Real Estate Wire Fraud: A Callback Checklist for Every Closing

The FBI’s 2025 Internet Crime Report logged 12,368 real estate fraud complaints and $275,110,419 USD in losses. Business email compromise (BEC), the scam behind most stolen closing wires, cost victims $3.04 billion USD across all industries.

One case in that report shows how thin the margin is. In August 2025, a buyer wired more than $449,000 USD to an account after an email impersonated their closing attorneys. They filed with the FBI’s Internet Crime Complaint Center (IC3) fast. The FBI’s Recovery Asset Team froze the full amount at the receiving bank. Most victims who wait lose everything.

Investors move money by wire every week: earnest money, closings, 1031 exchanges, lender draws, assignment fees, and payoffs. This guide gives you a six-step callback checklist for every wire and a 24-hour recovery protocol if one goes wrong.

How Do Scammers Steal Closing Wires?

Business email compromise in real estate transactions

Attackers hijack or spoof the email account of an agent, title officer, closing attorney, lender, or investor. They read the thread for days. They learn the closing date, the amount, and who sends what. A day or two before funding, they send new wiring instructions from the hacked account or a lookalike domain. The new account belongs to them.

Attackers often set a hidden forwarding rule in a hacked mailbox. The rule copies every message to the criminal, so they keep watching even after you change your password.

Why investors face more wire fraud risk than homebuyers

A homebuyer sends one or two wires. An active investor sends dozens a year across several title companies, lenders, and states. Deals close in LLCs, often all-cash, with no mortgage lender’s fraud checks in the chain. Tight timelines push people to skip verification, especially for landlords already stretched by tenants and repairs. (If that sounds familiar, our guide to a property management virtual assistant covers the day-to-day side of a rental portfolio.)

Red flags in a fake wire instruction email

Here’s an example built from common attack patterns:

• Lookalike domain. The real title company uses “titlecompany.com,” not “titlecompany-closings.com.”
• Changed bank details. Escrow accounts rarely change mid-closing. Treat any change as an attack until proven otherwise.
• Manufactured urgency. A hard deadline pushes you to skip the call.
• Phone avoidance. “Email is best” keeps you away from the one step that stops the scam.

What Is the Callback Checklist for Every Closing?

The American Land Title Association’s ALTA Best Practices framework expects title companies to protect wire instructions and verify them outside email. Your side of the transaction needs the same discipline. Run these six steps on every wire, including small earnest money deposits.

Step 1: Verify the phone number against a public license record

At contract, look up the title agency or closing attorney in your state’s insurance department or state bar license database. Use the main office number from that record, or from the company website you type into your browser yourself. Store it in the deal record in your CRM, such as REsimpli or Podio.

Why the license record matters: a criminal can edit an email signature, spoof a caller ID, or SIM-swap an escrow officer’s cell phone. They can’t change a state license record. If your saved number and the license record ever disagree, trust the license record.

Step 2: Flag every wire instruction as unverified

Every set of instructions starts as unverified, including instructions from a title company you’ve used for years. Trusted inboxes make the best targets.

Step 3: Call the main office line, never the email’s number

Call the number from Step 1. Ignore any number in the email, the PDF, or the signature. Ask the main line to connect you to the escrow officer on the file. If someone you don’t know answers a direct line, hang up and call the main office again.

Step 4: Make the escrow officer read the details to you

Ask the officer to read their wire details to you, and compare them with what you hold:

• Receiving bank name
• ABA routing number (9 digits)
• Account number
• Beneficiary name, matching the title agency’s legal name
• File number or property address for the reference line

The order matters. A scammer on the line can say “yes, that’s right” to anything. They can’t read out numbers they don’t have.

Step 5: Fund early and confirm receipt

Wire one to two business days before closing. Save the wire’s Fedwire reference numbers from your bank’s confirmation: the IMAD (Input Message Accountability Data) and, once it lands, the OMAD (Output Message Accountability Data). Then call the main line and confirm the title company received the funds.

A small test wire proves an account exists. It can’t prove who controls it. Use one only in addition to the callback.

Step 6: Log the verification

Record the date, time, officer’s name, number called, and IMAD in the deal file. That log supports any insurance claim, bank dispute, or FBI report.

Vetting a title agency you haven’t used before

Out-of-state deals often put you with a new title agency. Before you sign, run five checks:

• License. Confirm the agency and escrow officer hold active licenses with the state insurance department.
• Underwriter. Ask which title underwriter backs the agency, then ask for a closing protection letter on your file.
• Best Practices. Ask whether the agency has completed an ALTA Best Practices assessment.
• Wire process. Ask which verification tool the agency uses, such as CertifID or Closinglock, and how it sends instructions.
• Written warning. Ask for the agency’s wire fraud notice. Good agencies send one at contract, telling you they’ll never change instructions by email.

An agency that can’t answer these questions clearly isn’t ready for a large all-cash wire.

How Do You Protect Wires on Investor-Only Deals?

Standard homebuyer advice skips the transactions investors run every month. Each one creates a different opening.

Contractor and vendor payments carry the same risk outside of closings. An executive bookkeeping virtual assistant can keep verified payee records so a changed bank account never slips through.

How the FinCEN real estate rule adds email traffic on cash deals

Since March 1, 2026, FinCEN’s Residential Real Estate Rule requires title and closing companies to report many non-financed purchases of residential property by LLCs and trusts. Expect requests for beneficial owner details on cash deals. Verify any unusual request for personal data by phone, the same way you verify a wire.

How Do You Spot Seller Impersonation Fraud on Vacant Land?

In seller impersonation fraud, a criminal poses as the owner of a property and sells it to you. The FBI’s Newark field office reported a 500% increase in these schemes over four years. The National Association of Realtors’ 2025 Deed and Title Fraud Survey found that 62% of title fraud cases involve vacant land. In a 2024 ALTA survey of 783 title companies, 85% said seller impersonation is at least somewhat common in vacant land deals.

Warning signs of a fake land seller

• They refuse to meet in person or on a live video call.
• They push for an all-cash, fast closing below market value.
• They text or email only, often from a VoIP number.
• They know little about the parcel.
• They insist on their own remote notary.

Mail a letter to the owner’s address on the county tax bill and ask them to confirm the sale. Ask your title agency to run enhanced identity verification before closing.

What Should You Do in the First 24 Hours After a Stolen Wire?

FinCEN reports its best recovery results within 24 hours, and it describes 72 hours as the outer window. Work this list in order, the same day.

24-hour emergency protocol for stolen closing wires

1. Call your bank’s wire fraud line. Request a recall and ask the bank to contact the receiving bank. Give them the IMAD from your confirmation. Get a case number.
2. File at ic3.gov. Include the amount, date, receiving bank, routing number, account number, and IMAD. The IC3 report is blunt: “Regardless of the amount lost, file a complaint at www.ic3.gov.”
3. Call your local FBI field office and ask for the cyber squad.
4. Alert the title agency and any QI or custodian. They can freeze other disbursements on the file.
5. Preserve evidence. Save the fraudulent emails with full headers. Delete nothing.
6. Secure every mailbox. Reset passwords, turn on multi-factor authentication, and remove any forwarding rules you didn’t create.

How the FBI freezes stolen wires

The IC3 Recovery Asset Team runs the Financial Fraud Kill Chain, a process that works with banks to trace and freeze stolen funds. According to the IC3’s 2025 annual report, it handled 3,900 incidents and froze $679,013,183 USD, a 58% success rate. The $449,000 USD case above ended that way. The recipient bank confirmed the full amount still sat in the account, on hold.

Who Pays When a Closing Wire Goes to a Scammer?

Liability depends on your state, your contracts, and whose system the attacker breached. Plan as if you’ll absorb the loss.

Why banks rarely refund misdirected wires

Article 4A of the Uniform Commercial Code governs wire transfers in the US. Under UCC § 4A-207, when a payment order names one beneficiary but lists another person’s account number, the receiving bank can pay the account number as long as it doesn’t know the name and number conflict. Banks don’t match names to numbers. Scammers exploit exactly that gap.

What title insurance and closing protection letters cover

An owner’s title policy covers title defects, such as a forged deed or an unknown lien. It doesn’t cover funds you send to a criminal. A closing protection letter (CPL) covers certain failures and dishonest acts by the title agent, and it rarely reaches an outside criminal’s scam.

Insurance and tools that reduce your exposure

Ask your broker about a cyber policy with social engineering fraud coverage, and check the sublimit. Many title agencies use wire verification platforms such as CertifID. CertifID’s State of Wire Fraud report says it verified more than 1.46 million wires in 2025 and prevented $283 million USD in losses.

How Does a Real Estate Investor Assistant Keep the Checklist Running?

A checklist fails the week you’re juggling three closings and a rehab. A real estate investor assistant makes it routine, while you keep control of the money. Callback prep is one of the top tasks to delegate to an outsourced executive assistant, because it’s repeatable and rule-based.

Split duties so no one person controls a wire

Your assistant never holds wire authority. That separation stops a single compromised account from moving money. Grant access in stages, as our guide on how to onboard an outsourced executive assistant explains.

Email security settings for an investor team

• Phishing-resistant sign-in. Use passkeys or hardware security keys, such as YubiKey, on email accounts. Text-message codes fall to SIM swaps.
• Domain protection. Publish SPF and DKIM records, then set your DMARC policy to “p=reject.” Criminals then can’t send mail that passes as your domain.
• A dedicated closing address. Keep deal email separate from marketing and lead generation inboxes.
• A password manager. Share credentials through 1Password or Bitwarden, never by email or text.
• Monthly rule checks. In Gmail, review Settings, then Forwarding and Filters. In Outlook, review Rules.

For contracts, NDAs, and background checks on remote staff, see is hiring a virtual executive assistant safe and our breakdown of security risks and solutions in executive assistant outsourcing.

Real Estate Wire Fraud FAQs

Can a bank reverse a completed wire transfer?

Your bank can request a recall. The receiving bank decides whether to return funds, and it can only return what the criminal hasn’t moved. Report within 24 hours for the best odds.

Do 1031 exchange funds need a separate callback?

Yes. Money moves twice: from your sale to the QI, then from the QI to your next closing. Run the full callback on both legs.

Does the CFPB or FBI publish closing scam warnings?

Yes. The Consumer Financial Protection Bureau publishes a guide to mortgage closing scams, and ALTA’s wire fraud resources cover the title side. Share both with new team members.

What if my own email sent the fake instructions?

Treat it as a breach. Reset credentials, remove unknown forwarding rules, check your DMARC reports, and warn everyone on open deals by phone.

Run the Callback on Every Wire

A stolen wire takes minutes. The callback takes five. Build the habit into every deal, including small deposits and draws.

If your deal volume makes that hard to police yourself, a real estate investor assistant can own the verified contacts, the callback log, and the mailbox audits, while every wire still needs your approval.

This article shares general information. For advice on liability, insurance, or a specific loss, talk to a real estate attorney.