Email security for title and escrow companies: stop wire fraud at the inbox

A title or escrow office receives buyers' closing funds, pays off loans and sends sellers their proceeds, and most of the instructions for that money arrive by email. That makes your mailboxes the most valuable target in a real estate deal. This guide covers the email attacks that hit title and settlement companies specifically, what ALTA Best Practices 5.0 asks of you, and a checklist your office can put in place this month.

For the buyer's side of the same scam, see our guide to real estate wire fraud and fake closing instructions.

Why are title and escrow companies targeted by email fraud?

Title and escrow companies are targeted because they move large sums by wire on a predictable timeline, and a criminal who reads one closer's mailbox learns who is paying, how much and when. The FBI's June 2023 public service announcement says business email compromise (BEC) "targets all participants in real estate transactions," naming title companies alongside buyers, sellers, attorneys and agents.

Business email compromise (BEC) is fraud where a criminal impersonates or takes over a trusted email account to redirect a payment. The same FBI announcement reported a 27% increase in victim reports of BEC with a real estate nexus from 2020 to 2022, and a 72% increase in losses over the same period. Across all industries, the FBI's 2025 IC3 Annual Report recorded 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025.

Read the IC3's separate "Real Estate" figure with care. The 2025 report lists 12,368 complaints and $275,110,419 in losses under that crime type, which it defines as loss of funds from a real estate investment or "fraud involving rental or timeshare property." Hijacked closing wires usually fall under BEC instead, so no single IC3 number captures closing wire fraud.

Title offices also face a risk most businesses don't: the fraud can run through you without touching your bank account, because your name is on the fake instructions.

What email attacks hit title and escrow offices?

Title and escrow companies see six main patterns. Each one ends with money sent to the wrong account or a sale that should never have closed.

Fake closing instructions sent in your name

The classic attack is an email to the buyer, apparently from your escrow officer, saying the wiring instructions have changed. It comes either from a lookalike domain or from your own hijacked mailbox. The CFPB warned that scammers target real estate professionals to get into their email and learn about upcoming transactions, then send spoofed emails with false wiring instructions. Here's an example of the kind of message criminals send:

Example: "Hi Dana, our escrow bank has flagged the previous instructions for an audit. Please use the attached updated instructions for Friday's closing and send the wire today to avoid a delay. Reply here with the confirmation number. Thanks, Mark, Escrow Officer."

The defense is procedural: tell every buyer in writing, at file opening, that you will never change wiring instructions by email, and give them a number to call.

Seller proceeds and payoff redirection

The same trick runs in reverse at your end. A criminal emails as the seller, asking for proceeds to go to a new account, or sends a fake payoff statement with altered lender wiring details. ALTA's Outgoing Wire Preparation Checklist covers both: it asks you to record how instructions arrived, verify them "by calling the payee at a phone number obtained independently," and match payoff wires to "our company's list of validated wire instructions for common bank payoffs." Our guide to vendor invoice fraud and payment redirection gives a full call-back script.

Seller impersonation of vacant land

Seller impersonation is an email-first fraud aimed squarely at title companies. In PSA I-061626-PSA (June 16, 2026), the FBI warned that criminals "impersonate the owners of vacant property parcels" using fake IDs, email accounts and VoIP numbers, then contact a local realtor and title company to draft the sale contract. Proceeds go to a co-conspirator.

The FBI's red flags are useful as a checklist for your closers:

• The seller communicates only by email, text or VoIP numbers and avoids meeting in person.
• The seller pushes for a fast closing and may accept a price below market value.
• The seller knows little about the property or can't produce surveys or tax records.
• The seller wants international wires or payment to an account in another name or state.
• Documents arrive with unusual features, such as "property deeds notarized in a foreign country."

The FBI suggests sending a certified letter to the address on the land tax record to confirm the seller is the owner. ALTA Best Practices 5.0 also asks for an identity fraud prevention program with "protocols and processes to identify and respond to suspected fraud or impersonation attempts."

Phished staff mailboxes

All of these attacks get easier once a criminal is inside a closer's mailbox. The usual route is a fake sign-in page, often behind a document share notification or a fake e-signature request, which suits an industry that lives on shared documents. Attackers then add inbox rules that hide replies and forward anything about wires. Our guides to malicious inbox rules and signs an email account is compromised show what to look for.

What does ALTA Best Practices 5.0 say about email and wires?

ALTA Best Practices are the American Land Title Association's voluntary standards for title insurance and settlement companies, and version 5.0, approved by the ALTA Board on June 23, 2026 and effective October 8, 2026, asks for written, tested wire procedures, a written information security plan with multi-factor authentication and encryption, and annual security awareness training. The framework says these practices "are voluntary," but many lenders and underwriters ask agents to show they follow them. Here are the parts that touch email, at the time of writing (November 2026):

NPI (nonpublic personal information) is personal data such as information a consumer provides on a form or application and details of their transactions. A title file is full of it, which is why ALTA treats mailboxes as part of the information security plan rather than a side issue.

The framework's definitions section defines multi-factor authentication as verification using at least two of: something you know (a password), something you have (a token) or something you are (a biometric). Our guide to passkeys and phishing-resistant MFA explains why some kinds of MFA resist fake sign-in pages better than others.

This is general information about a voluntary industry standard, not legal advice. Your state regulator, underwriter and lender contracts may require more; ask your counsel or underwriter what applies to you.

How should a title office verify outgoing wire instructions?

Verify every outgoing wire by calling the payee on a phone number you obtained independently of the instructions, and record the call before anyone releases funds. This procedure follows ALTA's Outgoing Wire Preparation Checklist.

1. Record how the instructions arrived. In person, by mail or courier, by fax, by email or through a third party such as an attorney, agent or lender. Email and third-party instructions always need step 2.
2. Find the payee's number yourself. Use the original order or contract, a secure portal or your own search. The checklist is blunt: "never use the phone number included in an email."
3. Call and read the details back. Confirm the payee name, amount, bank, ABA routing number and account number, and write down the name of the person you spoke to and the date.
4. Match against the file. The account name and numbers should match the payee in the file, or for payoffs, an entry on your validated payoff list.
5. Use two people. The checklist has a separate wire creator and wire authorizer, each signing and dating.
6. Treat any change as a new wire. If instructions are "updated" after verification, start again at step 1.
7. Confirm receipt. Record the date sent, date received and who confirmed receipt. A fast confirmation call finds a diverted wire while it can still be recalled.

What should you do in the first hour after a wire fraud incident?

Call your bank's fraud department immediately and ask it to recall the wire and start the FBI's Financial Fraud Kill Chain, then file a complaint at ic3.gov. Speed decides whether money is frozen. ALTA's Rapid Response Plan opens with "Time is of the essence" and expects you to act on several steps at once:

1. Alert your internal response team by a pre-arranged group email or text: owner or manager, accounting, IT, legal counsel and your underwriter.
2. Call the sending bank's fraud department. Request a recall of the wire, a Hold Harmless Letter or Letter of Indemnity, and ask the bank to initiate the Financial Fraud Kill Chain. Also call the receiving bank and ask it to freeze the account.
3. Warn the other parties by phone on known numbers: buyer, seller, real estate agents, broker, attorneys, underwriter and notary. Tell them all further communication on the file happens by known, trusted phone numbers.
4. File at ic3.gov with victim details, the transaction, the recipient account and, for BEC, copies of the email headers.
5. Report to local police and your FBI field office, and ask the field office to initiate the Kill Chain too.
6. Call the sending bank again to confirm the recall was processed.
7. Document everything in a response worksheet, then contact your insurance carrier and outside counsel.
8. Find out how the attacker got in. Reset passwords, review sign-in and mailbox audit logs and remove rogue inbox rules.

The 2025 IC3 report shows why the IC3 complaint matters. In one August 2025 case, buyers wired over $449,000 after an email impersonating their attorneys. Once the complaint was filed, the IC3's Recovery Asset Team asked the recipient bank to freeze the account, and the bank reported "the full amount was still in the account and on hold." For the full recovery process, see recovering a BEC wire transfer.

How do you stop criminals sending email as your title company?

Publish SPF, DKIM and DMARC for your domain and move DMARC to an enforcing policy, so mail that fakes your exact domain is rejected by buyers' and lenders' mail providers. SPF lists the servers allowed to send your mail, DKIM signs each message, and DMARC tells receivers what to do when both fail. Include every service that sends as you, such as your title production software, closing portal and e-signature tool. An enforcing record looks like this example:

_dmarc.example-title.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-title.com"

Start at p=none, read the reports for a few weeks, then move to quarantine and reject. Our DMARC from none to reject guide walks through it, and the DMARC Checker shows where you stand today.

DMARC can't stop lookalike domains or a hijacked real mailbox. For lookalikes, run your domain through the Lookalike Domain Generator, register the closest variants you can, and read lookalike domain phishing. For the hijacked mailbox, MFA and the call-back rule are the answer.

Is Microsoft 365 or Google Workspace protection enough for a title company?

For a small title office, Microsoft 365 or Google Workspace configured properly is a reasonable baseline. Both filter spam and malware, support MFA and can tag external senders. If you haven't reviewed the settings, start with Microsoft 365 preset security policies or Google Workspace advanced phishing and malware protection, and give closers extra protection as described in executive and VIP email protection and Microsoft 365 priority accounts.

An MX-level filter adds a checkpoint in front of your platform. MX-level filtering means your domain's MX records point to a filtering service that checks mail before it reaches your mailboxes. It helps when phishing keeps landing in closers' inboxes, when staff need to release held mail from a quarantine digest without calling IT, and when you run several office or brand domains. iBlockSpam prices per domain with unlimited mailboxes; see our page on email security for real estate and title teams for how it fits a settlement office. No filter can stop a fake instruction sent from a real, compromised account, so the phone call stays mandatory.

Title and escrow email security checklist

1. Turn on MFA for every mailbox, your title production software, closing portal and bank portal.
2. Give buyers and sellers a written wire policy at file opening: you never change instructions by email.
3. Use ALTA's Outgoing Wire Preparation Checklist, with a separate wire creator and authorizer, on every outgoing wire.
4. Keep a validated payoff instruction list and call servicers on known numbers for any change.
5. Apply the FBI's seller impersonation red flags to every sale of vacant land.
6. Customize ALTA's Rapid Response Plan with names and phone numbers, and keep a printed copy.
7. Test the wire procedure at least annually and review the response plan at least annually.
8. Publish SPF, DKIM and DMARC for every domain you send from, including portal and e-signature senders.
9. Audit every mailbox each quarter for forwarding and inbox rules nobody created.
10. Run annual phishing and social engineering training for all staff, plus a refresher for new closers.

Next steps

• Run the free Email Health Check on your company domain to see your MX, SPF and DMARC setup.
• Download ALTA's Rapid Response Plan and fill in your bank's fraud line today, before you need it.
• Share our real estate wire fraud guide with buyers, and point mortgage partners to email security for mortgage brokers.
• If you want an inbound filtering layer every closer can manage from a digest email, see email security for real estate and title teams. Pricing is per domain, not per mailbox.

More threat guides are in our phishing and threats topic.