Wire Fraud at Closing: The 5-Minute Fix That Stops It
The scam that empties a buyer's down payment is boring, well-rehearsed, and preventable. Here's exactly how it unfolds and the protocol that kills it.
The short answer
To protect yourself from real estate wire fraud, never trust wiring instructions sent by email. Before sending any funds, call your title company at a number you independently verified—not one from the email—and confirm the routing and account numbers verbally. This five-minute call defeats nearly every business email compromise scheme.
How big is the wire fraud problem in real estate?
The number that should scare you
According to the FBI's Internet Crime Complaint Center (IC3), business email compromise—the category that includes real estate wire fraud—has driven billions of dollars in reported losses in recent years, with real estate and rental transactions among the hardest-hit sectors. Individual buyers routinely lose their entire down payment, often six figures, in a single wire.
Wire fraud in real estate is a scam where a criminal impersonates your title company, closing agent, or attorney and tricks you into wiring your closing funds to a fraudulent account. The money moves fast and is often unrecoverable within hours.
Here's the uncomfortable truth: this isn't sophisticated hacking. The attacker doesn't need to break into a bank. They monitor an inbox, wait for a real estate deal to appear, and send one convincing email at exactly the right moment. According to the FBI IC3, the losses tied to this pattern run into the billions annually across all industries.
The reason it works is timing and trust. You're already expecting wiring instructions. You're stressed, you're moving, and a message that looks like it's from your closing agent lands right on schedule. Most victims never suspect a thing until the money is gone.
How the scam unfolds, day by day
The attack has a rhythm. Understanding the sequence is the fastest way to spot it, because every legitimate closing follows a different one.
- 01
Weeks before: quiet surveillance
A criminal gains access to an email account somewhere in the transaction chain—often a real estate agent, a lender, a title employee, or even the buyer. They don't act. They read. They learn the closing date, the parties' names, the writing style, and the dollar amount. This is why it feels so real later.
- 02
3-5 days out: the setup
The attacker registers a lookalike email domain—swapping one letter, adding a hyphen, or using a display name that matches your agent. They draft a message in the same tone, referencing your actual property and closing date. Nothing feels off yet.
- 03
1-2 days before closing: the strike
You receive an email with 'updated wiring instructions' or 'a change to our banking details.' It cites a plausible reason—a bank merger, an audit, a routing update. The urgency is subtle but present: send today to stay on schedule. The account belongs to the criminal.
- 04
Wire day: the drain
You wire the funds. Within hours the money is pulled out, split, and moved offshore or through mule accounts. According to the FBI IC3, recovery depends on catching it in the first 24-72 hours—which almost never happens because nobody knows anything is wrong.
- 05
Closing day: the discovery
Your title company asks where the money is. You say you sent it. They say they never changed the instructions. That's the moment the floor drops out.
The contrarian point most people miss: your own email being clean doesn't protect you. The breach can happen anywhere in the chain—your agent's Gmail, a paralegal's laptop, a lender's inbox. You can do everything right and still receive a perfect forgery. That's precisely why verification has to be verbal and independent.
The wire verification protocol that defeats it
This checklist takes about five minutes and stops nearly every wire fraud scheme cold. Run it every single time, even if the instructions look identical to what you already have. Especially then.
Checklist
0/8Wire verification protocol (do this before every wire)
One structural fix worth demanding: ask your title company how they deliver wiring instructions. The strongest firms use secure portals, verbal-only confirmation policies, and give you a wire fraud warning up front. If yours emails a PDF and hopes for the best, that's a red flag about the whole operation.
A quiet benefit of platforms like One Home Agent is that closing documents and verified contacts live in one secure place after the deal—so a homeowner always has a trusted reference point instead of digging through an inbox full of forgeable emails.
Red flags vs. legitimate changes
Not every email about your closing is a scam. But the difference between a fraud attempt and a legitimate communication is almost always visible if you know what to compare.
| Signal | Fraud red flag | Legitimate practice |
|---|---|---|
| Wiring instructions | Sent or 'updated' by email at the last minute | Provided early, confirmed verbally, often via secure portal |
| Sender address | Lookalike domain or mismatched display name | Exact, consistent domain you've corresponded with |
| Tone | Urgent, pressures you to send today | Calm; encourages you to verify by phone |
| Banking changes | 'Bank merger' or 'audit' requires new account now | Changes are rare and always confirmed by a live call |
| Verification | Discourages calling; gives a new number in the email | Actively invites you to call the number on file |
| Beneficiary name | Account name doesn't match the title company | Account name matches the company exactly |
“The buyers who lose money aren't careless—they're trusting. A forged email arrives right on schedule, references their real address, and matches their agent's voice. The only reliable defense is a phone call to a number you got somewhere other than that email. Five minutes beats a six-figure loss every time.”
Todd Paton, Partner, One Home Agent
Bottom line
Wire fraud is preventable with one habit: verify wiring instructions by phone, using an independently sourced number, before every transfer. Treat every emailed change as suspect. Title companies that build verification into their process—not as an afterthought—are the ones buyers should trust with the biggest check they'll ever write.
For title companies: turn safety into a differentiator
Buyers remember the closing where nothing went wrong. Title companies that visibly protect clients from wire fraud—clear warnings, verbal verification, secure document delivery—earn referrals that price competition can't touch. Safety is a marketing asset, not just a compliance checkbox.
Give every buyer a lifetime of secure home management
One Home Agent lets title companies white-label an AI home platform where closing documents, verified contacts, and homeowner support live securely long after the deal closes. Stay the trusted brand your clients turn to.
See how it works for title companiesFrequently asked questions
Recovery is possible but rare, and it depends on speed. According to the FBI IC3, funds must usually be flagged within 24 to 72 hours before criminals move them beyond reach. Contact your bank immediately and file a report at ic3.gov to trigger a potential recall of the wire.
Sources & further reading