Wire fraud at closing: how to protect your down payment
July 28, 2026 · 4 min read
Business email compromise remains one of the most damaging crimes in residential real estate. The pattern is consistent: a criminal quietly monitors email between a buyer, an agent and a settlement office, waits until the days before closing, then sends convincing wire instructions from a lookalike address. The money leaves and is often gone within hours.
How the scam actually works
The attacker rarely breaks into a bank. They compromise or spoof an email account somewhere in the transaction, learn the closing date and the amount, and then send instructions that copy the real signature block, logo and tone.
Common tells include a domain that is off by one character, a sudden change to previously issued instructions, a new sense of urgency, and a request to keep the change quiet or handle it quickly.
The call-back rule
Never trust wire instructions received by email, even if they look identical to earlier messages. Before sending a dollar, call the settlement office using a phone number you obtained independently, from the agreement of sale, the office website or a prior in-person conversation.
Do not call a number printed in the email containing the instructions. That number belongs to the attacker.
- Verify instructions verbally, every time, with a known number
- Confirm the receiving bank name and the last four digits of the account
- Ask your bank to confirm the beneficiary name matches the title agency
- Treat any change to instructions as fraud until proven otherwise
- Send a small test wire when your bank allows it
If you already sent the money
Speed decides everything. Call your bank immediately and request a recall of the wire under the FinCEN Rapid Response Program. Then contact the settlement office, file a report at the FBI's IC3 portal, and notify local law enforcement.
Funds recovered within the first 24 to 72 hours are recovered far more often than funds reported a week later.
What a good title agency does on its side
We keep client funds in segregated escrow accounts, verify disbursement instructions by voice, and never send changed wiring instructions by email. If you receive an email from anyone claiming our instructions have changed, stop and call the office at the number on this site.
Frequently asked questions
- Will Good Shepherd Title ever email me new wire instructions?
- No. Our instructions do not change by email. Any message claiming otherwise is fraudulent — call the office directly to verify before sending funds.
- Is a cashier's check safer than a wire?
- It removes the wire-fraud vector but introduces its own delays and counterfeit risk. Talk to us in advance about the safest method for your closing amount.
- Can stolen closing funds be recovered?
- Sometimes, and almost always only when reported within hours. Contact your bank first, then file with the FBI IC3 portal.
- How do you protect escrow funds?
- Client funds are held in segregated escrow accounts with verbal verification of every disbursement instruction and dual review of outgoing payments.