WASHINGTON — Nonprime mortgage executives recently listened to the FBI, a fraud mitigation firm and one of their peers talk about mortgage fraud and how to reduce it.
Speaking at last week’s Mortgage Bankers’ Association Non-Prime Lending and Alternative Products Conference, Jackie Dreyer, managing director for training and education for a fraud mitigation firm, told the audience that a national conforming lender recently told her that it has seen mortgage fraud cases quadruple in the past mortgage six months. Dreyer said that while mortgage fraud causes losses to all segments of the industry, it is of particular concern to the nonprime sector because of vulnerability to “reputational damage” if nonprime borrowers fall prey to fraudsters that nonprime lenders fall to detect.
“Chunking,” “flipping,” downpayment assistance and foreclosure bailout scams are typical, she said.
Dreyer said the top markets for mortgage fraud in 2005 were Atlanta, Detroit, Chicago, Houston, Dallas and Miami. The top markets for fraud in for the first quarter of 2006 are Los Angeles, Atlanta, Orlando and San Francisco.
While there is no federal mortgage fraud law, she said Georgia has passed a mortgage fraud act that makes it illegal to lie in any way about mortgage transactions and that there are pending laws in New Jersey, Utah, Colorado and Oklahoma.
On the federal front, Sen. Barack Obama introduced in February 2006 the first proposed federal mortgage fraud bill. The bill is presently on hold because of the short legislation session and because other issues, such as immigration reform, garnered Congress’ attention. MBA will work with Obama to re-introduce the bill, she said.
Dreyer said her company has found a 70 percent decrease in claims by lenders who have been properly trained. Employees should know how to read a HUD-1 settlement statement, a title commitment and other loan documents to spot fraud because technological fraud fighting tools can not pick up fraudulent data on the forms.
Marc Loewenthal, senior vice president for corporate affairs, New Century Financial Corp., offered a best practices for attendees to follow in dealing with data breaches of customer information. The mortgage industry should not be complacent, he cautioned.
Loewenthal said mortgage companies have been a particular focus of the Federal Trade Commission and that the FTC has taken aggressive action in this area. One company, he said, was put under a 20-year consent order by the federal agency.
He suggested that companies examine the internal processes and procedures involved in their information security practices. How do you assess for risk? What are the weaknesses within your own normal course of conduct and how do you fix them? These are the questions that companies have to ask to determine their risk indicators, he said.
Companies also need a comprehensive scheme of monitoring and oversight, he said. Incidence response plans should be implemented. Put together a team that responds quickly to data breaches in order to get a handle on the nature of the breach, he suggested. Identify who you have to talk to when a data breach occurs, he said. Put procedures into place to determine how data is transitioned within the organization. He also suggested that companies formulate a business resumption plan or recovery plan.
He recommended that companies establish a compliance mechanism to deal with the applicable laws and regulations.
The same oversight applies to lenders, he said, cautioning that companies that outsource need to have in place the same policies and procedures. “You have to know where the weaknesses are in terms of your outside vendors,” he said. Maintain control over the data, he said, even when dealing with companies located overseas.
An information classification policy is necessary to identify the type of information in existence within the company. This means that someone in the company must know what information is public, what is internal, what is confidential, what is top secret and who has access to the various types of information and where it can go within the organization, he said.
Physical security is very important, he said. Security guards, surveillance, visitor policies requiring sign-ins and badges and making sure that doors to server rooms are closed are recommended. In fact, he said, such requirements are more and more being covered by state laws. For example, California has its own separate laws governing physical security of data.
Loewenthal also said that training employees is important as is the use of extensive background checks. Separation of duties for employees that have access to sensitive information is also recommended. Have a good disciplinary process, he said. “A public hanging is not necessarily a bad thing when it comes to this area. It sets an example,” he said.
He also suggested that companies establish an internal hotline so that workers can call in when they are aware of problems.
FBI Supervisory Special Agent Ronda Heilig, the federal agency’s program manager for mortgage fraud, said the FBI is in the process of gathering information on mortgage fraud.
The agency will soon be reviewing secondary market data from Fannie Mae, and Freddie Mac, she said. In addition, financial laundering suspicious activity reports that will cover mortgage lenders will be provided to the FBI. She noted the FBI is working on a public awareness initiative and developing a database for use in tracking identity theft and mortgage fraud and
Heilig has assigned an intelligence analyst to do a tactical assessment of mortgage fraud looking at how it occurs in certain areas and what types of schemes are prevalent in certain areas and to report back to her. The agent noted she will use the information to determine how to deploy the FBI’s resources. But she noted that there must be a $100,000 minimum actual loss for the federal agency to get involved.
