downloading the passwords list to check locally), especially while they're not Troy Hunt-level famous and still are trying to build up trust.
Troy's site isn't actually handling the user's real password to check, its doing a lookup of hashes to see if a similar hash is there. The password and final hash checks never leave the client side. Still a lot of trust involved in a site like that, and yeah he encourages you use the API to do the comparisons yourself.
This is actually uploading all the information to the backend and storing it in a database. Like a page that is asking for a service URL, a username, a password, a TOTP secret, sending it all to the server, and having the server check if the credentials have been pwned and saving it all.
On a per individual basis, I think most individuals would prefer to overpay mortgage fees slightly rather than lose the entirety of the money they wire.
Wire Transfers are not undoable and instant, much like Zelle. So I always recommend people send $10 first, and confirm everything works, before sending real money. When doing the confirmation, try using a different channel of communication, to ensure you are getting the right person. i.e. call them directly from known good phone numbers or something.
Yes many banks charge $30 or more for a wire transfer, but I'd rather just pay the $60 than have a large sum wire transfer lost, stolen, etc.
Some banks/Brokerages are sane and do not charge extra for wire transfers. Fidelity is one such. BOA also(if you have enough assets there, $100k will do it).
Is it too paranoid that even for first time Zelle (with people I know in real life) I send a $ and ask them to see if they received it, before sending anything else?
100% not paranoid. I do this for basically all payments.
I do / did this between my own bank accounts when entering details the first time.
I have never done a wire transfer at a residential closing. I come to the closing at the title company office with a cashier's check from my bank for the amount they told me to bring.
Did you bought enough houses to assume that's always the case?
My experience was that I was told to send the cashier's check using overnight FedEx because they did not have office in my area.
No, fair enough. I would not close anywhere other than a local title company though. I've had a few odd things surface at the last minute that were resolvable because everyone was sitting around the same table.
Cashier's check was only accepted for amounts less than $10k at our closing by our title company. This seems common to require wire. The title company contracted with a 3rd party escrow service so the money was required into the title company's account at the escrow service. I assume a cashier's check would need to be mailed to the escrow company
3rd party. ROFLMAO.
The only method available to me at closing was a wire transfer. It is dumb.