The largest check most people ever write is the one for a home, and in the final days before closing that money usually moves as a single wire transfer. That is precisely the moment criminals wait for. By quietly reading the email of a real-estate agent, a title company, or a closing attorney, a thief can step in with fresh wiring instructions that look entirely authentic and reroute a buyer’s whole down payment into an account they own.
How real-estate wire fraud actually unfolds
The scheme belongs to a family of crimes investigators call business email compromise. Rather than breaking into a bank, the fraudster breaks into an inbox, often a small title office or an agent whose password was exposed in an unrelated data breach. Once inside, the criminal reads for weeks, learning the names of the buyer, the seller, and the escrow officer, the closing date, and the exact amount due. Nothing looks wrong because nothing has visibly changed.
Then, hours or days before the money is due, an email arrives that appears to come from a familiar party. It announces a last-minute change: the escrow bank has been updated, or new wiring details must be used for this transaction. The message carries the right logo, the right signature, and often the right tone, because the thief has been studying the real correspondence.
The Federal Bureau of Investigation, which tracks these cases through its business email compromise program, has warned that real-estate transactions are a favorite target precisely because the sums are large and the timing is predictable. Bureau reporting to Congress documented a 27 percent rise in victim reports of real-estate-related compromise from 2020 to 2022 and a 72 percent jump in the money lost. Once a wire lands in the criminal’s account, it is frequently moved again within minutes, which is why recovery is so difficult.
Free retirement updates: Scam calls targeting retirees change every week. Our free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
Why the fake instructions fool careful people
What makes this fraud so effective is that it exploits a legitimate expectation. Closings really do involve wiring instructions, and last-minute logistics really do change, so a message about updated bank details does not automatically raise alarm. The email address may be spoofed to differ by a single letter, or the account may have been genuinely hijacked, meaning the note truly comes from the correct address. Some criminals even set up hidden inbox rules that divert the real staff’s replies, so the legitimate parties never see the fraudulent thread and cannot warn the buyer that anything is wrong.
Older buyers, including retirees purchasing a smaller home or a place near family, can be at particular risk. Many are downsizing decades of equity into one transaction, so a single misdirected wire can carry a life-changing sum. The criminals count on the pressure of a looming closing date, the trust built with a familiar agent, and the reasonable assumption that a wire, once sent, is simply how these deals work. Agents and title officers handle so many transactions that an unusual instruction can blur into the routine, which is why the duty to verify ultimately rests with the person whose money is on the line.
The one phone call that stops it
The single most reliable defense costs nothing and takes minutes. Before sending any funds, a buyer should call the closing office, the title company, or the escrow agent directly and confirm the wiring instructions out loud, digit by digit. The number for that call must come from a trusted source gathered earlier in the process, such as the signed contract, a business card, or the company’s published main line, never from the email requesting the transfer.
That distinction is the entire point. A thief who controls the inbox can also supply a phone number that rings straight to an accomplice. The FBI’s guidance is explicit that any change to an account number or payment procedure should be verified by phone using a previously known contact, not one provided in the message. A buyer who treats every last-minute change of banking details as suspicious, and who confirms even instructions that appear unchanged, removes the criminal’s opening entirely.
What to do if a wire has already left
Speed decides whether the money can be saved. Anyone who realizes a payment may have gone to the wrong account should call their bank immediately and ask for a wire recall or a hold, then contact the receiving bank as well. Because criminals move stolen funds quickly, a report filed within hours has a far better chance than one filed the next day. Victims should also file a complaint with the FBI’s Internet Crime Complaint Center, which can, in some cases, help freeze funds that have not yet been withdrawn. The bureau’s recovery specialists work directly with banks to place holds on fraudulent transfers, but their success depends almost entirely on how quickly the victim raises the alarm.
A closing is a moment of trust, and that trust is exactly what these criminals weaponize. But the scheme has one consistent weakness: it depends on a buyer wiring money without a spoken confirmation. A verifying phone call to a known number, made every single time before funds move, turns the most costly moment of a home purchase into the safest.
This article was researched and drafted with AI assistance and reviewed against the linked primary sources.
More Financial Reading
- Bank statements: how long to keep them and when to toss them
- The ideal retirement withdrawal rate so your savings actually last
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
