Real Estate Wire Fraud: 6 Red Flags Before You Wire

Real Estate Wire Fraud: 6 Red Flags Before You Wire

The single most effective way to stop wire fraud in a real estate transaction is to treat every wiring instruction like cash and verify it by phone using a number you saved before the transaction started, never a number or link found in an email. The FTC, IC3, and CFPB all point to the same fix: confirm instructions through a channel the scammer cannot touch, and delay the wire until that call is complete.

---

TL;DR:

• Before funds move, verify and save official phone numbers for at least two contacts, such as your lender and title officer.
• Most lenders expect wiring instructions confirmed one or two days before closing; a change sent on closing morning deserves fresh verification.
• Compare the Closing Disclosure with final instructions line by line, then confirm the receiving bank, account number, and routing number before authorizing payment.
• If closing deadlines create pressure, ask whether a cashier’s check or payment held in escrow is available instead of rushing a wire.
• If fraud is suspected, call your bank immediately to request a recall, report to IC3 within hours, and preserve emails and call logs.

---

Table of Contents

• What Wire Fraud Is and Why It Matters
• Common Fraud Tactics and Red Flags to Watch For
• Pre-Transaction Prevention Checklist: People, Process, and Technology
• Verification Protocols and Secure Communication Practices
• Closing-Day Checklist: Timing, Documents, and Step-by-Step Verification
• If You Suspect or Experience Wire Fraud: Immediate Actions and Reporting
• Industry Best Practices and Practitioner Insights
• Why Verification Habits Matter More Than Any Single Tool
• How Managed IT Support Strengthens Wire Fraud Defenses
• FAQ
• Sources

What Wire Fraud Is and Why It Matters

Wire fraud in real estate usually arrives as business email compromise (BEC): a criminal gains access to, or spoofs, an email account used by an agent, lender, or title company, then sends fake wiring instructions timed to closing. Variants include phishing emails that harvest login credentials, seller impersonation on vacant or inherited properties, and domain spoofing that mimics a trusted contact's address almost perfectly.

The scale is real. IC3's 2025 reporting documents rising losses tied to BEC and real-estate-targeted fraud, with cyber-enabled schemes making up the bulk of reported losses that year. Once a wire clears, recovery is never guaranteed, which is why the FTC advises contacting your bank immediately regardless of the amount lost.

• BEC: criminals compromise or mimic a real inbox to redirect funds.
• Phishing: fake links or attachments steal credentials that enable BEC.
• Seller impersonation: fraudsters pose as the actual property owner, often on unoccupied homes.
• Spoofing: a display name or domain is altered just enough to pass a quick glance.

Common Fraud Tactics and Red Flags to Watch For

Most wire fraud succeeds through pressure and small inconsistencies that get missed when everyone is moving fast near closing.

1. Sudden urgency: an email demanding action "today" or warning that closing will be delayed without immediate payment.
2. Last-minute changes: new account numbers, a different bank, or a revised wiring amount sent after instructions were already confirmed.
3. Domain mismatches: an address that looks right at a glance but swaps a letter, adds a hyphen, or uses a different top-level domain.
4. Display-name spoofing: the sender's visible name matches someone you trust, but the underlying address does not.
5. Unfamiliar attachments or links: PDFs or portals you were not told to expect, especially ones requesting login credentials.
6. Seller impersonation signs: a "seller" who avoids phone calls, pushes for a fast cash sale, or cannot answer basic questions a real owner would know, particularly on vacant or inherited property; checking public property records helps confirm ownership before funds move.

Pre-Transaction Prevention Checklist: People, Process, and Technology

Prevention starts weeks before closing, not the morning of. Build the safeguards into the transaction the same way you'd build in a home inspection.

• Collect and independently verify phone numbers for at least two trusted contacts (your lender, your title or escrow officer) before any money moves.
• Confirm those numbers against the lender's official website or office listing rather than anything supplied only by email.
• Require that any payment instruction be confirmed through a channel outside email, by phone, in person, or through a secure client portal.
• Segregate duties internally: the person who prepares wiring details should not be the same person who verifies them with the recipient.
• Adopt a Written Information Security Plan (WISP), as ALTA recommends, covering email authentication, staff training, and vendor security checks.
• Use secure client portals instead of plain email for transmitting account numbers and closing documents.

For brokerages building this out formally, a structured plan like a phishing awareness training program gives staff repeatable habits instead of one-time warnings.

Pro Tip: Save your lender's and title company's verified numbers in your phone the day you open escrow, before any pressure to act quickly exists.

Verification Protocols and Secure Communication Practices

A "known communication protocol," the term CFPB uses, means agreeing early in the transaction on exactly how wiring instructions will be confirmed, and sticking to it even when a request looks legitimate. Save the lender's office number, the title company's main line, and the loan officer's NMLS-listed number at the start, not after a suspicious email shows up.

• Call the saved number directly. Never call a number printed inside the email asking for the wire, since that number may route straight to the fraudster.
• Log each verification call: date, time, who you spoke to, and what was confirmed.
• Require a second factor, such as a callback plus written confirmation, before releasing any large transfer.
• Watch for authentication failures (SPF, DKIM) if your email provider flags them, and route unusual requests through a secure portal instead of a reply.

Pro Tip: If wiring instructions change at any point, no matter how small the change, stop and verify by phone before sending a cent.

Closing-Day Checklist: Timing, Documents, and Step-by-Step Verification

Most lenders expect wire instructions to be confirmed a day or two before closing, not sent or changed the morning of. Treat any last-minute instruction change as a red flag by default.

1. Compare your Closing Disclosure against the final wiring instructions line by line before authorizing anything.
2. Verify the identity of the person issuing instructions, by phone, using your previously saved number.
3. Call to confirm the receiving bank name, account number, and routing number match what your title company confirmed earlier in the process.
4. Pause the transaction immediately if any detail changed since your last verification call, and do not resume until you've reconfirmed through the known channel.
5. Ask your bank what confirmation you'll receive once the wire is sent, and follow up if that confirmation doesn't arrive on schedule.

When timing feels rushed, ask about alternatives such as a cashier's check or an escrow-held payment instead of wiring under pressure.

If You Suspect or Experience Wire Fraud: Immediate Actions and Reporting

Speed matters more than anything else once a fraudulent wire is suspected. The FTC advises contacting your bank immediately to request a wire recall, though recovery is never guaranteed once funds have moved.

• Call your sending bank first and ask them to initiate a recall or hold with the receiving institution.
• File a complaint at IC3.gov right away. IC3's 2025 reporting documents cases where rapid engagement with its Recovery Asset Team allowed banks to freeze funds before they disappeared, which is why reporting within hours, not days, matters.
• Contact your state attorney general's office and file a local police report creating an official record.
• Preserve every email, header, and call log tied to the transaction as evidence.

Be wary of anyone who contacts you afterward claiming they can recover your funds for a fee. The FTC warns that recovery scammers frequently target people who already lost money, and legitimate agencies never charge upfront fees to help.

Industry Best Practices and Practitioner Insights

Title and settlement professionals have converged on a "people, process, technology" framework for a reason: no single safeguard catches every scheme. ALTA's guidance recommends multivariable identity checks, including document review and independent phone verification, alongside a documented identity verification process covering staff roles and vendor oversight.

Reporting trends reinforce why that matters. BEC remains one of the most common fraud types reported through IC3, and cases that move quickly after discovery stand a better chance of a freeze before funds are moved again.

• Train staff regularly on phishing recognition, not as a one-time onboarding item.
• Set up email authentication (SPF, DKIM, DMARC) to reduce spoofed messages reaching inboxes.
• Monitor email accounts for unusual login activity or forwarding rule changes.
• Vet third-party vendors' security practices before trusting them with sensitive transaction data.

Our guide to business email compromise walks through how these compromises typically unfold inside a small office.

Why Verification Habits Matter More Than Any Single Tool

The transactions we've seen go wrong rarely fail because someone lacked a security tool. They fail because a verification step got skipped under time pressure, usually the phone call that should have happened before a wire went out. The fix is rarely more technology. It's a habit: build the callback into the workflow so skipping it feels as wrong as skipping a signature.

Teams that bake verification into their closing checklist, and revisit it in every training cycle, catch far more attempts than teams relying on vigilance alone. That's also where the right technical support starts to matter.

— Nicholas

How Managed IT Support Strengthens Wire Fraud Defenses

Verification habits work best when the systems behind them are locked down too. We provide managed IT support for real estate offices, title companies, and brokerages across Norman, Moore, and Oklahoma City, built around 24/7 monitoring that flags suspicious account activity before it reaches a client's inbox.

Our cybersecurity services include phishing-awareness training, secure email configuration, and rapid incident response if a compromise is suspected. Our services include prompt response and flexible terms to help small brokerages get support without long-term commitments.

• Start with a free network assessment to see where your current email and account defenses stand.
• Prefer a quick gut check first? Our 10-minute readiness audit covers the basics in one short call.

FAQ

How common is wire fraud in real estate?

Business email compromise, the scheme behind most real estate wire fraud, remains one of the most frequently reported fraud types to the IC3, with real estate transactions a recurring target because of the large sums moved on tight deadlines. The exact share tied specifically to real estate varies by year, but the trend documented in IC3's reporting has been upward.

Why do I keep getting texts asking me if I want to sell my house?

These texts are typically mass outreach from investors or wholesalers scanning public property records for potential sellers, not necessarily fraud on their own. Still, treat any unsolicited offer with the same caution as other unexpected contact: verify identity independently before sharing financial details or signing anything.

How many days before closing do you wire money?

Most lenders and title companies expect wiring instructions confirmed a day or two ahead of the actual closing, with the wire itself often sent the morning of or the day before funds are needed. Any last-minute change to those instructions, especially sent only by email, should be verified by phone before the wire goes out, per CFPB guidance.

What is the most common type of wire fraud in real estate?

Business email compromise is the most common form, where criminals gain access to or spoof an email account used in the transaction to send fake wiring instructions. The FBI's guidance notes these attacks are often timed deliberately around closing, when buyers are focused on deadlines rather than scrutinizing every email.

What should I do if I suspect a fraudulent wire?

Call your sending bank immediately and ask them to request a recall from the receiving institution, since wires are effectively irreversible once processed. File a report at IC3.gov the same day, since rapid reporting improves the odds of a freeze before funds disappear.

Sources

• What to know before you wire money | FTC
• Mortgage closing scams: How to protect yourself and your closing funds | CFPB
• IC3 2025 Annual Report | IC3
• Red flags and tips to help prevent seller impersonation in real estate | ALTA

Recommended

• 90 Day Phishing Awareness Training Plan for Security Teams
• Enhancing Cybersecurity for Local Law Firms