Real Estate Wire Fraud via Email
How fraudsters intercept real estate transactions by compromising email accounts and redirecting closing funds to bank accounts they control.
Part of: Real Estate Wire Fraud
Last reviewed: 8 June 2026
Real estate wire fraud is one of the most financially devastating email-based scams because the sums involved — down payments, closing costs, and full purchase prices — are typically the largest single payments a consumer will ever make. The fraud exploits the standard practice of wiring funds at closing, inserting fraudulent wire instructions by impersonating a title company, real estate attorney, or agent whose email has been compromised or spoofed.
Because wire transfers are processed quickly and are very difficult to reverse, victims who discover the fraud often do so after the funds have been moved multiple times and are largely unrecoverable. The buyer believes the transaction is proceeding normally right up until they discover that the legitimate closing party never received the payment.
This guide explains how email compromise enables real estate wire fraud and the specific verification step that prevents it.
How this scam works on email
In the weeks before a scheduled closing, a buyer receives an email appearing to come from their title company, real estate attorney, or agent with updated wire instructions. The email address may be nearly identical to the legitimate address — with one letter changed or an extra domain suffix — or may come from a genuine account that has been compromised.
The wiring instructions include the fraudster's bank account details rather than the legitimate title company's. The email may reference the correct property address, closing date, and parties involved, details obtained by monitoring the compromised email account for weeks before the fraud occurs.
The buyer wires the funds to the fraudulent account, often on the day of or the day before closing. The legitimate closing party has no knowledge of the transfer. The buyer discovers the fraud when the closing agent asks why funds have not been received. By this time the fraudulent account has typically been emptied.
Common red flags
- Wire instructions arrive by email rather than being provided in person or by phone via a number you called independently
- Instructions differ from any previously received without a confirmed verbal explanation from a person you called
- Email address is slightly different from previous correspondence — check every character
- Urgency in the email about completing the transfer before the end of the business day
- No callback number provided, or the callback number in the email connects to a voicemail you cannot verify
How to protect yourself
- Always verbally confirm wire instructions by calling a number you obtained independently from the closing documents — not from the email
- Treat any change in wire instructions as a red flag requiring in-person or independently verified phone confirmation
- Use a secure communication method to receive final instructions, such as an in-person meeting or a call to the title company's main publicly listed number
- Set up a separate verification call with your real estate agent or attorney for all fund transfer instructions
- If you have already wired funds to what may be a fraudulent account, call your bank immediately — a quick response may allow a recall
How to report it
- Call your bank immediately to attempt a wire recall — every minute matters
- File a report with the FBI's Internet Crime Complaint Center at ic3.gov
- Report to the FTC at reportfraud.ftc.gov
- File a police report for use in any insurance or civil recovery process
Frequently asked questions
Can I recover funds wired to a fraudulent account?
Recovery is possible but time-sensitive. Contact your bank within the same business day if possible to request a wire recall. The FBI's IC3 also has a Financial Fraud Kill Chain process for large transfers. Swift action is the most important factor.
How do fraudsters know the details of my real estate transaction?
In most cases, one of the email accounts involved in the transaction — yours, your agent's, or the title company's — has been compromised through a phishing attack. The fraudster monitors the email thread until a suitable moment to insert false wire instructions.