Real Estate Wire Fraud: How It Works and How to Protect Your Down Payment

The FBI's Internet Crime Complaint Center reported that cybercriminals stole more than $275 million through real estate-related fraud in the United States in 2025 alone — targeting at least 12,368 victims. That's up from $173 million in 2024 and $145 million in 2023. In the UK, conveyancing fraud cost victims an average of £78,393 per incident in 2024-2025. In Australia, payment redirection scams caused $166.8 million in losses in 2025.

These aren't sophisticated hackers exploiting banking software vulnerabilities. They're criminals who send emails. And the reason they keep winning is that most buyers don't know what the scam looks like until after they've lost their entire down payment.

Here's exactly how it works — and what you do to stop it.

How the Scam Works: The Business Email Compromise Attack

Real estate wire fraud is almost always executed through Business Email Compromise (BEC). The attack has three phases:

Phase 1: Infiltration. Criminals gain access to the email account of someone involved in your transaction — most commonly a title agent, conveyancing solicitor, or real estate attorney. This access is obtained through phishing campaigns targeting those professionals, or by exploiting weak, reused passwords. Once inside, the attacker creates inbox rules that hide their activity and quietly monitors communications.

Phase 2: Patience. The attacker doesn't act immediately. They wait, sometimes for weeks, until a specific transaction approaches its closing date and the value of the wire transfer is confirmed.

Phase 3: Interception. Days or hours before closing, the attacker sends an email to the buyer — either from the compromised, authentic account or from a typosquatted domain (like [email protected] where the lowercase 'L' is replaced with an uppercase 'I'). The email is indistinguishable from a legitimate communication. It uses the professional's exact signature, formatting, and tone. It states that there has been a "last-minute update" to the escrow account details and provides new wiring instructions.

The buyer, already in a state of high stress and cognitive overload from weeks of paperwork and financial pressure, wires their life savings to a mule account controlled by a criminal syndicate operating in another country.

By the time the real title company calls to ask where the funds are, the money has been routed offshore or converted to cryptocurrency. In roughly one-third of cases, the money is never recovered.

Why You Can't Spot It by Looking at the Email

The sophistication of modern BEC attacks means the email will look exactly right. The attacker has been reading your transaction's email thread for days or weeks. They know your name, your agent's name, the lender's name, the purchase price, and the closing date. The email won't misspell words or use awkward phrasing. It will reference specific details that only someone inside your transaction would know.

The FBI notes that fraudsters are increasingly using artificial intelligence to generate synthetic content, voice clones, and social profiles to make these communications even more convincing.

The attack works because it exploits trust in familiar parties, not ignorance of technology. Buyers who are technically sophisticated and security-conscious still fall for this because the communication appears to come from their actual title agent.

The Three-Step Verification Protocol

There is one reliable defense against this attack, and it requires you to verify wiring instructions through a channel that is completely separate from email.

Step 1: Source the phone number independently. Get the title company's phone number from your original signed purchase contract, from the company's official website (type it into your browser — don't click a link in an email), or from a physical business card you received in person. Write this number down and save it in your phone before closing week. Never, under any circumstances, call the phone number listed in an email about wiring instructions.

Step 2: Call and verbally confirm the account details. Call the independently sourced number and ask to speak with the person handling your closing. Read the routing number and account number aloud, digit by digit, and ask them to confirm. Do not read the number from the email — read it from somewhere you'll remember, and have them read it back to you.

Step 3: Confirm receipt after the wire is sent. Immediately after initiating the wire transfer at your bank, call the title company again to confirm the funds arrived in their trust account. Do this before your closing appointment. Do not wait until you're sitting at the table to discover the wire went to the wrong place.

This three-step protocol, when followed, results in a 91.7% reduction in successful fraud attempts during the closing phase, according to research on structured verification protocols.

Cashier's Check vs. Wire Transfer: Which Is Safer?

The instinctive response to wire fraud fear is to use a cashier's check instead. A physical check feels more tangible, more controllable. The reality is more complicated.

Cashier's checks have their own fraud exposure: they can be counterfeited, they can be physically lost or stolen in transit, and an increasing number of title companies refuse to accept them for amounts over $5,000 to $10,000 precisely because counterfeit check fraud is a documented problem. Some title companies in Florida, for example, now mandate wire transfers for all transactions regardless of amount.

If you use a cashier's check, confirm the acceptable policy with your title company at least a week before closing. Ask specifically what the maximum accepted amount is. If they'll accept a check, obtain it from your bank and deliver it in person at the closing appointment — don't mail or courier it through a third party.

The bottom line: wire transfers, executed with the three-step verification protocol above, are the most reliable method for large real estate transactions. Cashier's checks are an acceptable alternative when the title company accepts them, but they don't eliminate the risk — they shift it.

What to Do If You've Already Wired to the Wrong Account

If you realize you may have been defrauded, the next 72 hours are critical.

Immediately contact your originating bank. Tell them you believe you've been defrauded and request an emergency wire recall. Ask to speak with the fraud department specifically. Ask for a Hold Harmless Letter or Letter of Indemnity. The bank can attempt to claw back the funds if the receiving bank hasn't yet released them.

File a report at IC3.gov. The FBI's Internet Crime Complaint Center operates a Recovery Asset Team (RAT) that can trigger the Domestic Financial Fraud Kill Chain — a coordinated mechanism between law enforcement and financial institutions to freeze stolen funds. This process has a 71% success rate for funds frozen before they are dispersed, but it requires the amount to be $50,000 or more, the wire to be traceable, and the report to be filed within 72 hours.

The window is narrow. Fraudsters move funds within hours. Every minute you delay reduces the probability of recovery.

International Versions of the Same Scam

United Kingdom — "Friday Afternoon Fraud." UK property completions are overwhelmingly scheduled for Fridays. Criminals know this and specifically target conveyancing solicitors' email accounts on Friday mornings. They intercept the solicitor's final payment request to the buyer, replace the bank account details, and divert the funds. The UK Law Society mandates secure communication portals and in-person verification as a defense.

Australia — PEXA Workspace Fraud. Australia uses the PEXA electronic settlement platform for over 70% of property transactions. Fraudsters don't attack PEXA itself — they compromise conveyancers' email accounts before settlement data is entered into PEXA, then intercept the login credentials. In highly publicized cases, entire settlement proceeds have been diverted by attackers who gained access to a conveyancer's PEXA workspace. PEXA's Key app — a secure, encrypted alternative to email for sharing bank details — exists specifically to close this vulnerability.

Canada — Intercepted Lawyer Communications. The mechanism is identical to the US attack: compromised solicitor email accounts, fraudulent "updated" wire instructions sent to buyers transferring large deposits.

The scam is global because it targets the universal vulnerability: buyers moving large sums of money through unencrypted email.

The One Rule That Overrides Everything Else

If you receive an email during closing week claiming that the wire instructions have changed — regardless of how legitimate the email appears, regardless of who it appears to be from — treat it as a hostile fraud attempt until proven otherwise.

Verify through an independently sourced phone number. Not the number in the email. Not the number in the email signature. Not a number from Google unless you can independently confirm it matches the company's official listing.

Legitimate title companies, conveyancing solicitors, and escrow officers do not change their bank account details at the last minute. When you see that email, pick up the phone before you touch your bank account.

Wire fraud prevention is one section of a larger closing process. The Closing Day Checklist & Wire Fraud Prevention gives you the complete verification script, a line-by-line Closing Disclosure review framework, and a post-closing security plan — everything you need to get from clear-to-close to keys without losing your down payment.