Real Estate Wire Fraud Defense
The scam that empties down-payment accounts. How to spot it, how to stop it, and what to do in the first 24 hours if you have already sent the wire.
Real estate wire fraud cost US victims more than 446 million dollars in 2023.
Source: FBI Internet Crime Complaint Center (IC3) Annual Report. The average single loss tops 90,000 dollars. Most victims are first-time home buyers and seniors moving for retirement.
How the scam plays out
A real estate transaction is the perfect target: large dollar amount, tight deadline, dozens of emails between strangers. Hackers know this and they have three main entry points.
Email interception during closing
Hook
Email from "your title company": "Hi — small change. Wire the closing funds to the account below by 3pm today so we can record on time."
How it works
A hacker quietly reads emails between you, your real estate agent, your lender, and your title company for weeks. The day before closing, they send a message that looks like it came from a real person on the closing team. The email matches the writing style. The signature looks right. The wire instructions are new. The account belongs to the thief.
Red flag
Wire instructions arrive by email — or change at the last minute. The reply-to address is one letter off (titlefirm.com vs titlefrim.com). The note pushes urgency: "wire today or we lose the close date".
What to do
Stop. Do not wire anything based on instructions you got by email. Call the title company on the phone number printed on a paper document you got days earlier — never the number in the email signature. Read the wire details aloud and confirm them digit by digit.
Fake escrow company website
Hook
"BadHomeOnline Escrow & Title — secure closing for modern buyers."
How it works
Some scams skip the email hack and build a fake escrow company from scratch. Slick website, fake reviews, fake address, fake licensing badges. The "agent" emails wire instructions that point to a brand-new bank account. By the time the closing date passes and the seller asks where the money is, the website is offline and the account is empty.
Red flag
Escrow firm you never heard of. No physical office you can visit. Reviews all posted in the same week. Website domain registered less than 6 months ago. License number does not match the state real-estate database.
What to do
Look up the escrow or title company on your state's Department of Insurance or Real Estate Commission website. Call the licensing board to confirm the firm is real. Drive past the office address. If anything feels off, walk away.
Spoofed agent / lender phone call
Hook
"This is Sarah from the title company — I am calling to confirm the wire instructions I emailed earlier."
How it works
After sending the fake email, the scammer calls you from a spoofed number that matches the real agent's caller ID. The voice may even be an AI clone of the real person, built from public videos. They sound friendly, professional, calm. They confirm the fake account number.
Red flag
They called you. Real closing teams almost never push you to wire same-day over the phone. The phone confirmation matches the suspicious email, not the original closing disclosure.
What to do
Hang up politely. Call back using the number on a document you received in person — closing disclosure, signed engagement letter, business card you were handed face to face. If the wire details on the call do not match what that real person tells you, you have caught the scam.
Buyer protection
Five rules that stop wire fraud before it happens. Print this list and keep it next to the closing paperwork.
Verify by phone — using a known number
Before you wire a single dollar, call the title company. Use a number from a piece of paper you received before today (closing disclosure, business card, mailed welcome letter). Never the number in the wire-instruction email. Never a number from a Google search. Read the wire details aloud and have them confirm.
Treat email as untrusted for money
Email is the weakest link in a real estate transaction. Anyone watching can see when you are about to close. Assume any wire instructions that arrive by email may be fake — even if they come from an address you have written to a hundred times. Phone confirmation is the only real defense.
Confirm the firm is real and licensed
Look up the escrow / title company on your state's real-estate or insurance regulator site. Confirm the office address on Google Maps Street View. Check that the website domain is not brand new (use whois.domaintools.com). A real firm has a paper trail going back years.
Watch for last-minute changes
Be especially careful in the final 48 hours before closing. Real wire instructions rarely change at the last minute. Any "small update", "new bank", or "different account" message in the final week is a red flag worth a phone call before you do anything.
Use wire-verification services if your title firm offers them
Some closing firms now use services like CertifID or FundingShield that confirm wire details with a verified phone call and matching identity check. If your title company offers it, accept. If they do not, ask your lender what protection they have in place.
What to do if you have been hit (act in the next 24 hours)
Recovery is possible — but the window is short. The FBI Financial Fraud Kill Chain has the best chance in the first 24-48 hours after the wire leaves your account. Do these five things in order, today.
Call your bank now — this hour
Tell them: "I sent a fraudulent wire and I need a wire recall right now." Ask for the wire-fraud team. Many banks can recall a wire if it has not been picked up by the receiving bank yet. Speed is the entire game.
File at IC3.gov within 24 hours
Go to ic3.gov and file an Internet Crime Complaint. Include the amount, the receiving account number, the receiving bank, and the wire reference number. The FBI's Recovery Asset Team can file what is called the Financial Fraud Kill Chain — a process that freezes funds at the receiving bank if reported fast enough.
The 24-72 hour window matters
The FBI's Financial Fraud Kill Chain works best in the first 24-48 hours and almost never works after 72 hours. After that, the money has been moved through layers of accounts and out of the country. Files reported in the first day have recovered hundreds of millions of dollars in real cases.
Notify your title company, agent, and lender
Email and call every party in the closing. They need to know there is a hacker in the email chain — the same hacker may try the next buyer. Ask the title company to alert their IT team. Save every email you have related to the wire as evidence.
Report locally and to the FTC
File a police report in your county — a paper report helps with any insurance claim. Report at reportfraud.ftc.gov. If a real estate agent or title firm name was used, report to your state's real-estate commission so they can warn others.
Where to report wire fraud
- ic3.gov — FBI Internet Crime Complaint Center (file within 24 hours)
- reportfraud.ftc.gov — Federal Trade Commission
- Your bank's wire-fraud line — ask for a wire recall and the SWIFT trace
- Your local police department — paper report number for any insurance claim
- State real-estate commission — if a licensed firm name was used in the scam
Related
Quick Tip: the day you sign a purchase agreement, write the title company's real phone number on a paper card and tape it to your monitor. That number is the only one you trust during closing week.