Real estate closing wire fraud

Real-estate closing wire fraud is the highest-stakes consumer-facing variant of business email compromise. Days or hours before closing, an attacker — having compromised the title company's, attorney's, or real-estate agent's email — sends "updated wire instructions" to the buyer. The buyer wires their down payment and closing funds to the scammer's account instead of the real escrow.

The FBI reports billions in annual losses in this category. Individual losses range from $30,000 to $1M+. Recovery requires reporting to IC3 within 72 hours via the Recovery Asset Team; even then, recovery is often partial.

This scam is so widespread that some title companies now refuse to send wire instructions by email at all.

• "Updated" wire instructions sent late in the closing process.
• The email is from a slightly different domain than the original thread.
• The wire destination is in a state different from the closing.
• Reply-to address differs from the from address.
• The new account is at a bank the title company has never mentioned.
• Urgency: "send today to keep closing on schedule."
• The communication includes verbiage about not contacting the office by phone.
• Subtle changes in tone or signature compared to earlier emails.

1. Call the title company / closing attorney directly using a number from their official website — not the email. Verify wire instructions voice-to-voice with someone you already know.
2. Ask for instructions in person if possible. Many title companies will now only deliver wire instructions face-to-face or via secure portal.
3. Read the email's full headers. Mismatched sender / reply-to is a strong signal.
4. Use a small test wire (e.g., $1) and confirm receipt before sending the full amount — many title companies support this.
5. Insist on a written confirmation of the wire's receipt within 1 hour of sending.
6. For buyers, get cyber-insurance disclosure from your title company before closing.

• Call your bank immediately and request a SWIFT recall / hold-harmless letter. Time matters — the first hour is critical.
• File an IC3 report immediately. The Recovery Asset Team has a 72-hour window of high effectiveness.
• Notify the FBI field office in your jurisdiction.
• Notify the title company — their mailbox may be compromised and other clients at risk.
• Engage a real-estate attorney if you don't already have one. There are sometimes secondary liability claims against the title company.
• Contact your homeowner's insurance and any cyber-fraud coverage you may have.
• Don't sign anything releasing the title company from liability without legal review.

• Do not wire funds without voice verification of the instructions.
• Do not rely on the email thread as authoritative — the attacker controls it.
• Do not wait to report. The recovery window closes fast.
• Do not assume "the title company is large, they wouldn't be compromised." Large firms are heavily targeted.

• FTC: reportfraud.ftc.gov — the broadest US fraud intake; reports flow to thousands of law-enforcement agencies.
• FBI IC3: ic3.gov — the right destination when the scam is internet-enabled (phishing, BEC, romance, crypto).
• CFPB: consumerfinance.gov/complaint — for complaints about banks, money transmitters, payment apps, credit cards, debt collection.
• IdentityTheft.gov — if any identity information (SSN, driver's license, account credentials) was shared.
• Your bank or payment platform. Call the number on the back of your card or use the app's in-product help. Time matters — wires can sometimes be recalled within hours; ACH and Zelle are harder but worth trying.