The FBI's Internet Crime Complaint Center consistently ranks real estate as one of the top industries for wire fraud losses. The reason is simple: real estate transactions involve large wire transfers, tight deadlines, multiple parties communicating over email, and buyers who have never wired money before and don't know what normal looks like.
Most agents know wire fraud exists. Very few have a repeatable system for preventing it. And almost none have the conversation with their buyers early enough to matter.
This post covers how the fraud works, why real estate is so vulnerable, and exactly what to do — and say — on every transaction you close.
Wire instructions never legitimately change at closing
Title companies do not send updated wire instructions via email. If your buyer receives an email saying wire instructions have changed — for any reason — treat it as fraud until verified by phone.
What wire fraud in real estate actually looks like
Real estate wire fraud isn't a phishing email with bad grammar and a Nigerian prince. It's a meticulously researched attack. Criminals monitor email chains for weeks — sometimes months — watching for the moment a transaction reaches closing. They know the parties involved, the property address, the approximate closing date, and the name of the title company. When the time is right, they send a spoofed email from an address that looks nearly identical to the title company's, with updated wire instructions. The buyer wires their down payment and closing costs to a fraudulent account. By the time anyone realizes what happened, the money is gone.
How attackers get into the email chain
Business email compromise (BEC) is the technical term for what's happening here. Attackers gain access to one inbox in the transaction — often the agent's, the title company's, or the lender's — by exploiting a weak password, a phishing link clicked six weeks earlier, or a breached third-party tool. Once inside, they read silently. They don't act immediately because acting immediately would get them caught. They wait until the money is moving, then they strike. The most common entry point is the agent's email. Most agents use Gmail or Outlook with no multi-factor authentication, communicate across a dozen platforms, and click links constantly. It's a high-target, low-defense environment.
The anatomy of a successful scam
Here's how a typical attack unfolds: Two to three weeks before closing, the attacker gains read access to the transaction email thread. They learn the closing date, the title company name, and the buyer's contact info. Three to five days before closing, they send an email from a spoofed address — something like 'settlement@firstamerican-title.net' instead of 'settlement@firstamericantitle.com' — telling the buyer that wire instructions have changed due to a 'banking update' or 'security audit.' The email looks professional, references real transaction details, and creates urgency. The buyer wires six figures to a fraudulent account. The real title company sends the actual instructions later that day. The buyer calls to confirm — and the transaction coordinator's stomach drops.
What agents should do before closing day
There are three things every agent should do on every transaction. First: tell your buyer — in writing, early — that wire instructions will never change, and that any email claiming they have changed should be treated as fraud. Send this warning before closing is even scheduled, not the day before. Second: verify wire instructions by phone using a number you looked up independently — not one provided in an email. Call the title company directly. Third: enable multi-factor authentication on your email account. This single step eliminates the majority of BEC attacks. If you can't be reached through your email, attackers can't read your transaction threads. These three steps cost nothing and take less than fifteen minutes per transaction.
The conversation you need to have with every buyer
Your buyer needs to hear this directly from you — not in a disclaimer buried in a disclosure packet. Have the conversation out loud: 'Wire instructions in real estate are a major fraud target. Before you wire any money, call me and call the title company using a number you look up yourself. Do not trust wire instructions that arrive by email, even if the email looks exactly like one you've received before. If anything feels off, stop and call us immediately.' Most buyers have no idea this is a risk. When they hear it from their agent directly, they remember it. When they read it in fine print, they don't.
What to do if you suspect fraud has already occurred
If a buyer tells you they wired funds and something doesn't match — act immediately. Call the buyer's bank and ask them to initiate a SWIFT recall or wire reversal. Time is the only variable that matters; the first 24 hours determine whether the money can be recovered. Simultaneously, file a complaint with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov, and call your state's real estate commission to report the incident. Contact your E&O insurance carrier. Document everything: the fraudulent email, the wire confirmation, timestamps on all communications. Do not delete anything. Recovery is possible if you move fast — but the window closes within hours.
Wire fraud prevention checklist — use it on every transaction
- Enable multi-factor authentication on your email account today
- Send buyers a written wire fraud warning within 48 hours of going under contract
- Have the wire fraud conversation verbally, not just in disclosures
- Provide the title company's direct phone number and tell buyers to look it up themselves
- Remind buyers to verify wire instructions by phone before every transfer
- Never send updated wire instructions via email without a follow-up phone confirmation
- If fraud is suspected: call the sending bank immediately, then IC3.gov, then your E&O carrier