Wire transfer fraud

Wire transfer fraud is one of the highest-dollar scams in America. The typical victim is someone about to close on a house, and the pattern is almost surgical: a fake email appears to come from the title company, giving wire instructions at the critical moment. The buyer sends their down payment — often hundreds of thousands of dollars — to a fraudster's account. The money is usually gone within hours, and banks can rarely recover wires once sent.

How it works

1. Attackers compromise the email account of a real estate agent, title company employee, or attorney (usually through phishing).
2. They sit silently in the email inbox, watching for an active transaction approaching closing.
3. At the critical moment, they send a message that looks exactly like a real one from the title company — often replying within a real email thread — with 'updated wire instructions.'
4. The buyer, trusting the thread, wires the money to the fraudster's bank account.
5. The money is immediately moved through multiple accounts and often converted to crypto. Recovery is rare.

Why the fake email is so convincing

This isn't a spray-and-pray phishing blast — it's a targeted operation run from inside a real mailbox. Because the attacker has been reading the actual thread for weeks, the fraudulent message references your real closing date, your real loan officer's name, and the real property address. It often arrives as a reply within the genuine email chain, sometimes from the agent's actual compromised account, sometimes from a domain one character off (title-company.com vs. titIe-company.com, with a capital i). The story is always plausible: 'our bank is undergoing an audit, please use these updated instructions.' Buyers at closing are stressed, sleep-deprived, and conditioned to follow instructions quickly — which is precisely why attackers wait for that moment.

Why phone verification and not email confirmation? Because the attacker is inside the email. Reply to the fraudulent message asking 'is this right?' and the criminal — who controls the thread — cheerfully confirms their own instructions. People have lost six figures after 'double-checking' this way. The verification has to travel over a channel the attacker doesn't control, which means a voice call to a number you obtained somewhere other than the email: the title company's website, your closing documents, a business card from your first meeting. This is also why you should be suspicious of any phone number contained in the wire instructions themselves — fraudsters include their own 'verification line,' staffed and ready, for exactly this moment.

Business wire fraud

Small businesses face a similar version: an attacker compromises an executive's email, then sends the CFO or bookkeeper an 'urgent' wire instruction to a new vendor. Defense: a written policy that any new wire destination requires phone verification with the employee who requested it. Any exception to this policy should be treated as a red flag, not a normal request.

Protecting your transaction before it starts

• At the first meeting with your title company or attorney, ask how wire instructions will be delivered and state that you will verify by phone before sending anything. Legitimate professionals welcome this — many now require it.
• Get the wire details early in the process, in person or through a secure portal, so a last-minute 'change' has a baseline to be compared against.
• Ask whether the title company uses a secure document portal instead of email attachments; many fraud losses trace to instructions sent as ordinary PDFs.
• Confirm receipt after sending: call the title company an hour after wiring and verify the funds arrived in their account. A same-day discovery is recoverable far more often than a next-day one.
• For businesses: require dual approval on all wires, verify any banking change with the vendor at a known number, and train whoever pays invoices that 'urgent and confidential' requests from executives are the attack pattern, not a normal workflow.

If the wire already went out

1. 1
   Call your bank's wire department immediately

   Request a wire recall and a SWIFT recall if international. Minutes matter — funds often sit in the first receiving account for a few hours before moving.

2. 2
   File at ic3.gov the same day

   Reports filed quickly can trigger the FBI's Financial Fraud Kill Chain, which can freeze domestic wires over $50,000 if initiated within about 72 hours.

3. 3
   Call the receiving bank's fraud department

   Identify the account and transaction and ask them to freeze the funds pending the recall. They won't discuss the account with you, but they will act on fraud flags.

4. 4
   Notify everyone in the transaction

   Title company, agent, lender, and attorney — both to hunt the compromise and because someone's insurer may be liable. Preserve the fraudulent emails with full headers.

5. 5
   File a police report and FTC report

   You'll need the paper trail for insurance claims, disputes, and any litigation over which party's email was breached.

The bottom line

Wire fraud succeeds because a wire is the one payment everyone treats as routine on the single largest transaction of their life. Flip the default: assume any emailed wire instruction is fraudulent until confirmed by voice at a number you looked up independently, treat every 'change' near closing as an attack, and move fast — bank, IC3, receiving bank — if money leaves. The verification call costs five minutes. Skipping it has cost people their houses.