To protect your closing funds from wire fraud, verify every wire instruction by voice before you send a dollar, using a phone number you obtained independently rather than one in the email. That single habit defeats the scheme that stole more than $275 million from real estate buyers and sellers in 2025 alone.1Internet Crime Complaint Center (IC3). 2025 IC3 Annual Report The FBI’s Internet Crime Complaint Center logged 12,368 real estate fraud complaints that year, and the pattern behind almost all of them is the same: a criminal quietly reads a real estate professional’s email for weeks, then sends you fake wire instructions right before closing.
How the Scam Reaches You
The attack begins long before you hear about it. Criminals compromise the email account of a real estate agent, title company employee, or closing attorney, usually through phishing or a weak password. They don’t act right away. They watch the inbox, learn the deal, and wait for the wire.
A day or two before closing, an email arrives that looks like it came from your title company or attorney. It quotes the correct property address, the correct dollar amount, and the right names. It contains new wire instructions. The account belongs to the criminal, and once you send the money, it typically moves through several accounts or into cryptocurrency within hours. The FBI classifies this tactic as Business Email Compromise, and speed is what makes it so hard to unwind.2Internet Crime Complaint Center (IC3). Business Email Compromise: The $55 Billion Scam
Red Flags in the Email
Fraudulent emails pass a quick glance. They rarely survive a careful one.
The single biggest warning sign is any message claiming that wire instructions have changed close to the closing date. Legitimate title companies rarely change bank accounts, and when they do, it doesn’t happen through a last-minute email.
Look closely at the sender’s address. Attackers register domains that differ by one character: an “m” swapped for “rn,” an extra letter tucked in, a zero standing in for the letter “o,” or a hyphen added (“titlecompany-llc.com” instead of “titlecompanyllc.com”). On a phone screen, these are nearly invisible.
Other tells: unusual urgency (“wire must go today or the deal falls through”), a reply-to address that doesn’t match the display name, formatting that looks slightly off compared with previous emails from the same firm, and requests to keep the new instructions confidential or to avoid calling the office to confirm. A real closing professional wants you to verify.
The Verification Routine That Actually Works
Verification only helps if you set it up before closing week, not during it. The Consumer Financial Protection Bureau recommends identifying two trusted contacts on the transaction early, confirming their phone numbers in person or by phone, and agreeing on a way to verify their identity later.3Consumer Financial Protection Bureau. Mortgage Closing Scams: How to Protect Yourself and Your Closing Funds
When wire instructions arrive, call the title company or closing attorney using the number you obtained independently. Not the number in the email. Fraudulent emails often list a phone number that rings straight to the scammer, and using it turns your “verification call” into part of the scam. On the call, read back the routing number and account number digit by digit, and confirm the beneficiary name matches exactly.
A few habits that reinforce the routine:
- Never email financial information, and treat any wire instructions received only by email as unverified until you’ve confirmed them by voice.
- When you initiate the wire at your bank, put the property address in the purpose field so the transaction leaves a clear paper trail.
- If anything about the instructions changes, verify again by phone, even if you already verified once.
The CFPB’s guidance on this is blunt: never follow wiring instructions contained in an email without independent confirmation first.3Consumer Financial Protection Bureau. Mortgage Closing Scams: How to Protect Yourself and Your Closing Funds
Safer Alternatives to Emailed Wire Instructions
A growing number of title companies deliver wire instructions through encrypted online portals rather than email. These platforms require multi-factor authentication, keep wiring details out of email entirely, and can verify bank account ownership before funds are sent. If your title company offers a secure portal, use it. If they don’t, ask why not.
Some title companies accept cashier’s checks for smaller amounts. Policies vary, but many set a threshold (often around $5,000 to $10,000) above which a wire is required. Cashier’s checks carry their own fraud risks, including counterfeiting, and they clear more slowly than wires, which can delay closing. Confirm acceptable payment methods with your closing agent well before closing day.
If You Already Sent the Money: The First 24 Hours
The window for recovering a fraudulent wire is brutally short. The order of operations matters.
First, call your bank’s fraud department, not law enforcement. Request an immediate wire recall. Banks can initiate a recall through the Federal Reserve’s Fedwire system, but the receiving bank is not obligated to return funds once they’ve been deposited, so every hour counts.
Second, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Include the wire confirmation receipt, the transaction date and time, and any reference numbers from the transfer, which your bank can provide. Preserve every related email with full headers intact; those headers contain the IP addresses investigators need. The CFPB’s sequence is the same one: contact your bank first, then report to IC3.3Consumer Financial Protection Bureau. Mortgage Closing Scams: How to Protect Yourself and Your Closing Funds
Third, file a local police report. Local police rarely investigate international cybercrime, but the report creates an official record you may need for insurance claims or civil litigation. Then compile everything, the fraudulent emails, the legitimate wire instructions, phone logs, and a timeline of events, into one chronological file.
Filing with IC3 doesn’t mean an agent will call you back. The IC3 is an intake center, not an investigative unit, and it states plainly that filers will not be contacted by IC3 itself.4Internet Crime Complaint Center (IC3). IC3 Frequently Asked Questions Filing still matters, because it feeds the IC3’s Recovery Asset Team, which coordinates with banks and FBI field offices to freeze fraudulent transfers. In 2024, that process handled over 3,000 complaints involving $848 million in attempted theft, and domestically the team froze $469 million across 2,651 cases, a 66% success rate. International recoveries added $92.5 million.5Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report Those numbers depend on speed. The sooner the complaint reaches the team, the better the chance the funds are still sitting somewhere they can be frozen. For international transfers, a SWIFT recall notice must be initiated by your bank, which is another reason to call the bank before you file anything else.6Department of Justice. FBI International Kill Chain Process
Who Ends Up Paying
In most cases, the buyer who sent the wire bears the loss. Wire transfers are treated as authorized by the sender, and banks generally have no legal obligation to make you whole after you initiated the transfer yourself, even if you were tricked.
Standard title insurance does not cover wire fraud losses. Title insurance protects against defects in the title to the property, things like undisclosed liens, forged deeds, or boundary disputes. A buyer who wired money to a criminal has no title defect; they have a theft loss. Specialized wire fraud insurance products exist for title companies, but those protect the company, not you.
Whether anyone else shares liability usually turns on whether the title company, attorney, or real estate agent used commercially reasonable security measures, including things like strong passwords, multi-factor authentication, and encrypted delivery of wire instructions. Cases along these lines are expensive to litigate and unpredictable in outcome. In one federal appellate decision, the court held that the customer bore the loss after an employee fell for a phishing attack, because the bank’s security procedures were deemed commercially reasonable.
The practical lesson runs through every part of this: preventing the fraud is far more reliable than recovering from it. A five-minute phone call to a number you looked up yourself is the difference between a normal closing and a disaster you may never fully undo.