The Email That Costs You the House: Wire Fraud at Closing

There is one way to lose the entire down payment in an afternoon, and it is not a market downturn. It is sending it to the wrong account because an email told you to.

This is not a rare or exotic crime. Real estate closings are the ideal target — a known large sum, moving on a known date, between parties who mostly communicate by email and have often never met in person — and the money is usually gone within hours of arriving.

How it actually works

The mechanism is dull, which is exactly why it succeeds. Nobody is breaking encryption.

1.Someone gains access to an email account in the transaction. Often not yours — an agent's, an assistant's, a paralegal's at the closing office. Usually through a reused password or a convincing login page.
2.They read, and they wait. Sometimes for weeks. They learn the names, the property, the closing date, how everyone writes, and roughly what the numbers will be. Many set a quiet forwarding rule so they keep seeing the thread even after a password change.
3.They send instructions at the right moment — the day the real ones were due. The message looks correct because it is modelled on the real thread. The sending address is a near-miss on a real one: a letter swapped, an extra hyphen, `.co` instead of `.com`, a display name that is right while the address underneath is not.
4.The wire lands in an account they control, and is moved out and broken up immediately.

Two details make this worse than it sounds. A wire is not a cheque — there is no clearing period and no unilateral reversal. And the funds are yours, not the attorney's, so the loss usually falls where it lands.

The specific version you will see

The message tends to arrive with a plausible reason for the change: the firm's bank has updated its routing, there is an issue with the previous account, the wire room has moved. It will urge speed and it will discourage calling — a note about the office being in closings all day, or a phone number helpfully included in the email itself, which is of course the sender's.

Any of the following in an email about money is the signal, and any one of them alone is enough:

Instructions that have changed from what you were given before.
Urgency attached to the change.
A phone number supplied in the same message as the instructions.
A reply-to that differs from the sender, or a domain you have not read character by character.
First-time instructions arriving by email at all, unencrypted, with no prior conversation about how they would come.

The one habit that defeats all of it

Call and verify, using a number you already had.

Not the number in the email. Not the number in the signature block of the email. The number from the firm's website that you looked up yourself, or the one on the engagement letter you were sent weeks ago, or the one you have already used to speak to a human being. Read the account number and the routing number aloud and have them read back to you.

That single step costs three minutes and defeats the entire scheme, because the fraud depends completely on the instructions never being checked against a channel the criminal does not control. Do it even when nothing looks wrong. Especially then — a well-run version of this looks entirely normal, and the instructions that are correct are also the ones that survive a phone call.

What else to do, on both sides

For buyers:

Establish at the start how instructions will be delivered, and agree that they will never change by email. Ask your attorney what their process is. A firm with a good answer has thought about this.
Send a small test wire the day before where the bank and the timeline allow it, and confirm receipt by telephone before sending the balance.
Confirm receipt after sending, by telephone, the same day. Speed matters enormously in recovery.
Use unique passwords and two-factor authentication on the email address you use for the transaction. Most compromises here start in somebody's inbox, and the transaction is only as protected as the least careful account on the thread.

For sellers: the same crime runs in reverse. Someone impersonates you and asks the attorney to send your proceeds elsewhere. Tell your attorney at the outset that your payout instructions will be given in person or by a verified call and never by email, and ask how they will verify a change.

If it has already happened

The next few hours are the only ones that matter, and acting inside them recovers money often enough to be worth the panic.

1.Call your bank immediately and ask for a wire recall and a SWIFT indemnity. Say the words fraud and misdirected wire.
2.Call the receiving bank and report the account as fraudulent.
3.File with the FBI's Internet Crime Complaint Center at ic3.gov straight away. Its Recovery Asset Team can ask a domestic receiving bank to freeze the funds, and that mechanism works best within roughly the first day or two.
4.Call local police and the Massachusetts Attorney General's office.
5.Tell the closing attorney and your agent, then assume every account on the thread is compromised and change those passwords from a different device.

Do all five in parallel rather than in order, and do not wait until morning.

The part that is uncomfortable

People assume the attorney, the bank or the title company will make them whole. Sometimes one of them does, and it is never quick, and it usually involves establishing that somebody else was negligent. You may also find that the party whose email was compromised was not the party who lost the money, which is precisely why no one in the chain can be relied on to protect you.

This is one of the few risks in a transaction where the entire defence is yours, it is free, and it takes three minutes. Make the call.