Wire Fraud at Closing and How Firms Stop It

Real estate closing is an unusually attractive target. The amount is large, the date is knowable, the buyer is expecting to send money to an unfamiliar party, and everyone involved is under time pressure. Business email compromise exploits exactly that combination, and the losses are frequently unrecoverable.

How it actually happens

The attacker gains visibility of the transaction — commonly through a compromised email account belonging to a party in the chain, sometimes an agent or a small firm rather than the buyer. They watch, learn the closing date and the names, and then send instructions that arrive at a plausible moment, referencing real details, with altered account numbers. Often they also intercept and delete the genuine instructions.

The email that redirects the funds usually comes from a real mailbox belonging to a real party. That is why it reads correctly.

Set expectations before the money moves

The most effective defence costs nothing and happens at engagement, weeks before the risk arises. Tell the client in writing, and again verbally:

• Wire instructions will be provided once, by a stated method, and will never change by email.

• Any email changing bank details is fraudulent — do not act on it, and tell us.

• Before sending, call this specific number, which you should record now, and verify verbally.

• Do not use a phone number that appears in an email about the wire, even ours.

Verify out of band, both ways

The buyer should verify the firm's instructions by calling a number obtained independently. The firm should verify the buyer's identity and the incoming wire by calling the buyer on a number captured at intake. Both directions matter: fraudulent payoff and seller-proceeds instructions targeting the firm are as common as instructions targeting the buyer.

Harden the email channel

• Multi-factor authentication on every mailbox, without exception.

• Alerting on mailbox forwarding rules — attackers create them to stay hidden.

• Authentication records published for your domain so spoofing is harder.

• A secure portal for documents and instructions rather than email attachments.

• Prompt review of login activity from unexpected locations.

Verify payoffs and seller proceeds too

Attention concentrates on the buyer's incoming funds, but outgoing disbursements carry the same exposure. Payoff instructions should be verified with the lienholder using contact details from the lender's own published channels, and changes to seller proceeds instructions should require verbal confirmation with a known contact plus a second approver.

Have the first hour planned

If a wire goes astray, speed is the only real lever. Know in advance who calls the sending bank to request a recall, who contacts the receiving institution, who files with law enforcement, and who notifies the insurer and the client. Recovery odds fall sharply after the first day, and a firm improvising the sequence loses hours it cannot recover.

This describes risk-management practice and is not legal advice. Obligations around client funds, notification and insurance vary by state and by bar; confirm your firm's requirements and check your crime and cyber coverage actually responds to social-engineering losses — many policies exclude them without a specific endorsement.