Editor’s Note: According to OREP/WRE’s HVCC Appraiser Talkback Survey, there is high interest in appraisal security. Ninety-two percent (92%) of survey takers answered “Yes” to the following question: Is being able to be certain that your clients are receiving an unaltered version or “true copy” of the appraisal reports you send them an important issue to you? This story offers one solution.
Appraisal Security Solution
by Steven Nation
Before the Internet and email, the appraisal business was largely a relationship-centered business conducted between appraisers and lenders or their agents. The relationship was primarily local and often conducted over a handshake. There was often a high level of confidence in knowing who you were doing business with. This is far from the case today.
Identity theft, altered appraisals and other fraud are rampant today as a result. Appraisers have become nothing more than a name and a number or username and password to national companies, and vice-versa; lost are personal interactions and the security of knowing who you’re dealing with. Needless to say, recent events and market forces on a national level have created an unprecedented urgency to restore confidence in the security of the appraisal transaction.
Getting snared by an identity thief who has stolen your name and/or changed the contents of your appraisal report without your permission can be very costly to your reputation and your bottom line. Nation Technologies has released the BIOWRAP System that utilizes advanced fingerprint authentication technology to bring security back to business-to-business transactions.
Preserving “True Copy” Appraisals
The BIOWRAP System provides a tool for appraisers to accurately associate their identity and credentials to an unalterable “true copy” appraisal report using fingerprint technology. Appraisers are able to track anyone who views their “true copy” appraisal reports. According to David Doering with Missouri Property Appraisal, Inc., in Jefferson City, Missouri: “The days are long gone when we could be certain that the printed appraisal report, hand-delivered or mailed, would reach its intended user intact. As appraisers, we are asked routinely to transmit appraisal reports via the Internet to often unknown users, hundreds or thousands of miles away. And while our appraisal software allows us to use an electronic signature that is protected by a password, it is naive to think that it is not possible for an appraisal sent as a PDF or in .xml format to be hijacked with readily available software and changes made at will.”
“With BIOWRAP we are able to send both narrative and form appraisal reports and other files with the confidence that the report will be received by the intended user precisely as it was sent, unaltered and complete. With BIOWRAP we know that we have a verifiable record that what we send is what the client will ultimately see. Further, BIOWRAP provides us with accountability as to the chain of custody of who opened the file and if the file has been altered,” Doering said.
The system provides guaranteed assurance of the authentication, security and accountability of appraisal reports without impeding existing technology. Clients can limit their liability and have certainty that the appraisals they receive are secure and authenticated and were created by an accurately-identified and properly credentialed appraiser. The integrity of an appraiser’s identity and credentials serve as the basis for his or her livelihood. This new technology offers that protection.
OREP and WRE Discounts
Through an affinity relationship, those who purchase their E&O insurance from OREP save $70 at sign up. Working RE readers also qualify for a discount ($35). To learn more and to obtain the discount code(s), please visit OREP.org (click Benefits) or WorkingRE.com (under left column: Appraisals and Identity Security Solution). You will find links for more product information as well.
For additional information please read Altered Appraisal Reports (WorkingRE.com, Current Issue).
HVCC Update - NAMB’s Call to Action
The National Association of Mortgage Brokers (NAMB) believes the time has come for every appraiser’s individual voice to be heard. In order for this “Call to Action” to be effective, NAMB is asking for everyone to fully participate, encourage others to join the action and continue calling and emailing every day, until advised to stop by NAMB. To read NAMB’s press release to learn more about who to contact and what to say, please visit WorkingRE.com, Premium Content: NAMB’s HVCC Call to Action.
3 responses so far ↓
1 Chuck Miller // Jul 14, 2009 at 5:57 pm
I still have a copy of the true report kept in my files if push comes to shove and I have to defend my position legally. There are secure data back up companies that operate off site and are not that expensive. So when (not if) my system crashes I can get access to my “true copy” work. I must admit putting fingerprint technology on all my work makes me a little aprehensive for no other reason then orwellian visions of the future. But really if there is technology to add safe gaurds then rest assured somebody is also working on the way around it. Best argument for that is the most recent cyber attacks on Government systems which were compromised by foreign nationals, No system is fool proof. For now, for me, I save my work off site, I print a copy of the pdf and stuff in the work folder and will most certainly gaurantee that if pressed to produce both will match which could only lead to the conclusion that somebody else did the change and I’m clear. Back to the question at hand ( no pun intended) finger print and smart chip technology is already in place within the Federal government system they require special programming and card readers. Who is going to bear the cost of this? An individual apprasier that is already on the ropes financially? probably not. Though if required it would be a massive logistical nightmare until everyone who needs to see your report has the technolgy in place to view it and then we are back where we started with every one having the potential to alter your report once the initial security barriers that allow inroads to the document are breached. I say breached because as with any secure program one of the first things you encounter is a password and somebody will figure a way around it especially where millions of dollars are involved.
2 John Cirincione // Jul 27, 2009 at 10:05 am
Chuck, good post. I would like to throw in my 2 cents and attempt to address areas that may help clarify. Please be advised, I am not an expert in this field. I am an appraiser and have had the privilege to learn about this new technology and opportunity working closely with Stephen Nation, Nation Technologies.
I still have a copy of the true report kept in my files if push comes to shove and I have to defend my position legally. There are secure data back up companies that operate off site and are not that expensive. So when (not if) my system crashes I can get access to my “true copy†work.
Good point. There are various back-up methods and BIOWRAP simply offers an alternative solution. As pointed out in the article, the tool offers additional information management capabilities and can be used with all electronic file types other than appraisal.
I must admit putting fingerprint technology on all my work makes me a little aprehensive for no other reason then orwellian visions of the future. But really if there is technology to add safe gaurds then rest assured somebody is also working on the way around it. Best argument for that is the most recent cyber attacks on Government systems which were compromised by foreign nationals, No system is fool proof.
The information at the end of this message might be of some help. It is available at the BIOWRAP web site.
For now, for me, I save my work off site, I print a copy of the pdf and stuff in the work folder and will most certainly gaurantee that if pressed to produce both will match which could only lead to the conclusion that somebody else did the change and I’m clear.
Back to the question at hand ( no pun intended) finger print and smart chip technology is already in place within the Federal government system they require special programming and card reader. Who is going to bear the cost of this? An individual apprasier that is already on the ropes financially? probably not.
I am also not an expert on Federal government biometric standards, however I am confident Stephen Nation, NATION Technologies could answer this question.
Though if required it would be a massive logistical nightmare until everyone who needs to see your report has the technolgy in place to view it and then we are back where we started with every one having the potential to alter your report once the initial security barriers that allow inroads to the document are breached. I say breached because as with any secure program one of the first things you encounter is a password and somebody will figure a way around it especially where millions of dollars are involved.
The lack of standards without any driving force from major industry players does create a problem. However, keep in mind, this technology requires both a password and fingerprint concurrently for access. A stolen password without your physical fingerprint on the fingerprint sensor that plugs into your pc USB port will not work.
Hope this helps.
BIOWRAP Web Site Info:
IDENTIFICATION
Unlike other online identity verification and authentication systems where a user claims to be somebody, the BIOWRAP System physically approves our Registered Users to operate in the system. To ensure the user is, in fact, who they claim to be, their identity is verified in person by a trusted third-party
individual known as a BIOWRAP Registrar. Upon completion of the online registration form, a BIOWRAP Registrar will contact the pending Registered User to schedule an appointment for identity verification. If the BIOWRAP Registrar approves the individual’s identity, the Registrar will then witness the enrollment of the individual’s fingerprints to be associated with their unique username and password.
The end result of the BIOWRAP registration and enrollment process is that an individual becomes a Registered User, complete with a certified biometric identity record (Username + Password + Fingerprint).
CREDENTIALING
Once a user’s identity has been verified, the system can associate any number of professional credentials and affiliations with their biometric identity record.
Requirements are set by a third-party that performs the verification of a user’s provided credentials. The administering third-party sets these standards and can even require further checks such as a criminal background check before administering the rights for a user to operate in their group. Applications include, but are not limited to an entire industry, trade group, company or group of individuals.
The receiving party of the BIOWRAP file will have apparent authenticity, that the individual that created the file is in fact who they claim to be and that they are properly
credentialed to create the file. The Administrator can also specify if BIOWRAP files created with their seal can only be accessed by the group, defined groups or the public with biometric or non-biometric access.
Applying a credential and/or verified affiliation to a positively identified individual allows for the creation of a truly trusted network. Allowing for accurately identified and properly credentialed individuals to create secure, biometrically authenticated files that can be tracked.
AUTHENTICATION
The BIOWRAP System utilizes the unique practice of Biometric Multiple Factor Authentication.
With this combination, anybody can know the Username and Password, but they don’t have the key to the system: the Registered User’s Fingerprint.
Every transaction in the BIOWRAP System (including file creation and account administration) requires our Registered Users to present their fingerprint. Unlike other systems that leave the user vulnerable to fraud by relying on identifying users by a username and password only, the BIOWRAP System only allows you to operate on your system.
PRIVACY
Biometric
The BIOWRAP System does not store images of a Registered User’s fingerprints. Rather biometric images are converted into templates that cannot be used to recreate the fingerprint image, furthermore the templates are encrypted.
When a Registered User presents their fingerprint for authentication, the software, using the live fingerprint sample image creates a secure, encrypted
fingerprint template for comparison to the Registered User’s enrolled fingerprints. This live fingerprint image or non-encrypted
fingerprint is never stored on the client PC or the BIOWRAP Servers.
A fingerprint template, whether encrypted or not, cannot be used to recreate a fingerprint image.
The fingerprint sensor’s hardware/firmware and its software interface cooperate to preclude the use of a mechanical fake finger. They also cooperate to detect electrical signal playback to prevent man-in-the-middle attacks between the device and the PC.
PRIVACY
Username/Password Obfuscation
Passwords are never stored in the client or server systems. The password is used to obfuscate the username. To obfuscate a username/password they are
taken, plus some proprietary security measures and hashed to produce a fixed length string of 40 characters. The process cannot be reversed to produce the username or password.
PRIVACY
BIOWRAP File
The BIOWRAP System does not store the original or native file that is authenticated.
PRIVACY
Sensitive Data
Sensitive data in the BIOWRAP Server database including the user’s personal information, security information, biometric templates (not images) and other important data is encrypted. The BIOWRAP Servers are connected via an isolated network to a storage server. The storage server’s isolated network is protected from the public network.
See http://www.mybiowrap.com/nation for more information on the appraiser application of BIOWRAP or contact NATION Technologies for more information, (877) 267 3453 or email snation@nationtechnologies.com
3 Jim Gerot // Aug 13, 2009 at 11:47 am
With a scanner / OCR program you can go around almost any security measure. Locks and doors are for the honest people. JimG.
Leave a Comment