How closing wire fraud works
The scam rides on email. Criminals break into, or imitate, an email account belonging to someone in your transaction: the title company, an agent, an attorney, a lender, or you. They watch the messages, learn the closing date and the amounts, and then send a convincing email at the right moment.
The FBI’s Internet Crime Complaint Center describes business email compromise as a scam aimed at people and businesses that make fund transfers, in which criminals take over or imitate legitimate email accounts, through social engineering or intrusion, and use them to redirect money. Real estate closings are a natural target because large sums move on a known schedule.
Typical messages:
- “Our wiring instructions have changed. Please use the account below.”
- “Send your new bank details so we can wire your proceeds today.”
- “Urgent: the payoff must go to this updated account.”
The emails often look exactly like the real ones, with the right logos, names and closing details, sometimes from an address one letter off.
The 2025 numbers
IC3’s 2025 annual report shows how large the problem is:
| Category, 2025 | Complaints | Reported losses |
|---|---|---|
| Business email compromise | not broken out here | $3,046,598,558 |
| Real estate fraud | 12,368 | $275,110,419 |
IC3 defines its “real estate” category as loss of funds from a real estate investment or fraud involving rental or timeshare property, so closing-wire schemes that start with a hacked email are mostly counted as business email compromise instead. The report also lists 27,626 complaints of all kinds from Ohio in 2025.
One case in the report shows how fast it happens: in August 2025, buyers closing on a home received an email impersonating their attorneys and wired more than $449,000 to a fraudulent account. Because they reported it quickly, IC3’s Recovery Asset Team requested a freeze and the recipient bank confirmed the full amount was still on hold.
How sellers get targeted
Buyers are the classic target, but sellers have money in motion too:
- Your proceeds. A fake “title company” email asks you for, or changes, the account where your proceeds will be wired.
- Your mortgage payoff. Fake payoff instructions send your loan payoff to a criminal, leaving your mortgage unpaid and the lien still on record.
- Your personal data. Requests for your Social Security number, bank login or ID scans. The title company does need your taxpayer ID for the IRS Form 1099-S, which is exactly why a fake request can look routine.
How to protect your closing
IC3’s guidance is to “use secondary channels or two-factor authentication to verify requests for changes in account information.” For a home sale, that means:
- Get the title company’s phone number at the start, from its website or your purchase agreement, and save it.
- Give your bank details by phone or in person, not by email, and confirm them with the closer by phone.
- Treat any change as fraud until proven otherwise. Call the number you saved before acting.
- Check the sender’s full email address, especially on a phone, where only the display name shows. IC3 specifically recommends this.
- Turn on two-factor login for your email, and change your password if you have any doubt.
- Ask for a check for your proceeds if you’d rather avoid wires altogether.
- Confirm receipt. Call to confirm the wire arrived, the same day.
The FTC warns that scammers often demand payment by wire transfer, so an unexpected request to wire money should always make you stop and check.
What to do if money was wired to a scammer
Minutes matter. IC3’s report says: “If you discover a fraudulent transfer, time is of the essence.”
- Call your bank immediately. Ask the bank that sent the wire to request a recall or reversal, and ask about a hold harmless letter or letter of indemnity.
- File a complaint at ic3.gov, “regardless of the amount lost,” with full transaction details including bank and account numbers. IC3 may be able to help banks and law enforcement freeze funds through its Recovery Asset Team.
- Tell your title company, agent and lender, using phone numbers you trust.
- Report it to the FTC at reportfraud.ftc.gov.
- Secure your accounts: change email and banking passwords and check for forwarding rules a hacker may have set.
IC3 also notes that it won’t contact you asking for money, and doesn’t work with private “recovery” firms. Anyone who calls offering to recover your funds for a fee is another scam.
Warning signs in closing emails
Slow down if a message:
- announces new or “updated” wiring instructions
- asks you to keep the change confidential or not to call
- comes from an address that is slightly different from earlier messages
- pushes a deadline of today or within the hour
- asks for bank logins, ID photos or your full Social Security number by email
- arrives right after a real email from your closer, as if continuing the thread
Any one of these is enough to pick up the phone.
Choosing who handles your closing
A title company that verifies instructions by phone, uses secure portals for documents, and will issue a check on request reduces your risk. Ask about its procedures when you open the file. Our guide to what a title company does explains its role in moving the money, and how to get a mortgage payoff statement covers checking payoff instructions. If you’re selling to a cash buyer, also verify the buyer’s proof of funds before you sign.
