REALTOR’s all over Arizona have changed their business models to pursue short sale. It makes sense as up to 65% of all the sales that take place in Maricopa County are distressed sales (short sale or foreclosure).
As a Realtor you are most likely concerned with identifying short sale candidates, marketing and contacting them, finding a buyer and ultimately negotiating a successful short sale. In order to approach the bank with a short sale there are certain things that most agents will collect : pay stubs, tax returns, social security numbers just to name a few.
According to Don Doerr and Doug Farnham of Thomson Conant’s Mortgage Mediation Group, there are compliance regulations that now apply to you and your business as a result of collecting financial information to short sell a property. I was not aware of this either, which is why we chose to make episode 3 of the “BS” Show: “Short Sale and The Security Nightmare” .
Most loan originators are aware of the rules associated with accepting sensitive client information. They do it on a daily basis. Most real estate professionals, however, have not had to deal with compliance regulation and processes such as DSS (Data Security Standard), DLP (Data Loss Prevention) and ILM (Information Lifecycle Management). These are more than just fancy terms. These processes apply to anyone that has access to client information, for how long, how data is stored and disposed of, and requires you to show logs and security measures to establish compliance.
Arizona is in the top 5 states for identity theft. According to Don and Doug, If ID theft is linked back to a leak at your company, you will be required to demonstrate how you have followed all required regulations. You will also need to produce policies and procedures, document and logs to show that regulations were followed. Before you tell yourself this could never happen at your business, think about this; cyber crime is growing at record pace and becoming more sophisticated each day. Even the largest companies with the biggest security budgets have been infiltrated. Although the economic return from hacking your computer may be small by comparison, your computer is an easy target. A hacker will always go after the low-hanging fruit first.
There is no way to guarantee your computer or office has not, or will not be compromised. Compliance is about minimizing that risk and being able to show that you did your due diligence to secure the data in the event of a breach.
Some things to consider even if you don’t store client information on your computer:
- Email is not secure.
- Do not accept information by email.
- Additionally, if your email syncs to your phone you have just extended the endpoints of your data network as these devices should be encrypted.
- It is possible to have data stolen from your phone through a blue tooth connection without your knowledge and of course there is always the possibility of losing your phone.
Chat (messaging) programs are also not secure, they store a chat log on your computer, and are a common method hackers use to gain access to, or upload malware to your computer that will monitor your activity.
Many lenders require information be entered into an online system (i.e. Equator). If your computer is compromised this data could be captured by hackers and sold to the highest bidder.
Required Regulations:
Don and Doug remind us “there are many regulations that apply when you start accepting sensitive client data. Most of these contain overlapping requirements. For many companies, following the PCI (Payment Card Industry) requirements covers the minimum requirements for many other regulations. Even if you do not accept or process credit cards, PCI is a well accepted standard and is very clear in its definitions. It is also well supported by numerous software programs for testing and report generation. As an alternative to PCI, ISO27001 is becoming an accepted standard. Because the data collected by a client relate to mortgage origination there are parts of SOX (Sarbanes Oxley) and GLBA (Gramm-Leach-Bliley Act) that could apply. But these last two are not as well defined as PCI or ISO27001 and are somewhat vague as to DSS requirements. FISMA is a government standard released by NIST (National Institute of Standards and Technology) that seems to have some teeth as far as enforcement and penalties.”
You are responsible for the security of the data you receive from a client, even if you have a third party handle the negotiations and processing. It is imperative that you confirm that any software you use to process or any third party used to process this data meet these requirements.
For more information about Data collection and how you can protect your clients and yourself, please contact
Don Doerr
Director, Mortgage Mediation Group
602.774.3757
ddoerr@tcmmg.com
www.MortgageMediationGroup.com
or
Doug Farnham
Thomson Conant
602.326.6552
dfarnham@tcmmg.com
Here are some links to help you with tracking and compliance:
PCI (Payment Card Industry) Compliance
Policies and Procedures Template for PCI
GLBA (Gramm-Leach-Bliley Act)
FISMA
ISO27001
MA201
MediationNet (Short sale software for attorneys and processors.)



















