Dec. 29: FEMA reverses flood ruling; cybersecurity notes; observations on general housing trends

Congrats to anyone involved in lending and real estate: The Federal Emergency Management Agency will issue and renew flood insurance policies, reversing an unexpected and controversial ruling the agency released earlier this week. Some critics said they wished the “no issuance” ruling to stand to increase ire against the government…

Cybersecurity

One time I saw a sign in a clothing store, “Genuine authentic Ultrasuede.” “Accept no imitations!” I thought to myself. Speaking of authentication, in financial services, many lenders and banks no longer rely solely on passwords anymore. Today they, and especially banks, rely more on two factor authentication (2FA). This type of authentication checks a user’s identity using a combination of two different pieces of evidence (factors) such as, something the user knows, and either something the user has, or something the user is. A typical example here is a logon ID with a password and a system generated code sent to the user’s mobile phone or email.

Unfortunately, hackers are good at breaking nearly any security protocol, including the use of text messages as the second factor. They do this by either intercepting software codes or exploiting account-recovery systems. Some hackers have even targeted phone carriers to get to bank account information by rerouting and forwarding codes in transit, to their evil lairs. Lenders and bankers should be careful here and when something seems the least bit odd with a customer- ask, ask, and ask again.

Steve Brown with PCBB notes, “One way thieves acquire texted authentication codes can be to send an unsuspecting person a text or to simply call their mobile number. Thieves then pose as a bank representative and claim they have seen suspicious account activity. The scammer then makes a big to-do about not giving them any personal information for security reasons but tells the customer to expect a text from the bank asking for an authorization code to fix the problem. The thief then attempts to log into the customer’s online account using previously stolen login information and when the actual text message code is sent to the customer for authorization, he provides it to the thief, thinking it’s the bank.”

Four major US wireless carriers have teamed up on “Project Verify“, an app due out in 2019 that is supposed to seamlessly verify the user’s identity using a multi-factor profile based on their personal mobile device. While this doesn’t do much good if the user’s phone is stolen, it is a big step in the right direction.

If you’re interested in more, check out Verizon’s 2018 Data Breach Investigations Report (DBIR), considered by many as the guide to what’s happening in enterprise cyber-attacks. Verizon looked at more than 53,000 global incidents that resulted in more than 2,200 successful system breaches across several verticals, including education, government, healthcare retail, and financial services over the past year. The findings paint a detailed, if somewhat disturbing picture of how the business of cybercrime and its attack vectors are evolving.

In some ways, for example, the more things change, the more they stay the same across all industries. For instance, 68% of enterprise breaches still take a month or more to be discovered, according to respondents. In many, if not most cases, attackers are relying on the same tried and tested malware, phishing techniques, and fraud scams that they have been employing for years. Case in point, arguably the most damaging attacks of the past year have relied on variants of older malware strains, known and unpatched vulnerabilities, and social engineering.

“Banks are where the money is,” and given that the majority of breaches are financially motivated, banks and credit unions are often targeted. And cyber thieves have long since realized that community banks and credit unions may be less equipped to identify certain scams. But there are some things for management to think about that could aid community banks in better understanding how breaches could be impacting them, and what they can do to mitigate the risk of a successful attack.

First, remember that financial services are not the most compromised sector. Rather, healthcare organizations were on the receiving end of 24% of attacks, #1. But small businesses were victims in 58% of all attacks, which is one of the biggest and most alarming changes in the cybercrime landscape in the past year.

Second, about 73% of attacks are conducted by outsiders vs. 25% that came from insiders. Even more worrisome, 60% of outsider attacks were backed by organized crime rings or nation-state groups. User errors like sending an email to the wrong recipient or incorrectly configuring web servers play a role in only 17% of breaches. Training your staff about suspicious emails is critical. I know companies that regularly send false malicious emails to their employees to see if anyone opens them or clicks on an embedded link, at which point training is required.

It’s been 5 years since ransomware emerged as a threat, and this most recent year was the first time it was the most prevalent form of malware. Ransomware was identified in roughly two out of five of all malware exploits. Off-the-shelf tools, ease of use, and little risk (since attackers don’t need to resell their stolen data, just hold it ransom) have made this a favored attack of advanced and newbie attackers alike.

General housing & lending environment

Mortgage applications for new homes are down roughly 25 percent year over year as climbing interest rates are taking their toll on the number of consumers in the market for new home mortgages. Less-discussed is how rising rates are affecting non-bank mortgage lenders whose success came during the periods with zero or near-zero interest rates. A year ago, the average interest rate on a 30-year fixed rate mortgage was 3.99 percent; it now sits over 4.80%.

Non-bank lenders now represent the majority of mortgage underwriting done in the U.S., originating roughly 52 percent of all deals. Large non-bank players like Quicken may continue to thrive in a rising rate environment, while smaller non-bank lenders may struggle in the new environment, as unlike banks or credit unions, these lenders have neither deposits to fund themselves nor (in most cases) other lines of business to buoy them through a slow housing market. Instead, they often rely on short-term bank loans – now also at a more expensive rate. What remains to be seen is if consolidation is a natural part of the interest rate cycle, or if a decline in refinance volume will spell disaster for the non-bank lending industry.

Rate-wise, the Fed, as expected, raised short term rates again this month, meaning the 80 percent figure representing Q3 cash-out refinance applications to overall refinance applications will only increase. The cash-out option played in the housing crisis a decade ago. Many homeowners sought to take the cash out of their homes right before the market crashed, leaving them underwater on those loans post-crash and for several years after. Fortunately, this time around, homeowners are at present pulling a lot less money out of their houses than they were right before the crash. This could change with rising rates as consumers who don’t really understand all the consequences of a cash-out refi are pressured to pursue them by underwriters trying to keep their volume up and make profitability targets.

But with the Fed moving rates higher a couple weeks ago, and on pace to raise them again once or twice in 2019, it seems likely that cash-out refinances will continue to make up the majority of mortgage refinancing in the U.S. Whether that increase will be enough to keep the non-bank lenders in the market in the face of falling purchase mortgages and interest rate refinances, probably depends on the size of the company.

Small-time investors who poured into real estate in the past decade to take advantage of low borrowing costs and rising home values are starting to cut back, indicating the market’s short-term risk-takers see limited upside, and potentially worse, ahead. Fewer than 46,000 single-family houses and condos were flipped in the third quarter, the smallest number in three-and-a-half years for a market that is expected to make up 5.5% of home sales in 2018. The number of new home loans issued with terms of three years or less, typically used by investors looking to make a quick profit, dropped by 11% in Q3 2018 YoY from 2017. Higher interest rates have been putting a damper on the U.S. housing market, long a boost to the economy post-2008 recession that now looks to threaten to turn into a drag. Additionally, a years’ long rush higher in home prices has stalled in recent months; the S&P CoreLogic Case-Shiller National Home Price Index showed home-price gains slowed across the nation for the sixth month in a row in September. While the current decline doesn’t suggest a housing crash on the scale of the one a decade ago, it looks similar to the drop-off in 2014 as higher rates made mortgages costlier. Even if when the market crashes, investors have a hard time imagining losing money in the long run.

First-time homebuyers may be facing rising affordability issues, but they are still outpacing the share of repeat buyers in the housing market, and the gap is actually widening. The share of first-time homebuyers is even higher for FHA loans, which allow for lower down payments even with lower credit profiles. That figure is about 83% in today’s market, up from a historical figure closer to 80%. The GSE share of first-time homebuyers was at only 25% during the early 2000s, hit nearly 40% during the housing bubble, fell during the recession, but has increased once again to nearly 50% today. The rising share of first-time homebuyers can be attributed to the lack of repeat buyers in the housing market, as falling home prices after the recession prevented many homeowners from accumulating equity in their homes. While homeowners may have more equity, they are not likely to want to give up their low mortgage rates they locked in during the recession. Homeowners hanging on to their homes and not moving up, combined with the lack of new home construction, will cause inventory to continue to tighten and home prices to increase for starter homes.

After nearly a decade of low levels of building, housing stock is well short of what the United States needs. Research from Freddie Mac finds that if supply continues to fall short of demand, home prices and rents are likely to outpace income and household formation will fail to reach potential. Housing supply has been a major challenge facing the housing market in 2018 and will continue to be for years to come, according to its latest Insight. According to Freddie Mac research, the current annual rate of construction is about 370,000 units below the level required by long-term housing demand. Loosely estimated that at least 50,000 American households each year can’t buy or rent a home because it hasn’t been built.

The U.S. construction industry is suffering from a shortage of skilled workers. The count of unfilled jobs in the construction industry reached post-Great Recession highs in 2018, according to the National Association of Home Builders.

The U.S. Census Bureau released its five-year estimates, 2013-2017, from the American Community Survey (ACS), which provides statistics for every county in the nation totaling 3,142 counties. One of the perspectives gauged differences in income growth across the counties. The survey says median household income nationally increased 1.9%, from $56,587 to $57,652 in inflation-adjusted dollars between the two five-year periods. The percentage of people in poverty decreased from 14.9% to 14.6%. These rates vary across the nation’s counties but in general, median household income is higher in urban counties than in rural areas. Likewise, poverty rates tend to be lower in urban areas than in rural areas. Detailed information regarding income growth and poverty rates portion of the survey can be accessed here. The ACS data release features more than 40 social, economic, housing and demographic topics, including homeownership rates and costs, health insurance, and educational attainment. It is the only full data set available for the 2,316 counties with populations too small to produce a complete set of single-year ACS estimates. View highlights of the survey here.

A man walks into a bar, and notices a few steaks hanging from the ceiling.

When he asks the bartender about it, the bartender replies, “If you can jump up and hit one, drinks are on the house for the night, but if you miss, everyone’s drinks are on your tab for the next two hours. Do you want to try?”

The man decided not to take the risk. He thought the steaks where too high.

Visit www.robchrisman.com for more information on our industry partners, access archived commentaries, or to subscribe to the Daily Mortgage News and Commentary. If you’re interested, visit my periodic blog at the STRATMOR Group web site. The current blog is, “Low Down Payments Can Help Borrowers AND Lenders.” If you have both the time and inclination, make a comment on what I have written, or on other comments so that folks can learn what’s going on out there from the other readers.

Rob

(Market data provided in partnership with MBS Live. For free job postings and to view candidate resumes visit LenderNews. Currently there are hundreds of mortgage professionals looking for operations, secondary and management roles. For up-to-date mortgage news visit Mortgage News Daily. For archived commentaries, or to subscribe, go to www.robchrisman.com. Copyright 2018 Chrisman LLC. All rights reserved. Occasional paid job listings do appear. This report or any portion hereof may not be reprinted, sold or redistributed without the written consent of Rob Chrisman.)