Wire Fraud at Closing: How Real Estate Investors Lose Everything in One Email

This is how the scam works, what it costs, and the three habits that make you nearly impossible to victimize.

The scale of it

This is not a rare crime. The scheme behind it — business email compromise, or BEC — produced 21,442 complaints and roughly $2.77 billion in reported losses in 2024 alone, according to the FBI's Internet Crime Complaint Center (IC3) 2024 Annual Report. That made it the second-costliest internet crime in America, behind only investment fraud. Across the past decade, the FBI puts identified global exposed losses to BEC at more than $55 billion.

Real estate transactions are a favorite target because the dollar amounts are large, the timing is public or guessable, and the parties — buyer, seller, agent, title company, lender — are all strangers coordinating by email under deadline pressure.

Anatomy of the scam

Wire fraud at closing is not hacking in the movie sense. Nobody breaks into a bank. The criminal compromises or convincingly spoofs one email account in the transaction — most often the title company's or the agent's — and then does something more dangerous than stealing: they wait and read.

They learn the file number, the names, the closing date, how everyone writes. Then, in closing week, they send the buyer "updated wire instructions." The email looks perfect because in every respect but one, it is: right thread, right signature block, right file number. The only thing that's changed is the account receiving the money.

You wire your funds to close — down payment, cash to close, reserves — and they're swept out of the receiving account within hours, often to overseas banks.

A real case from the FBI's 2024 report: a couple buying a property received a spoofed email from what appeared to be their real estate agent, instructing them to wire $956,342 to finalize the closing. They discovered the spoof two days later. In that case the FBI's Recovery Asset Team froze the transfer and recovered $955,060 — because it was reported almost immediately.

Why recovery usually fails

That story is the exception, and the FBI publishes it because it shows the one variable that matters: speed. When frozen quickly through the FBI's recovery process, funds were successfully held in about 66% of the cases the Recovery Asset Team pursued in 2024. But that number describes the cases that reached the FBI within hours or days. Money that has already been moved — typically swept within hours into second and third accounts, then offshore — is generally not coming back. There is no FDIC protection for an authorized wire, and your homeowner's, builder's risk, and general liability policies do not cover it. If you wire it, it was legally you who sent it.

Treat recovery as a lottery ticket, not a safety net. The defense happens before you hit send.

The three habits that defeat it

1. Verify every set of wire instructions by phone — at a number you found yourself

Before wiring a dollar, call the title company and read the instructions back to them. The critical detail: get the phone number from the title company's website or from documents you received at the start of the transaction — never from the email containing the instructions. The fraudster controls everything inside that email, including the helpful "call us to confirm" number, which rings a phone the fraudster answers.

2. Treat changed instructions as the scam itself

Title companies almost never change their wire instructions in the middle of a file. Their accounts are stable; their instructions are usually printed at the start of the transaction. An email announcing new or "updated" instructions days before closing is not an administrative update — it is the signature move of the fraud. Stop, call, verify.

3. Add a second verifier

Have another person — your partner, your bookkeeper, anyone competent — independently source the number and make the same call before the wire moves. Two people verifying through independently sourced channels turns a one-mistake failure into a two-mistake failure, and two-mistake failures almost never happen.

What this looks like at a lending shop

These three habits aren't theoretical advice we're passing along. They're our own operating rules at Harvey Capital Funding. On every loan we fund, two of us — independently — call the title company at a number we sourced ourselves and confirm the wire instructions out loud before any money moves. No wire leaves on an email alone, ever. We move money every week, and we treat every set of instructions as unverified until a phone call proves otherwise. If professional lenders won't trust an email, an investor wiring their life's savings shouldn't either.

Red flags worth memorizing

• Any change to wire instructions, at any point, for any stated reason
• Urgency framing: "wire must be received today to avoid delaying closing"
• A switch from a business account to a personal account, or a receiving bank in a different state than the title company
• Slightly-off email addresses — one letter changed, or a lookalike domain
• Instructions sent at odd hours, or a thread that suddenly excludes other parties
• Any resistance to phone verification ("we're slammed, everything's in the email")

If it happens anyway

Minutes matter more than anything else. Call your bank immediately and request a wire recall and fraud freeze. File a complaint at ic3.gov right away — that's what activates the FBI's Recovery Asset Team, the mechanism behind the recovery in the case above. Call the receiving bank's fraud department. Then call your local FBI field office. Every hour of delay converts recoverable money into gone money.

The bottom line

A bad GC bid costs you margin. A missed ARV costs you profit. Wire fraud costs you the entire stack of cash you brought to the deal — and unlike every other risk on a project, it's fully preventable with a two-minute phone call. Verify by phone, at a number you found yourself, every time. Treat changed instructions as the scam. Have a second person check.