Fact Checked
Real Estate Wire Transfer Fraud: How to Protect Your Closing Funds in 2026
The wiring instructions email that shows up two days before closing looks like it came from your title company. That's the whole scam, and the fix has to start weeks before closing, back at preapproval, when there's still time to set up verification before a single wiring instruction exists to fake.
Key Takeaways
- Title and closing staff are impersonated in 37% of real estate wire fraud cases, FinCEN data shows.
- Real estate fraud losses reported to federal investigators topped $275 million in the most recent full year on record.
- Confirm wiring instructions by phone with a number you already had, never one from the email itself.
- A frozen fraudulent wire has roughly a 58% recovery rate when it's reported within hours of the transfer.
- Build your verification contacts during preapproval, before a single wiring instruction exists to fake.
Why Prevention Has to Start Before You Ever See a Wiring Instruction
When a borrower asks me about closing fraud, I tell them this: by the time you're staring at a wiring instructions email, you're already in the riskiest moment of the transaction, making a security decision under time pressure with people you may never have spoken to on the phone. That's not a fair fight. Reading the email more carefully rarely catches a well-run scam, because the message is built to look correct. What actually protects a buyer is already having a verified phone number for their title company before the email ever lands.
Federal researchers have looked closely at how this fraud works, and the pattern is specific. Business email compromise targeting real estate transactions doesn't come from a stranger pretending to be a stranger. It impersonates the exact people a buyer has been told to trust. A Financial Crimes Enforcement Network review of real estate-sector fraud incidents found that title and closing entities and personnel were impersonated in 37% of cases, the single most commonly impersonated party in the dataset, ahead of both lenders and agents. The title or escrow office is usually the last name a first-time home buyer hears before they're told to send six figures somewhere.
That changes what the usual advice needs to be. "Be careful who you trust" falls apart when the criminal is posing as someone your lender and your agent already told you to trust completely. The real defense is an independent way to verify that person's identity, one that doesn't route through email at all, and that channel has to exist before closing week. If you're working with AmeriSave on your preapproval, this is exactly the groundwork worth laying early, while there's no deadline attached to it yet.
The Scale of the Problem, in the Government's Own Numbers
I'm going to give you exact figures here rather than a vague "this is common" warning, because specific numbers change how seriously people take a checklist item. Real estate fraud accounted for over 12,300 complaints and more than $275 million in reported losses in the most recent annual reporting period tracked by federal cybercrime investigators, up from roughly $173 million the year before. Business email compromise, the broader scheme category that includes fraudulent wiring-instruction emails in real estate closings, generated more than $3 billion in reported losses in that same period, also a year-over-year increase.
A multi-year FinCEN review of real estate-sector business email compromise found the average monthly value of these incidents climbed from roughly $354,000 to over $503,000 across the review window, with an overall average above $412,000 and a median right around $116,000. That median represents the buyer's entire down payment in many cases, gone in one transfer.
Almost all of it moves fast, too. Nearly 88% of real estate business email compromise incidents involved an initial transfer to a domestic U.S. bank account, with the remainder going internationally, most often to Hong Kong, mainland China, Mexico, Nigeria, and the United Kingdom. A domestic destination just means the money can move through several intermediary accounts within the same banking day, before anyone notices, and recovery stays just as hard either way.
What the Scam Actually Looks Like at the Closing-Agent Layer
The mechanics of this particular fraud are remarkably consistent once you know what to look for. Criminals typically monitor a transaction over time, sometimes by compromising an email account belonging to the title company, the real estate agent, or occasionally the buyer, and watch for the natural rhythm of a closing to approach. Then, right around the time wiring instructions would legitimately go out, a message arrives that looks correct in every visible way. Same logo. Same signature block. The only thing different is the account and routing number.
One case from federal investigators' most recent annual report shows exactly how convincing this gets. A senior citizen closing on a property received a compromised email that appeared to come from the title company, complete with instructions to wire over $1.3 million to what turned out to be a fraudulent account. Investigators later connected that same recipient account to a separate $6 million business email compromise loss reported by an Oregon city government weeks later. Months passed before anyone connected the two cases to the same account. In a second case from the same period, a couple closing on a home received an email impersonating their attorneys and wired more than $449,000 before the fraud was caught.
If you're staring at one of these emails, ask the same diagnostic question I use with you when we're comparing loan products: what actually changed, and does that change make sense given how this process normally works? Legitimate title companies and escrow officers don't send last-minute changes to wiring instructions by email, and they don't pressure you to move fast on a wire without a verified phone conversation first. If an email introduces urgency or a slightly different account name, treat that as the tell it is rather than an inconvenience to work around.
Building Your Verification System During Preapproval
Timing matters more than the checklist itself. Most guidance treats wire fraud prevention as a closing-week task: verify the instructions, call the title company, don't click suspicious links. All true, but by closing week you're building trust with people you may be talking to for the first time, under a deadline, about a six-figure transfer. That's a bad time to build a security relationship from scratch.
The better play is to treat fraud-proofing as a task you start at preapproval, the same stage where you're already collecting contact information for your loan officer, agent, and eventually your title or escrow company. The Consumer Financial Protection Bureau's guidance is direct: identify at least two trusted people in your transaction, commonly your agent and your settlement or title agent, and get a confirmed phone number for each independent of anything that arrives by email. Save those numbers under a label you'll recognize weeks later. Then, when a wiring instruction eventually appears, you already have a verified channel to confirm it that doesn't depend on trusting the email that delivered it.
At AmeriSave, this is a conversation built into the process early rather than left as a closing-day afterthought. When you're working through preapproval and your loan file moves toward underwriting, that's the natural moment to also lock down who you'll call to verify any future wiring instructions, because the number of parties involved in a purchase only grows from there, and each one is a name a scammer could plausibly impersonate later.
A few habits are worth building into that early verification system:
- Call the title or escrow company using a number from their official website or a prior closing document, never one pulled from a suspicious email.
- Agree in advance with your agent and settlement agent on a callback process for any money-movement request.
- Treat any email that changes wiring instructions, even slightly, as a phone-verification trigger, no exceptions.
- Confirm the account name matches the title company's exact legal name before initiating any transfer.
- Keep a written record of every verified contact so nothing has to be re-verified from memory under time pressure.
Contrastive Example: The Two Types of Buyers Who Fall for This
Maybe a rushed wire feels obviously risky to you because you've read a few fraud warnings already. But picture a first-time buyer three days from closing, juggling movers, a final walkthrough, and a lender asking for one more document. An email arrives that looks routine, references the actual closing date, and asks for a wire by end of day. The instinct to just get it done and move to the next task is exactly what the fraud is built to exploit. Compare that to a buyer who, months earlier during preapproval, already saved a verified number for their title company and agreed with their agent that any wiring change gets a phone call first. For that second buyer, the same suspicious email costs a five-minute phone call. The identical message lands on two buyers and produces two completely different outcomes, because the systems were built at different stages of the process.
I've worked with buyers who assumed a professional-looking email was proof enough on its own, and buyers who treated every money-movement request as guilty until verified by phone. The second group built the habit earlier, when there was no pressure and no deadline attached to it, which is what made the difference.
If You Suspect Fraud, Speed Is the Only Variable You Control
Once a fraudulent wire goes out, the numbers get harder, but they're not hopeless. Federal investigators run a Recovery Asset Team built to intercept fraudulent wires before they disappear into other accounts. In the most recent reporting period, that team initiated thousands of these efforts covering more than $1.1 billion in attempted theft, and froze roughly 58% of that amount before it could be moved again. That freeze rate isn't guaranteed, and it drops the longer you wait to report, but it's a real, documented outcome.
Set that against the recovery data from the FinCEN real estate review, where outcomes were far more mixed. Only about 22% of incidents with reported outcomes achieved full recovery of the stolen funds. Another 14.5% saw partial recovery, roughly 20% saw no recovery at all, and about 12.5% were blocked or declined before the funds ever processed, effectively the best outcome available if the fraud is caught early enough. Read those numbers together and the actionable takeaway is obvious: reporting fast is the single biggest variable you actually control after the wire has already left.
If you believe a wire was sent to a fraudulent account, call your bank immediately and request a wire recall before doing anything else. Then file a complaint with federal investigators the same day, since that filing is what triggers the cross-bank intercept effort that produced the freeze rate above. Every hour that passes gives a fraudulent account more time to move the money through additional accounts, and that freeze percentage reflects incidents reported quickly, not incidents reported after a week of trying to figure out what went wrong. It's the same reason AmeriSave encourages borrowers to keep their verified contact list handy through the entire process, from preapproval all the way through the day funds are wired.
Federal Bureau of Investigation, Internet Crime Complaint Center: annual complaint and loss totals for real estate fraud and business email compromise, the Recovery Asset Team's Financial Fraud Kill Chain freeze-rate statistics, and two closing-fraud case examples cited in this article.
Financial Crimes Enforcement Network, "Business Email Compromise in the Real Estate Sector: Threat Pattern and Trend Information": impersonation-target data showing title and closing entities as the most commonly impersonated party, domestic-versus-international transfer patterns, average and median incident values, and fund-recovery outcome breakdowns.
Consumer Financial Protection Bureau, "Mortgage Closing Scams: How to protect yourself and your closing funds": guidance on identifying trusted transaction contacts, phone verification of wiring instructions, and immediate steps to take with your bank if fraud is suspected.
Jerrie leads sales operations in the Dallas-Fort Worth region for AmeriSave, where his entire mortgage career has been spent since being recruited into the industry at age 18. Licensed as a Mortgage Loan Originator in 37 states, he specializes in making complicated loan options accessible and helping borrowers understand what matters most in their individual situations. He brings deep regulatory knowledge and a client-centric approach honed through progression from entry-level to upper management, including successfully onboarding and training 70 people from a closed Cleveland office.
Frequently Asked Questions
Yes, it's common and growing. Real estate fraud generated more than 12,300 complaints and over $275 million in reported losses in the most recent annual federal cybercrime report, up sharply from the prior year. Business email compromise, the broader category covering fraudulent wiring emails, topped $3 billion in reported losses in that same period. Real estate closings are a well-documented target because of the large, one-time dollar amounts involved.
Most often, they impersonate the title or escrow company. A federal review of real estate-sector business email compromise found title and closing personnel were impersonated in 37% of incidents, more than the lender or the real estate agent and more than any other party in the transaction. That's precisely why phone verification with a number you already had matters more than scrutinizing the email for typos.
Sometimes, but recovery is inconsistent and speed matters enormously. Federal data on real estate business email compromise shows roughly 22% of incidents achieved full recovery and about 20% saw no recovery at all, with the rest split between partial recovery and unclear outcomes. Separately, a federal fraud interception program has frozen about 58% of attempted theft amounts when victims reported quickly. Call your bank immediately to request a wire recall, then file a complaint with federal investigators the same day.
The ideal starting point is preapproval, well before closing week. During preapproval, you're already gathering verified contact information for your loan officer and real estate agent; that's the natural moment to also establish a confirmed phone number for your title or escrow company and agree on a verification process for any future wiring instruction. Waiting until a wiring instructions email arrives means building trust with unfamiliar parties under time pressure, exactly the condition fraud is built to exploit.
Any change, however small, to previously provided account or routing information, especially paired with urgency. Legitimate title and escrow companies don't send last-minute changes to wiring instructions by email and don't pressure you to skip verification to meet a deadline. If an email introduces a new account or pressure to act immediately, treat it as a phone-verification trigger rather than something to resolve by replying to the same thread.
It affects the odds of recovery but doesn't change what you should do. Federal research on real estate-sector business email compromise found nearly 88% of incidents involved an initial transfer to a domestic U.S. account, with the remainder going to international accounts, most commonly in Hong Kong, mainland China, Mexico, Nigeria, and the United Kingdom. Domestic transfers can still move through several accounts within hours, so the response is the same either way: report immediately and request a wire recall.
No. A phone number inside a suspicious email can just as easily be fraudulent as the account number next to it. Always verify using a number you obtained independently, such as one from a prior closing document or the title company's official website. This is exactly why building a verified contact list during preapproval matters: it removes the temptation to trust whatever contact information happens to be sitting in the email you're trying to confirm.