Warning: In a Pandemic, Real Estate Companies Are Particularly Vulnerable to Fraud

As a result of the pandemic, real estate executives have been dealing with many issues at once: the safety of their employees, managing the business remotely, the ability of their tenants to pay rent, cost reductions, and possibly lender negotiations. But there is another equally important concern that is often not on management’s radar: fraud. According to the 2020 Association of Certified Fraud Examiner’s (ACFE) Report to the Nations, real estate has the second highest median fraud loss of any industry. Most real estate is held by private companies that have not invested in the internal controls necessary to prevent, or even recognize, fraud. However, the onset of the pandemic has made real estate companies particularly vulnerable to fraud, which heightens financial and reputational risk.

Increasing Fraud Risk: The Perfect Storm

According to the ACFE report, the five most common acts of fraud in real estate involve misappropriation of assets, improper billing, check and payment tampering, and false expense reimbursements. Many property managers, knowingly or unknowingly, have experienced these types of fraud. While most organizations consist predominately of ethical employees, the unfortunate reality is that the COVID-19 pandemic is creating an environment ripe for fraudulent activity. Fraud increases during times of crisis. In a survey after the global financial crisis, the ACFE found that 88% of respondents anticipated an increase in the level of fraudulent activity and less than 2% of respondents believed that there would be lower instances of fraud during times of economic distress.

The pandemic combined with high unemployment has created an environment of great uncertainty and stress. People are concerned about their health and safety, their job security, their ability to pay for rent, health care, food and all the other expenses of daily life. Moreover, financial pressures on real estate companies are causing significant stress at all levels of the organization to deliver financial results. Accordingly, senior management of real estate organizations must be fully aware of the internal and external drivers of fraudulent activity:

• Pressure – changes in an employee’s mindset: Employees may be stressed about the performance of the real estate companies they work for and whether their salaries, incentive compensation, or even jobs are at risk. They are concerned with medical bills and insurance, and wondering how long they will be working from home, perhaps not being recognized for their hard work. Many are dealing with poor working conditions, children at home, or infirm parents. And at work they may be dealing with a myriad of problems that, in turn, could impact their financial livelihoods. The pressure is on.
• Opportunity – new circumstances that permit fraud: Without first-class systems and processes, remote working with limited management oversight makes it easier to override and circumvent controls. Organizations that are eliminating positions could negatively impact segregation of duties and review functions. Decreasing budgets means companies have to do more with less, and monitoring fraud may not be the top priority, particularly when management is laser-focused on collecting rent.
• Rationalization – the justification to commit fraud: The extreme anxiety created by the pandemic and the possibility of lost income can alter an employee’s moral compass. Employees can perceive improper behavior differently during a crisis if their psyche suddenly focuses on self-preservation and supporting and protecting the family at all costs. And given the major other issues the company is dealing with, the employee may believe that improper acts will not be caught.

Watching for Red Flags

Despite the burden of broader strategic and tactical issues that real estate executives are dealing with on a daily basis, management should be looking for signs of fraudulent activity. Situations in property management companies that merit investigation include:

• Weakening of approval processes due to remote working, particularly around cash payments
• Changes to salary or bonus entries in internal or external payroll systems
• New vendors added to the payables systems that have not been vetted and could be employee-related
• Weak reporting of Paycheck Protection Program (PPP) funds disbursement
• Frequency or amount of payments to particular vendors are unexpectedly rising
• Bank reconciliations are late or prepared by employees involved with disbursement processes
• Unusual number or amounts of wire transfers
• Unauthorized movement of funds among property entities.

Fraud can be perpetrated across all functions of a business, and in real estate it could be easier to hide movements of funds in the myriad of ownership entities. The solution is to keep control of cash and maintain separation of duties even when employees are working remotely or the number of employees has been reduced.

Mitigating Risks: Best Practices for Preventing Fraud

Fraud mitigation, like all control functions within an organization, has three primary lines of defense:

First Line: Operational Management

Risk mitigation starts with the tone at the top. Senior management should be visible in its commitment to combatting fraud by being vocal on the topic and taking an obvious and active role in fraud prevention. Management should identify and prioritize functions that have the highest risk and endeavor to put controls in place while recognizing the difficulties created by a remote workforce. Management should then roll up their sleeves and become part of the review of transaction accounting, billings, and cash reconciliations. A new policy alerting employees to the focus on fund misappropriation and its penalties often helps send the right message. Instituting a whistleblower hotline has also proven very effective as long as it has support from the top and it is clear there will be no retribution to the whistleblower.

Second Line: Financial and Risk Management

With increasing levels of layoffs and furloughs, management should assess whether there is proper coverage to mitigate fraud risks. Management of the finance, accounting, and property management teams should also identify high risk functions and review the current efficacy of accounting policies and control processes including segregation of duties and reconciliations. Many property management and accounting systems have built in controls and analytics, and the question for management is whether they are turned on and being used, and whether management is receiving regular and effective red flag reports on the accounting for targeted types of transactions. So it’s worthwhile to review existing systems to understand what functions and analytics are available. Moreover, and this will be particularly relevant for real estate fair value reporters, senior management should pay extra attention in reviewing the reasonableness of significant accounting estimates that have varying degrees of management judgment.

 Third Line: Internal and External Audits

If a real estate company conducts an internal audit review, the work program should be modified this year to take into account the added risks of a reduced workforce, expense reductions, and remote work. As in the first and second lines, high priority functions most prone to fraud should be targeted for review. Any controls that were suspended during the pandemic should be documented and monitored for required reinstatement. If deemed necessary, the review could include a proactive forensic data analysis of high risk transactions. Certain reviews should be done off cycle so the team performing high risk functions are not alerted in advance. As many private real estate companies do not have this type of infrastructure, management should consider utilizing their external auditors or another third party for some of these reviews.

Protecting Against Increasing Cyber Threats

In addition to the occupational fraud risks described above, cybercrime poses a unique set of challenges. As the COVID-19 pandemic sweeps the world and millions have to working remotely, the risk of being victimized by a cyber threat, such as phishing attacks and business email compromises, has substantially increased. Cybercriminals have moved in at an accelerated pace to take advantage of increased vulnerability. Within six weeks of the announcement of the first COVID-19 case reported in the U.S., the Federal Bureau of Investigation (FBI) developed a dedicated site on its official webpage urging vigilance during the COVID-19 pandemic. The FBI issued several fraud warnings to the public linked to the COVID-19 pandemic dealing with cyber threats, business email compromise schemes, emerging health care fraud schemes, and cryptocurrency scams, among others.

Real estate companies need to remain vigilant during the new paradigm shift of moving their workforce remotely to prevent phishing attacks and remind their employees of this risk. As organizations review their policies and procedures to mitigate a cyberattack, three lines stakeholders should actively communicate across differing departments within the organization. Mitigating cyber threats should be an enterprise-wide effort and not one solely focused on IT departments.

Management can send brief “Did you know” type emails to their employees with best practice ideas, including:

• Remain alert against cyber threats that can originate from manipulated emails, URLs, text messages, and phone calls.
• Be cautious when clicking on unfamiliar links.
• Think twice before providing corporate financial data and personal information.
• Be cautious of downloading a file without verifying it.

Moving Fraud to Management’s List of Priorities

As the COVID-19 pandemic continues to wreak havoc on all sectors of the real estate industry, the perfect fraud storm is brewing. Organizations are more vulnerable to corporate fraud as all three elemental drivers impacting employee behavior (pressure, opportunity, and rationalization) are negatively heightened. This crisis is creating unprecedented disruption and opportunities for corporate wrongdoers. Anti-fraud specialists expect a significant uptick of fraudulent activity. Real estate companies must act swiftly to adapt their risk management and control frameworks to put proper fraud mitigation procedures in place. Management should identify gaps and vulnerabilities and quickly build in new controls and monitoring systems. The earlier action is taken, the higher the likelihood that an organization can prevent wrongdoing and mitigate loss.