Real estate wire fraud: the email that steals your down payment days before closing
Days before you close on a home, an email from your 'title company' says the wiring instructions have changed — and your life savings go to a criminal's account. The FBI ties real-estate business email compromise to $446.1 million in reported losses in 2022 alone. Here's how the swap works, and the one phone call that stops it.
You’re days from closing on a house. The inspections are done, the loan is cleared, and your down payment — years of savings — is sitting in your account, ready to move. Then the email arrives from your title company: a small administrative note, sorry for the late notice, but the wiring instructions have changed. Please send the funds to the updated account below so closing stays on schedule.
Everything about it checks out: your name, the property address, the closing date, the officer you’ve been emailing for weeks. And if you wire the money, it’s gone. This is real estate wire fraud — business email compromise (BEC) aimed at the largest check most people will ever write. The FBI’s Internet Crime Complaint Center (IC3) reported that BEC with a real estate nexus cost victims $446.1 million in 2022, up from $258.4 million in 2020.
Here’s the whole defense in one line, before any of the detail: wiring instructions never change by email. When money is about to move, you call your settlement agent on the number you saved at the start — and nothing you read in an inbox overrides that call.
The setup: someone in your deal has been hacked
This scam doesn’t start with you. It starts weeks earlier, when a criminal compromises an email account belonging to someone in your transaction — a real estate agent, a title or escrow officer, an attorney. BEC is the machinery behind it, and it’s one of the most expensive crimes in the world: the IC3 ties it to more than $55 billion in exposed losses — actual and attempted — reported between 2013 and 2023.
What happens next is patient. The IC3 describes perpetrators who, once inside an account tied to a real estate transaction, “monitor the real estate proceeding” and time their move — a request for “a change in payment type (frequently from check to wire transfer) or a change from one bank account to a different bank account under their control.” They read the thread, learn the names, learn the dates, and wait for the one moment the money is in motion.
That’s why the email knows things a stranger couldn’t. It isn’t a lucky guess. It’s a transcript.
The email: a last-minute change dressed as paperwork
The CFPB warned homebuyers about exactly this play: scammers “send spoofed emails to homebuyers” — posing as “the real estate agent, settlement agent, legal representative” — “with false instructions for wiring closing funds.” The message arrives from the real mailbox they’ve compromised, or from a look-alike address a character or two off, inside what looks like the conversation you’ve been having all along.
The ask is engineered to feel small. Not “send money to a stranger” — you were already sending the money. Just a routine correction to where. Add a deadline (“so we don’t lose your closing date”) and an offer to answer questions by email, and every check you’re likely to run stays on the one channel the criminal controls. Reply with doubts, and the scammer replies with reassurance. It’s the same one-channel trap we dissect in the “our bank details have changed” BEC email — same engine, pointed at a business’s accounts team instead of a homebuyer.
Why closing is the perfect moment
Three things make the closing wire uniquely attractive to criminals. The sum is enormous — a down payment plus closing costs is often the largest single transfer of a buyer’s life. The victim is a first-timer — most people have never sent a wire before, so “here are the wiring instructions” carries no baseline of normal to compare against. And the deadline is real — you actually do have to move money this week, so urgency doesn’t have to be manufactured, only redirected.
The growth curve shows how well this works. The CFPB reported in 2019 that reports of these attempts rose 1,100 percent between 2015 and 2017, with an estimated loss of nearly $1 billion in real estate transaction costs in 2017 alone. And per the IC3, from 2020 to 2022 victim reports of real-estate BEC rose another 27 percent — while losses rose 72 percent. Bigger wires, better-researched emails.
A wire, unlike a card payment, has no dispute button. Once the receiving account is emptied — usually within hours, through mules and crypto — recovery gets very hard. That finality is why the scam insists on it, and why the renter-targeting version of this con pushes the same rail: see rental deposit scams.
The defense: one phone call, on your number
This is a job for the Call-Back Rule, and it beats every version of this scam because it never argues with the email — it just refuses to act on it.
- At the start of the process, save the phone numbers of your settlement agent or title company and your real estate agent, confirmed in person or from documents you received at the first meeting. The CFPB’s version: “Identify two trusted individuals to confirm the closing process and payment instructions.”
- Before wiring anything, call and read the instructions back. The CFPB is categorical: “Before wiring money, always confirm instructions with your trusted representatives. Never follow instructions contained in an email.”
- Treat any change as fraud until verified by voice. The FBI’s own protective guidance for BEC says to “use secondary channels or two-factor authentication to verify requests for changes in account information.” A real title company will never be offended by the call. A scammer needs you not to make it.
Note what’s not on the list: inspecting the email for typos, checking the sender address, trusting it because it knew your closing date. All of that can pass and the email can still be fraud, because the mailbox itself may be the thing that’s stolen.
If the money already moved
Speed decides this. The CFPB’s instruction: “Contact your bank or wire-transfer company immediately. Ask for a wire recall.” Then file with the FBI at ic3.gov — email headers, account numbers, timeline — and alert everyone in the transaction, because the compromised mailbox is likely still live and aimed at the next buyer. The full sequence is in Freeze & Report, and our guide to getting your money back by payment method covers what’s realistic on the wire rail.
For the rest of the free playbook, see our defense moves — or test whether you’d catch the swapped-account email in the 60-second quiz.
- Close to your closing date, an email from your 'title company,' 'escrow officer,' 'attorney,' or 'agent' announces new or updated wiring instructions — the account for your down payment has changed.
- The email looks perfect: real names, your actual closing date, the right property address — because a mailbox somewhere in your transaction was compromised and the scammer has been reading along.
- It pushes speed and stays on email: wire today or the closing slips, and every question you send back gets a fast, reassuring reply — from the account the scammer controls.
- Before wiring closing funds, call your settlement agent or title company on a number you saved at the start of the process — never a number from the email that brought the instructions.
- Follow the CFPB's advice: 'Identify two trusted individuals to confirm the closing process and payment instructions,' and confirm by phone before money moves. 'Never follow instructions contained in an email.'
- Treat any change to wiring instructions as fraud until a voice on a known number says otherwise. Legitimate closing instructions almost never change at the last minute — the 'update' is the scam.
- If you already wired: call your bank immediately and ask for a wire recall, then file a complaint at ic3.gov. Speed is the single biggest factor in getting the money back.
What makes this scam uniquely cruel is the timing: closing day is the one day in most people's lives when wiring six figures to a stranger's account feels completely normal. You're primed, exhausted, and on deadline — the scam just redirects momentum you already have. My rule for anyone buying a home is blunt: the wiring instructions you confirm by phone at the start are the only instructions that exist. Anything 'updated' by email is fraud until a voice you know says otherwise.
Sources
Frequently asked
The email came from my agent's real address and knew my exact closing date. How could it possibly be fake?
Because the scammer is inside the conversation, not guessing at it. The FBI's IC3 explains that once BEC perpetrators gain access to an email account involved in a real estate transaction, they 'monitor the real estate proceeding' and time the fraudulent request — often 'a change from one bank account to a different bank account under their control.' The details are right because they were copied from real emails; the sender can be a compromised genuine mailbox or a look-alike address one character off. That's why nothing in the email itself can clear it. Only a phone call to a number you already had can.
Why do scammers insist on a wire transfer instead of a check?
Because a wire is fast, final, and hard to claw back — once it lands, the money is typically moved out of the destination account within hours. The FBI's IC3 notes fraudsters often time 'the fraudulent request for a change in payment type (frequently from check to wire transfer)' precisely because it converts your closing funds into the most irreversible form available. A wire itself isn't the problem — closings legitimately use them — but a sudden push to switch payment type or destination is the tell.
I already wired my closing funds to the scammer's account. What can I do?
Move immediately — this is measured in hours, not days. The CFPB's guidance: 'Contact your bank or wire-transfer company immediately. Ask for a wire recall.' The sooner you report, the better the odds the receiving bank can freeze the funds before they're drained. Then file a complaint with the FBI at ic3.gov with the email, the account numbers, and the exact timeline, and tell your settlement agent and real estate agent so they can warn other clients — the compromised mailbox is probably still being used. Our [Freeze & Report](/defense/freeze-and-report) protocol walks through the full sequence.