Sending wire instructions by email is not safe. The protocol email runs on was built in the early 1980s for speed, not confidentiality, and it offers no reliable protection for banking details that criminals can turn into stolen funds within hours. The FBI’s Internet Crime Complaint Center received over 21,000 business email compromise complaints in 2024, with reported losses above $2.77 billion.1Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report If you must exchange routing and account numbers electronically, treat email as unverified until you confirm every digit by phone through a number you already had before the transaction started.
Why Email Cannot Be Trusted With Banking Details
When you send an email, the message hops across a chain of servers before reaching the recipient. The standard protocol does not guarantee that only the intended recipient can read it. The data often travels as readable text and sits on multiple servers along the way, where anyone with access to the network infrastructure can copy or alter it.
That weakness becomes catastrophic when the message contains a routing number, an account number, and instructions to move six or seven figures. An attacker who compromises either party’s email account, or any server along the route, can read every message in the thread. They can watch a transaction develop for weeks, learning names, deal terms, and timing, then move at the exact moment the money is about to change hands.
How a Wire Redirection Scam Unfolds
The scheme follows a predictable pattern. A criminal gains access to the email account of someone in the transaction, often a real estate agent, title company employee, or attorney. They do not announce themselves. They set up forwarding rules and monitor the conversation quietly, sometimes for weeks, until wire instructions are about to be exchanged.
At that moment, the attacker sends an email from the compromised account, or from a nearly identical spoofed address, with fraudulent banking details. The message looks legitimate because the sender knows the deal terms, the parties, and the expected timing. A buyer expecting wire instructions from the title company receives what appears to be exactly that. The routing and account numbers point to an account the criminal controls, and by the time anyone notices, the money has often been withdrawn or moved overseas.
Who Absorbs the Loss
Most victims are shocked to learn how little legal protection they have. Wire transfers sit outside the consumer safeguards that cover debit cards and other everyday electronic payments. Federal regulations explicitly exclude wire transfers and similar bank-to-bank systems from the rules that would otherwise limit your liability for unauthorized transactions.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Commercial wire transfers are governed instead by Article 4A of the Uniform Commercial Code, adopted in some form by every state. The core rule: if your bank had commercially reasonable security procedures in place and followed them in good faith, the loss falls on you, the customer, even when the payment was unauthorized. Courts evaluate “commercially reasonable” against factors like the size and frequency of your typical transfers, the security options the bank offered, and what similar banks and customers use. Article 4A also generally blocks negligence suits against the bank over the same transaction, because the statute was designed as the exclusive framework for allocating wire losses.
Standard title insurance policies do not typically cover wire fraud either. Because the victim voluntarily initiated the transfer based on fraudulent instructions rather than suffering a direct hack, most insurers treat the loss as outside standard coverage. Specialty endorsements exist, but they carry their own limitations.
Verifying Wire Instructions Before You Send Money
Nearly every dollar lost to wire redirection fraud traces back to one failure: someone trusted an email without confirming the instructions through a separate channel. The fix is straightforward, but it requires discipline.
- Get instructions from a known source first. Before any wire details arrive by email, obtain the recipient’s banking information directly. Visit the title company or closing attorney in person, or call a phone number you already had on file. That gives you a baseline to compare against anything that later shows up in your inbox.
- Use a callback procedure. When wire instructions arrive electronically, call the sender at a phone number you independently verified before the transaction began. Do not use any number listed in the email itself. Read back every digit of the routing number and account number during the call. A single mismatched digit means the instructions have been tampered with.
- Check the routing number format. An ABA routing number is always nine digits. If what you received has more or fewer, or does not match the number on the recipient’s official bank documents, stop the transaction.3American Bankers Association. ABA Routing Number
- Insist on a secure portal. Many title companies and law firms now use encrypted document portals with multi-factor authentication that keep wire details off email entirely. If your closing agent does not offer one, ask why.
- Treat last-minute changes as a red flag. Fraudulent instructions almost always arrive as “updated” details at the last possible moment, when everyone is rushing to close. Any change to previously confirmed banking information should trigger a full re-verification, even if the email looks perfectly legitimate.
The callback step alone would prevent most of these scams. Criminals can forge emails. They cannot answer a phone at a number they do not control.
Safer Alternatives to Email
If you have to move sensitive financial data electronically, standard email is the wrong tool. Two encryption standards, S/MIME and PGP, can add end-to-end protection to email messages. Both use a mix of public-key and session-key encryption so that only the intended recipient can decrypt the content. S/MIME relies on certificates issued by trusted authorities and integrates into most major email clients. PGP uses a decentralized model where users verify each other’s keys. The two are not compatible with each other, so both parties need to use the same one.
In real estate and business transactions, most closing agents have moved toward purpose-built secure portals rather than encrypted email. These platforms require the recipient to authenticate before viewing anything, create an audit trail of who accessed what, and keep sensitive data off email servers. For anyone who handles wire instructions regularly, a secure portal is a better investment than getting every counterparty set up with matching encryption.
What to Do If You Already Sent the Wire
Speed is everything. Recovery rates collapse after the first 24 hours and drop into single digits once that window closes. If you realize you wired money based on fraudulent instructions, treat the next few hours as the most financially consequential of your life.
- Call your bank’s wire department immediately. Request a SWIFT recall and a fraud freeze on the transaction. If you catch the error within minutes, the bank may be able to cancel the wire before it finishes processing. Even a fully processed wire can sometimes be frozen if the receiving bank cooperates, though it is not legally obligated to return the funds.
- File a complaint with the FBI’s Internet Crime Complaint Center. IC3 operates a Recovery Asset Team designed to freeze fraudulently obtained funds in domestic accounts. In 2022, the team achieved a 73 percent freeze rate on reported losses. Filing this report is the mechanism that triggers the interbank freeze process.4Internet Crime Complaint Center (IC3). Home Page – Internet Crime Complaint Center (IC3)
- File a local police report. This creates a formal record you will need for insurance claims, tax deductions, and any civil litigation.
- Notify every party to the transaction. Your real estate agent, title company, and attorney need to secure their accounts and warn other clients who may have been targeted through the same breach.
Once funds leave the domestic banking system or convert to cryptocurrency, recovery becomes nearly impossible. Every minute you spend gathering information before that first call is a minute the criminal uses to move the money further out of reach.
Insurance Coverage Is Narrower Than People Assume
Standard business insurance and title insurance almost never cover losses from wire redirection. The gap exists because the policyholder voluntarily authorized the transfer. Insurers distinguish between a hacker breaking into your bank account and a criminal tricking you into sending money to the wrong place. The first looks like unauthorized access. The second looks like an authorized transfer based on bad information.
Coverage does exist, but you have to go looking for it. A social engineering fraud endorsement can be added to a commercial crime or cyber liability policy, covering losses from transfers made in good faith based on fraudulent instructions. The catch is the sublimit: coverage typically ranges from $10,000 to $250,000, which may not come close to a real estate transaction or large business payment. Some policies bury the coverage under names like “fraudulent instruction coverage,” so read the actual policy language rather than relying on the endorsement title. Before closing, ask your title company whether it carries this coverage and what its per-transaction limit is.
Tax Treatment of a Wire Fraud Loss
A wire fraud loss may create a deductible theft loss on your federal return, but the rules depend on whether the stolen funds were tied to a business or investment or were purely personal.
If the loss arose from a transaction entered into for profit, such as a business payment or investment transfer, you can generally claim a theft loss deduction under Section 165 of the Internal Revenue Code.5GovInfo. 26 USC 165 – Losses The deduction is available for the year you discover the theft, reduced by any amount you have a reasonable prospect of recovering through insurance or litigation.
Personal losses are far more restricted. For tax years after 2017, individuals can only deduct personal casualty and theft losses if they are attributable to a federally declared disaster.6Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts Wire fraud does not qualify, so a homebuyer who loses a down payment to a redirection scam generally cannot deduct that loss on a personal return. A narrow exception applies only if you have personal casualty gains in the same tax year that offset the loss. Talk to a tax professional before assuming you qualify, because the interaction between these rules and any pending recovery efforts or insurance claims affects both the timing and the amount of any deduction. Keep the police report, the IC3 filing, bank correspondence, and any recovery documentation, since all of it supports the deduction if you are eligible.