Wire Fraud at Closing: The 5-Minute Fix That Stops It

The scam that empties a buyer's down payment is boring, well-rehearsed, and preventable. Here's exactly how it unfolds and the protocol that kills it.

The short answer

To protect yourself from real estate wire fraud, never trust wiring instructions sent by email. Before sending any funds, call your title company at a number you independently verified—not one from the email—and confirm the routing and account numbers verbally. This five-minute call defeats nearly every business email compromise scheme.

How big is the wire fraud problem in real estate?

The number that should scare you

According to the FBI's Internet Crime Complaint Center (IC3), business email compromise—the category that includes real estate wire fraud—has driven billions of dollars in reported losses in recent years, with real estate and rental transactions among the hardest-hit sectors. Individual buyers routinely lose their entire down payment, often six figures, in a single wire.

Wire fraud in real estate is a scam where a criminal impersonates your title company, closing agent, or attorney and tricks you into wiring your closing funds to a fraudulent account. The money moves fast and is often unrecoverable within hours.

Here's the uncomfortable truth: this isn't sophisticated hacking. The attacker doesn't need to break into a bank. They monitor an inbox, wait for a real estate deal to appear, and send one convincing email at exactly the right moment. According to the FBI IC3, the losses tied to this pattern run into the billions annually across all industries.

The reason it works is timing and trust. You're already expecting wiring instructions. You're stressed, you're moving, and a message that looks like it's from your closing agent lands right on schedule. Most victims never suspect a thing until the money is gone.

BillionsAnnual reported BEC losses across all sectorsFBI IC3
Six figuresTypical down payment at risk in a single wireNAR
HoursWindow to recover funds before they vanishFBI IC3

How the scam unfolds, day by day

The attack has a rhythm. Understanding the sequence is the fastest way to spot it, because every legitimate closing follows a different one.

  1. 01

    Weeks before: quiet surveillance

    A criminal gains access to an email account somewhere in the transaction chain—often a real estate agent, a lender, a title employee, or even the buyer. They don't act. They read. They learn the closing date, the parties' names, the writing style, and the dollar amount. This is why it feels so real later.

  2. 02

    3-5 days out: the setup

    The attacker registers a lookalike email domain—swapping one letter, adding a hyphen, or using a display name that matches your agent. They draft a message in the same tone, referencing your actual property and closing date. Nothing feels off yet.

  3. 03

    1-2 days before closing: the strike

    You receive an email with 'updated wiring instructions' or 'a change to our banking details.' It cites a plausible reason—a bank merger, an audit, a routing update. The urgency is subtle but present: send today to stay on schedule. The account belongs to the criminal.

  4. 04

    Wire day: the drain

    You wire the funds. Within hours the money is pulled out, split, and moved offshore or through mule accounts. According to the FBI IC3, recovery depends on catching it in the first 24-72 hours—which almost never happens because nobody knows anything is wrong.

  5. 05

    Closing day: the discovery

    Your title company asks where the money is. You say you sent it. They say they never changed the instructions. That's the moment the floor drops out.

The contrarian point most people miss: your own email being clean doesn't protect you. The breach can happen anywhere in the chain—your agent's Gmail, a paralegal's laptop, a lender's inbox. You can do everything right and still receive a perfect forgery. That's precisely why verification has to be verbal and independent.

The wire verification protocol that defeats it

This checklist takes about five minutes and stops nearly every wire fraud scheme cold. Run it every single time, even if the instructions look identical to what you already have. Especially then.

Checklist

0/8

Wire verification protocol (do this before every wire)

One structural fix worth demanding: ask your title company how they deliver wiring instructions. The strongest firms use secure portals, verbal-only confirmation policies, and give you a wire fraud warning up front. If yours emails a PDF and hopes for the best, that's a red flag about the whole operation.

A quiet benefit of platforms like One Home Agent is that closing documents and verified contacts live in one secure place after the deal—so a homeowner always has a trusted reference point instead of digging through an inbox full of forgeable emails.

Red flags vs. legitimate changes

Not every email about your closing is a scam. But the difference between a fraud attempt and a legitimate communication is almost always visible if you know what to compare.

Wire fraud red flags vs. how legitimate title companies operate
SignalFraud red flagLegitimate practice
Wiring instructionsSent or 'updated' by email at the last minuteProvided early, confirmed verbally, often via secure portal
Sender addressLookalike domain or mismatched display nameExact, consistent domain you've corresponded with
ToneUrgent, pressures you to send todayCalm; encourages you to verify by phone
Banking changes'Bank merger' or 'audit' requires new account nowChanges are rare and always confirmed by a live call
VerificationDiscourages calling; gives a new number in the emailActively invites you to call the number on file
Beneficiary nameAccount name doesn't match the title companyAccount name matches the company exactly

The buyers who lose money aren't careless—they're trusting. A forged email arrives right on schedule, references their real address, and matches their agent's voice. The only reliable defense is a phone call to a number you got somewhere other than that email. Five minutes beats a six-figure loss every time.

Todd Paton, Partner, One Home Agent

Bottom line

Wire fraud is preventable with one habit: verify wiring instructions by phone, using an independently sourced number, before every transfer. Treat every emailed change as suspect. Title companies that build verification into their process—not as an afterthought—are the ones buyers should trust with the biggest check they'll ever write.

For title companies: turn safety into a differentiator

Buyers remember the closing where nothing went wrong. Title companies that visibly protect clients from wire fraud—clear warnings, verbal verification, secure document delivery—earn referrals that price competition can't touch. Safety is a marketing asset, not just a compliance checkbox.

Give every buyer a lifetime of secure home management

One Home Agent lets title companies white-label an AI home platform where closing documents, verified contacts, and homeowner support live securely long after the deal closes. Stay the trusted brand your clients turn to.

See how it works for title companies

Frequently asked questions

Recovery is possible but rare, and it depends on speed. According to the FBI IC3, funds must usually be flagged within 24 to 72 hours before criminals move them beyond reach. Contact your bank immediately and file a report at ic3.gov to trigger a potential recall of the wire.

Sources & further reading

  1. FBI Internet Crime Complaint Center (IC3)
  2. American Land Title Association (ALTA)
  3. Consumer Financial Protection Bureau — Closing on a home
  4. National Association of Realtors — Research & Statistics

Keep reading

Title CompaniesWhat Does a Title Company Do in a Home Purchase?8 min readTitle CompaniesHow a Title Company Differentiates Beyond Rate8 min readTitle CompaniesWhat Happens to Your Documents After Closing on a House7 min read