Wire Fraud at the Closing Table: Five Habits Every Brokerage Should Teach

A closing brings together a buyer, a seller, two agents, a lender, and a title or escrow company, all trading email about a large sum of money on a known date. That is exactly the setup an email fraudster looks for. They don't need to break into the title company. They need one convincing message, at the right moment, telling someone the wiring instructions have changed.

What the numbers show

The FBI's Internet Crime Complaint Center recorded 12,368 real estate fraud complaints in 2025, with $275.1 million in reported losses, up from about $173 million the year before.^1,2 Those are reported figures only. Many incidents never reach the FBI, so the real total is higher.

For a brokerage, the more useful point is where these schemes start. Almost always, it's in someone's inbox.

Why brokerages are part of the picture

Agents sit in the middle of nearly every transaction thread, usually on a phone, often between showings. A compromised agent mailbox hands a fraudster the thread history, the closing date, the names of every party, and the tone of real messages. From there, a spoofed or hijacked reply with "updated" instructions looks routine.

A title company's controls can be excellent and still fail if the buyer is told, by what looks like their own agent, to send funds somewhere else.

1. Tell clients how wiring instructions will arrive, early and in writing

At the first meeting or in the buyer packet, state the rule plainly: wiring instructions come only from the title company, through a method you name, and they will never change by email. A client who hears the rule weeks in advance is far harder to fool on closing day. Title underwriters give the same advice: set expectations about how instructions will and won't be delivered before anyone needs them.⁴

2. Agents never relay wiring instructions

Not forwarded, not pasted into a text, not "just passing this along." If an agent's mailbox is ever compromised, anything that agent sends about money becomes suspect. The simplest rule is that agents don't send it at all, and clients know that.

3. Verify by phone, using a number you already had

Any wiring instruction, and any change to one, gets a call to the title company at a number obtained independently, never one taken from the email itself. The National Association of REALTORS® also suggests asking the sending bank to confirm the name on the receiving account, and calling the title company within a few hours of sending to confirm the funds arrived.³ As NAR puts it, "It's extremely rare that wiring instructions will change at the last minute."³

4. Protect the agent's mailbox as if it holds the money

In practice, it does. Turn on multi-factor authentication for email, stop reusing passwords, and check periodically for forwarding or filtering rules nobody remembers creating. Attackers commonly add these rules after getting in so they can read a mailbox quietly for weeks.⁴

5. Know the first-hour playbook before you need it

If money has gone to the wrong account, speed matters more than anything else:

• Call the sending bank immediately and ask for a wire recall.
• Contact the title company at a number you already had.
• File a complaint at IC3.gov.

Reporting within the first 24 hours gives the best chance of recovering funds.^3,4 Put these steps on a single page and make sure every agent and assistant knows where it is.

Why a disclaimer isn't enough

Most brokerages already have a wire fraud warning in their email signature. A disclaimer states the rule. It doesn't build the reflex to pause when a convincing message arrives at 4:45 on a Friday before a Monday closing. That reflex comes from practice: seeing realistic examples, including the "updated instructions" email, in a setting where getting it wrong costs nothing. We cover why that kind of repetition matters in Why Annual Security Training Doesn't Stick.

To put habit 1 in place this week, use our free Client Wire Safety Notice: a fillable one-page notice for buyers, with space for your brokerage name and verified contacts. For a broader self-check covering account access, payment verification, and reporting, see the Email Fraud Readiness Checklist.