Why It Matters
Here's what you need to know: real estate closings are the primary wire fraud target because the amounts are large and wiring instructions arrive by email. The FBI's IC3 reported over $446 million in real estate wire fraud losses in 2023 alone. The attack is simple — a criminal monitors an intercepted email thread, then sends fake instructions right before closing. Your defense is equally simple: always call to verify wiring instructions using a phone number you independently sourced, not one from the email. That one step stops most attacks.
At a Glance
- What it is: Email-based scam redirecting closing wire transfers to criminal bank accounts
- How criminals get in: Compromised email accounts at title companies, agents, or law firms
- Primary target: Buyers wiring down payments — losses typically run $50,000–$500,000
- Red flag: Last-minute change to wiring instructions by email or text
- Prevention: Call to confirm wiring instructions using an independently verified phone number
- If it happens: Call your bank within minutes — there's a narrow window to recall a wire
- Report to: FBI IC3 at ic3.gov and your state's attorney general
- Recovery rate: Low — wired funds often leave the US banking system within hours
How It Works
The attack starts with email access. Criminals use phishing or purchased credentials to break into email accounts at title companies, agents, or attorneys. Once inside, they monitor quietly — sometimes for weeks — waiting for the closing date, wire amount, and party names to come into focus.
Then they send the swap. Days before closing, they send an email that looks identical to your title company's — same name, nearly identical address, same signature logo. The message says wiring instructions changed due to a "bank account update." Wire to those and your closing funds go directly to a criminal-controlled account.
Domain spoofing makes it convincing. Criminals register domains nearly identical to real ones — `firstamericantitIe.com` (capital I for lowercase l) passes spam filters because it's legitimately registered and looks identical to prior correspondence.
Recovery is extremely difficult. Once funds hit the fraudulent account, criminals transfer them internationally within hours. Most victims learn at the closing table that funds never arrived. The FBI's Recovery Asset Team can freeze funds if contacted within 72 hours, but recovery rates are low.
Real-World Example
Stephanie is purchasing a $385,000 rental in Phoenix. Two days before closing, she gets an email appearing to be from Desert Title & Escrow: "Due to a recent banking transition, please use the updated wiring instructions for your closing funds of $97,843." The email comes from `deserttiIe-escrow.com` — capital I instead of lowercase l.
She calls the title company using the number from their official website. They confirm: no updated instructions were sent. Original instructions are still valid.
The FBI IC3 reported average real estate wire fraud losses of $70,000 in 2023. A 90-second phone call saved Stephanie's entire down payment.
Pros & Cons
- Prevention costs nothing. Calling to verify wiring instructions using an independently sourced number takes under two minutes and stops most attacks
- Recovery resources exist. The FBI IC3's Recovery Asset Team has frozen funds in some cases when notified within hours of the transfer
- Secure platforms reduce risk. Tools like CertifID let title companies share verified instructions through encrypted portals rather than standard email
- Recovery is rarely possible. Once funds leave the US banking system — which can happen within hours — international recovery requires cooperation that is slow and often unsuccessful
- Insurance gaps are real. Standard homeowner's and landlord's policies do not cover wire fraud losses; specialized cyber coverage must be purchased separately
- Criminals adapt. Attacks have evolved to include phone spoofing and voice impersonation designed to defeat standard verbal verification
Watch Out
Any change to wiring instructions is a red flag, full stop. Legitimate title companies do not change bank accounts mid-transaction. Even if the email looks exactly like prior correspondence, call using a number from the company's official website — not the email — and ask for your closing officer by name.
Verify every wire unconditionally, not just suspicious ones. Sophisticated attackers know your exact closing amount and timeline. The email will raise no flags. Verification is not about whether something looks suspicious — it's a fixed checkpoint in your closing timeline applied to every transaction.
Time pressure is part of the attack. Fraudulent instructions often include urgency: "Please wire today to avoid delays." Legitimate title companies understand verification takes a few minutes. Pressure to skip it is itself a warning sign.
Ask an Investor
The Takeaway
Wire fraud exploits the most routine moment of a closing — the wire transfer — and it works precisely because buyers aren't expecting an attack at that point. The defense is not complex: verify every set of wiring instructions by phone, enable two-factor authentication on all email accounts used in real estate, and use secure closing portals when your title company offers them. Treat verbal wire verification like title insurance — non-negotiable, applied to every deal. If you become a victim, call your bank and the FBI IC3 immediately. Speed is the only thing that gives recovery a chance.