Learn

Wire fraud at closing: verifying instructions before money moves

Real-estate wire fraud follows one script. A criminal watches a transaction unfold, usually from inside a compromised email account belonging to an agent, a title company, or the buyer. Days before closing, the buyer receives wiring instructions that look exactly like every other email in the thread: same names, same signature blocks, same transaction details. The account number belongs to the criminal. Once the wire settles, recovery windows are measured in hours, and most victims miss them.

The defense is not spotting bad grammar. These messages are written by someone who has read the whole thread. The defense is a verification routine that treats every set of wiring instructions, and every change to them, as unverified until proven otherwise.

The routine for buyers

Call the title company at a phone number you obtained independently, from their website, from your first in-person meeting, or from closing documents you received early in the process. Never use a number from the email carrying the instructions; criminals print accomplice numbers that answer professionally. Read the account and routing numbers aloud and have the title company confirm them. Do this even if the instructions arrived exactly when expected, and do it again if anything changes.

Treat any change to previously confirmed instructions as the attack itself. "Our account was flagged for an audit, please use this one instead" is the single most common closing-fraud sentence in circulation. Legitimate title companies change wiring accounts mid-transaction approximately never.

The routine for agents and title companies

Check the messages, not just the money. An email's own delivery records show whether it actually came from the sender it claims: the path it traveled, and whether the receiving server's authentication checks passed or failed. When a thread turns to money, save the critical message as a .eml file and check its records. A message whose visible sender does not match its routing records, or whose reply-to silently redirects responses to a lookalike domain, is telling you the thread is compromised, before any funds move.

Standardize the channel early. Tell every client at engagement, in writing: wiring instructions come once, through this channel, and we will never change them by email. That single sentence converts the criminal's main tool, plausible-sounding change requests, into an automatic alarm.

After a suspicious message

Do not reply to it. Replies often go to the criminal, who will reassure you. Contact your bank's wire department and the receiving bank immediately if anything was sent, file with IC3.gov the same day, and have whoever owns the compromised-looking account rotate credentials and review mail rules; criminals add forwarding rules to monitor threads silently.

FAQ

How fast do I need to act if a wire went to the wrong account?

Immediately, and in hours rather than days. Ask your bank to attempt a recall and notify the receiving bank's wire-fraud line, then file with IC3.gov. Recovery odds drop steeply after the first 24 to 72 hours as funds move onward.

Can checking an email really show it was sent by a criminal?

It can show that a message failed its sender's authentication checks, traveled an unexpected path, or redirects replies somewhere new. Those are records written by the mail systems that handled the message, and they frequently expose impostor messages that read perfectly. A clean result does not prove safety on its own, which is why the phone callback stays in the routine.

Whose email account usually gets compromised?

Industry reporting points most often at the parties handling many transactions at once, agents and title or escrow staff, because one compromised inbox exposes dozens of closings. Buyers should assume any party's account could be the source and verify by phone regardless of who appears to be writing.