The day before closing, the buyer gets an email that looks like it came from the title company. It says the wiring instructions have changed and gives a new account number. The buyer sends the down payment. The money is gone before anyone realizes the email was fake.
This is business email compromise, and the FBI has tracked tens of billions of dollars in losses from it across all industries. Real estate is a favorite target because the sums are large, the deadlines are tight, and a lot of people are emailing each other about the same deal.
The short version
- The scam usually starts weeks earlier, with one stolen email password.
- Wiring instructions should never be changed, or trusted, by email alone.
- Multi-factor authentication on email is the most important technical fix.
How the scam works
- An email account is compromised. It could belong to an agent, a broker, a transaction coordinator, the title company, the lender or the buyer. The usual way in is a phishing email.
- The criminal watches quietly. They read the thread and learn the names, the property, the amounts and the closing date. Often they set up a hidden rule that forwards copies of messages to themselves.
- They strike at the right moment. Just before funds are due, they send new wiring instructions from the real account or from a lookalike address.
- The money moves fast. Once the wire lands, it is quickly passed through other accounts.
What your office can do
- Multi-factor authentication on every email account. That includes agents who use their own phones and personal mailboxes for business.
- Check for forwarding rules. Hidden rules in a mailbox are a classic sign that someone else is reading it.
- Never accept or send wire changes by email alone. Confirm by calling a phone number you already had, not one from the message.
- Warn clients on day one. Tell them in writing how they will receive wiring instructions and that those instructions will not change by email.
- Use a secure portal or encrypted email for documents and instructions.
- Filter for lookalike domains and flag messages from outside your organization.
- Train everyone, including part-time agents and coordinators.
- Secure the devices. Screen locks, updates and the ability to wipe a lost phone.
If a wire goes to the wrong account
Hours matter. Call the sending bank immediately and ask for a recall of the funds. File a complaint at ic3.gov as soon as you can, whatever the amount. Tell every party in the transaction, and change the passwords on any account that might be involved.
Xceltek supports real estate offices with email security and phishing prevention and day-to-day IT support for teams that work from everywhere.
Is every mailbox in your office protected?
We can check your email setup for the gaps this scam depends on.
Common questions
How do criminals know about the closing?
Usually from inside an email account they have broken into. They read the real conversation, so their message arrives at the right time with the right details.
Is multi-factor authentication enough?
It blocks most account takeovers, which is where this scam starts. Pair it with a firm rule that wiring instructions are always confirmed by phone on a known number.
Can a stolen wire be recovered?
Sometimes, if it is reported to the bank and the FBI quickly. There is no guarantee, which is why prevention and fast reporting matter so much.
