Real estate wire fraud: how closings get hijacked and how to stop it

How real estate wire fraud works

Real estate wire fraud is a sophisticated form of social engineering. It begins when a criminal hacks into the email account of someone involved in a real estate transaction, such as an agent, a lawyer, or a title company employee. The attacker then sits silently and watches the conversation. They learn the names of the buyers and sellers, the property address, the closing date, and the expected amount of the wire transfer. This reconnaissance phase can last for weeks as the attacker waits for the most opportune moment to strike.

Right before the closing, the attacker sends an email to the buyer that appears to be from the agent or the title company. The email often claims there has been a last-minute change to the wiring instructions and provides a new account number. The email looks legitimate, uses the correct jargon, and arrives at exactly the time the buyer is expecting it. The buyer, often stressed and in a hurry, follows the new instructions, sending their life savings to a criminal's account. This simple act can destroy years of savings and end a home-buying dream in seconds.

Identifying the red flags of a wire scam

While these attacks are sophisticated, they almost always have warning signs. Learning to spot these red flags is the best way to prevent real estate wire fraud. Attackers rely on creating a sense of urgency or secrecy to prevent you from double-checking their requests. They know that in the final days of a real estate deal, everyone is moving fast, and that speed is the attacker's greatest ally.

• Any 'last-minute' changes to wiring instructions or payment methods.
• Requests for secrecy or instructions not to call to verify the change.
• Emails sent from an address that is slightly different from the official one (e.g., .net instead of .com).
• A sense of extreme urgency, claiming the closing will fail if the money isn't sent immediately.
• Emails sent outside of normal business hours, such as late at night or on weekends.
• Changes in the tone of voice or the way a contact usually writes their emails.

Verification is your strongest defense

The most effective way to stop real estate wire fraud is to step outside of email entirely. Never rely on the information in an email to verify wiring instructions. Always call the person you believe sent the email using a phone number you already have or one you find on their official website. This 'out-of-band' verification is the single most effective barrier against social engineering.

The buyer's role in wire safety

Buyers are often the last line of defense in real estate wire fraud. It is your money at risk, so you have every right to be cautious. From the very beginning of the process, ask your real estate agent and the title company for their official wire transfer procedures. If they don't have a clear, written process, that is a red flag in itself. When the time comes to send the wire, go to your bank in person if possible. Discuss the transfer with the bank officer and ask them to double-check the recipient's information.

Remember that once a wire is sent, it is very difficult to get back. Taking ten extra minutes to verify the details can save you from a lifetime of financial loss. Don't let the pressure of a closing date push you into making a mistake.

Protecting your email account

Since most wire fraud starts with a compromised email account, securing your inbox is vital for real estate professionals. Real estate agents are often on the move and use multiple devices, which can make them more vulnerable. If your email is compromised, you aren't just putting yourself at risk; you are putting every one of your clients' transactions at risk. A single breach can lead to multiple hijacked closings.

1. Enable multi-factor authentication (MFA) on all your email and business accounts.
2. Use a password manager to create and store strong, unique passwords for every service.
3. Regularly check your email settings for any unauthorized 'forwarding rules' that might be sending copies of your messages to an external address.
4. Be extremely cautious when clicking links or downloading attachments in emails, especially from 'new clients.'
5. Avoid using public Wi-Fi for any sensitive business tasks, and always use a VPN when working remotely.

Working with tech-forward title companies

When choosing a title company or an escrow officer, ask them about their security practices. Do they use a secure portal for communicating wiring instructions? Do they require verbal verification for all transfers? A company that takes security seriously will be happy to explain their processes to you. In the modern real estate market, a commitment to cybersecurity is just as important as a commitment to customer service.

What to do if you suspect wire fraud

If you realize that money has been wired to a fraudulent account, every second counts. The faster you act, the higher the chance that the funds can be frozen before they are moved again. You must move quickly through several critical channels simultaneously. There is a very short window—often less than 24 hours—where the money might still be within the reach of the banking system.

Immediately contact your bank and ask them to send a recall notice to the receiving bank. Next, call the FBI's local field office and report the fraud. You should also file a complaint with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Finally, notify all other parties in the transaction so they can take steps to secure their own systems and warn other potential victims.