Wire fraud in real estate: how the scam works and how to stop it

How the attack works

Criminals monitor a compromised email account in the transaction — often an agent's or a party's personal inbox — and wait until closing is near. They then send instructions that look like a normal follow-up, changing only the receiving bank details.

The message usually mirrors real signatures, real file numbers and real names, because the attacker has been reading the thread for weeks.

Warning signs

• Any last-minute change to wire instructions, however plausible the reason
• Urgency, secrecy or pressure to send before a deadline
• A reply-to address that differs by one character from the real domain
• Instructions sent only as an attachment, or a new phone number in the signature

The rule that prevents it

Call to verify every wire instruction, before every transfer, using a phone number you obtained independently — from an earlier document or the firm's website — not one from the email. Confirm the receiving bank name, the account name and the last four digits verbally.

Never send account numbers, identification images or wire details through a contact form or unsecured email.

If you think funds were misdirected

Act within hours, not days. Contact your bank and request a recall, notify the closing agent immediately, and file a report with the FBI's Internet Crime Complaint Center. Recovery odds fall sharply after the first day.