# Real estate wire fraud: how fake closing instructions work and how to stop them

URL: https://iblockspam.com/blog/real-estate-wire-fraud-closing-scams
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How criminals send fake closing and wiring instructions to home buyers, how to verify a wire safely, what title and escrow firms should do, and what to do fast.

## Short answer

Real estate wire fraud is an email, apparently from your agent, title company, escrow officer or attorney, that sends new wiring instructions for your closing funds. The account is a criminal's. Never act on wiring instructions sent by email: call a number you got independently. If you've sent money, call your bank for a recall, then file at ic3.gov.

Buying a home is often the biggest payment a person ever makes, and it usually moves by wire. Criminals know this. They send an email that looks like it comes from the title company, escrow officer, attorney or agent, with "updated" wiring instructions, and the closing funds go to their account instead. This guide explains how the scam works, how buyers and closing offices can stop it, and what to do in the first hour if money has gone.

## What is real estate wire fraud?

The FBI treats it as a form of [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) (BEC). Its [June 2023 public service announcement](https://www.ic3.gov/PSA/2023/psa230609) says the scam "targets all participants in real estate transactions," including buyers, sellers, real estate attorneys, title companies and agents.

Once a criminal gets into the email account of someone involved in the deal, the FBI says they send "the fraudulent request for a change in payment type (frequently from check to wire transfer) or a change from one bank account to a different bank account under their control." The money may then move on "to a secondary fraudulent domestic or international account," which makes it harder to recover.

The same announcement reported a 27% increase in victim reports of BEC with a real estate nexus from 2020 to 2022, and a 72% increase in losses over the same period. The FBI noted the rise in losses may partly reflect higher real estate prices.

### How the IC3 counts it

The 2025 [IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) lists 12,368 complaints and $275,110,419 in losses under its "Real Estate" crime type. Read that figure with care: the IC3 defines that category as "loss of funds from a real estate investment or fraud involving rental or timeshare property." Hijacked closing wires usually fall under BEC instead, which the IC3's Recovery Asset Team labels "BEC/Real Estate." So no single IC3 number captures closing wire fraud on its own.

## How do criminals find your deal?

The fake email often knows your address, price and closing date. There are two common reasons.

1. **They're inside a mailbox.** The FBI says criminals gain access to "a participant's email account" and then monitor the deal. The [CFPB](https://www.consumerfinance.gov/about-us/blog/mortgage-closing-scams-how-protect-yourself-and-your-closing-funds/) warned that "scammers are increasingly targeting real estate professionals" to get access to their email and learn about upcoming transactions. A compromised agent mailbox exposes every client at once. Our guide to [email thread hijacking](https://iblockspam.com/blog/email-thread-hijacking) explains how attackers reply inside a real conversation.
2. **They use public data.** A [2018 IC3 announcement](https://www.ic3.gov/PSA/2018/PSA180712) said attackers "will use information that is publicly available on real estate listing sites to target victims." Listings, agent pages and public records give them names, roles and timelines.

The sending address may be the real party's hijacked account, a free webmail account using the right display name, or a [lookalike domain](https://iblockspam.com/blog/lookalike-domain-phishing) that differs from the real one by a letter. NAR warns that "Criminals will use a similar-looking (but fake) email address and steal a logo and other info to make it look like the email came from your real estate agent or title company."

## What are the red flags of a fake closing email?

| Red flag | Why it matters |
|---|---|
| New or "corrected" wiring instructions | NAR says "It's extremely rare that wiring instructions will change at the last minute." |
| A switch from check to wire, or to a new bank | This is the exact change the FBI describes |
| Urgency: "wire today or you'll lose the closing date" | Pressure stops you from calling to check |
| A new phone number in the email or signature | It may ring the criminal |
| A receiving account name that isn't the title or escrow company | Closing funds normally go to the settlement firm's escrow account |
| A sender domain that's slightly off | Lookalike domains pass a quick glance |
| A request to keep it quiet, or to stop copying your agent | Scammers want fewer people checking |

None of these signs is reliable on its own. If the email comes from the real party's hijacked mailbox, it can look perfect. That's why the safe rule is about procedure, not about spotting the fake.

## How should buyers verify wiring instructions?

The single rule that stops most of these losses: **never act on wiring instructions received by email**. The CFPB put it plainly: "Never follow instructions contained in an email." Use this procedure instead.

1. **Set up trusted contacts early.** At the start of the deal, the CFPB suggests choosing two trusted people, such as your agent and settlement agent, and confirming the closing process and payment instructions with them in person or by phone. Write down their names and numbers then, before any emails about money arrive.
2. **Consider a code phrase.** The CFPB also suggests agreeing a code phrase that only those trusted parties know.
3. **Call, don't click.** When instructions arrive, call your title or escrow officer on the number you recorded, or one from the company's official website that you typed in yourself. Don't use any number or link in the email. Read the bank name, account name and account number back to them.
4. **Ask your bank to check the name.** NAR advises: "Ask your bank to confirm the name on the receiving account before sending a wire."
5. **Confirm receipt quickly.** NAR says: "Within four to eight hours, call the title company or real estate agent to confirm they received your money." If they haven't, you'll find out while there's still time to act.
6. **Don't send financial details by email.** Both the CFPB and NAR warn against emailing bank or personal information.

If you're unsure about any message, open the headers with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). It shows which server actually sent the email, though a hijacked real mailbox will still look genuine, so the phone call remains the real check.

## What should title, escrow and agent offices do?

Buyers can't carry this alone. Closing offices handle many transactions, and one compromised mailbox puts all of them at risk.

### Tell every client how you'll pay and be paid

- Give clients your wiring policy in writing at the start of the transaction, not in the same email thread as the instructions. Say you will never change wiring instructions by email.
- NAR suggests adding a wire fraud notice to your email signature and using "a transaction management platform or secure email" with clients.
- Call the buyer before the closing date to confirm they know the process and have your real number.

### Lock down the mailboxes

- Turn on multifactor authentication for every account, as NAR also recommends. Stolen passwords are how most closings get hijacked.
- Watch for signs of a [compromised account](https://iblockspam.com/blog/signs-email-account-compromised), especially new [inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) that hide replies or copy mail to an outside address.
- Remove access promptly when agents, assistants or contractors leave.

### Protect your domain and your clients' inboxes

- Publish a DMARC policy at enforcement so criminals can't send email as your exact domain. Check your current record with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker). DMARC doesn't stop lookalike domains or hijacked real accounts, so it's one layer, not the answer.
- Register obvious misspellings of your domain if you can, and watch for new lookalikes.
- Filter inbound mail for impersonation and lookalike domains, and tag external email so staff notice when a "colleague" writes from outside.

### Verify outbound payments too

The same scam runs in reverse. Sellers' proceeds and mortgage payoffs can be redirected by fake emails sent to the closing office. Apply the same call-back rule to any change in where you send money, as covered in our guide to [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

## What should you do if you've already wired the money?

Speed decides whether the money comes back. The [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) says: "If you discover a fraudulent transfer, time is of the essence."

1. **Call your bank now.** The FBI advises you to "contact your financial institution and request a recall of the funds along with any necessary indemnification documents." Do this before anything else.
2. **File a complaint at [ic3.gov](https://www.ic3.gov).** The IC3 says to do it "regardless of the amount lost" and to include "the full transaction details." NAR adds that "Making a report within the first 24 hours provides the best chance of recovering your money."
3. **Call your title or escrow office and your agent** on known numbers, so they can secure their systems and warn other clients.
4. **Report it to your local FBI field office,** which NAR also recommends.
5. **Keep the evidence.** Save the original emails with full headers, the wiring instructions and your bank's transfer confirmation.

### How the Recovery Asset Team helps

The IC3's Recovery Asset Team (RAT) works with banks through the Financial Fraud Kill Chain to freeze stolen funds. In 2025 it initiated 3,900 of these incidents across all fraud types, with $679,013,183 frozen, a 58% success rate, according to the [2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf).

The same report describes a real closing. In August 2025, buyers "were closing on a home when they received an email impersonating their legitimate attorneys." They wired over $449,000. Their attorneys' separate attempts to reach the recipient bank got nowhere, but once the IC3 complaint was filed, the RAT asked the recipient bank to freeze the account, and the bank reported that "the full amount was still in the account and on hold." Fast reporting made the difference.

## Next steps

- If you're buying: write down your title officer's and agent's phone numbers today, and agree that wiring details will only ever be confirmed by phone.
- If you run a title, escrow or brokerage office: put your wiring policy in writing, add a wire fraud notice to your signature, and turn on MFA for every mailbox.
- Check that your domain enforces DMARC with the [Email Health Check](https://iblockspam.com/tools/email-health-check).
- Share our guides on [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) and [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email) with your team.
- iBlockSpam filters phishing, spoofing and impersonation attempts before they reach every mailbox on your domain. See [how it works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Do title companies ever change wiring instructions by email?

Treat any change by email as fraud until proven otherwise. The National Association of REALTORS says it's extremely rare for wiring instructions to change at the last minute. A genuine change can always be confirmed by calling the title or escrow office on a number you found yourself, such as one from your contract or the company's official website.

### How do I safely confirm wiring instructions for a home closing?

Call your title or escrow officer on a number you got independently, not one in the email, and read back the bank name, account name and account number. Ask your bank to check the name on the receiving account before sending. Then call again within a few hours to confirm the money arrived.

### Can I get my closing funds back after wiring them to a scammer?

Sometimes, if you act fast. Call your bank immediately and ask for a wire recall, then file a complaint at ic3.gov with the full transaction details. The FBI's Recovery Asset Team works with banks to freeze funds. NAR says a report in the first 24 hours gives the best chance of recovery.

### How do scammers know when I'm buying a house?

They often read the deal from the inside. The FBI says criminals break into the email of a buyer, seller, agent, attorney or title company and watch the transaction, then time a payment request. They also use public listing sites to pick targets. That's why the fake email can mention your address, price and closing date.

### Is a phone number in the wiring email safe to call?

No. A number in the email, its signature or an attached PDF may ring the criminal. The CFPB says to avoid using phone numbers or links from emails. Use a number you agreed with your agent or settlement agent early in the deal, or one from the company's official website that you typed in yourself.

## Sources

- [FBI IC3 PSA: Business Email Compromise: The $50 Billion Scam (June 2023)](https://www.ic3.gov/PSA/2023/psa230609)
- [FBI IC3 PSA: Business E-mail Compromise: The 12 Billion Dollar Scam (July 2018)](https://www.ic3.gov/PSA/2018/PSA180712)
- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [CFPB: Mortgage closing scams, how to protect yourself and your closing funds (2019)](https://www.consumerfinance.gov/about-us/blog/mortgage-closing-scams-how-protect-yourself-and-your-closing-funds/)
- [National Association of REALTORS: Protect your money from mortgage closing scams](https://www.nar.realtor/financing-credit/protect-your-money-from-mortgage-closing-scams-when-buying-a-home)
- [National Association of REALTORS: Wire fraud](https://www.nar.realtor/wire-fraud)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/real-estate-wire-fraud-closing-scams (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt