Here's the short version, because this is the one section of this site where you should stop skimming and actually read: before you wire a single dollar of closing funds, call your title/escrow company on a phone number you looked up yourself — not one from an email — and verbally confirm the wiring instructions, every single time, even if nothing looks different. Do that one thing and you've defeated almost every version of this scam. Skip it, and you're playing Russian roulette with your down payment.

Wire fraud isn't a rare, freak-accident scam. It's a mature, industrial-scale criminal business built specifically around the moment you're least equipped to think clearly: the final days before closing, when you're stressed, moving fast, and expecting an email with wiring instructions anyway. In 2025 alone, the FBI's Internet Crime Complaint Center (IC3) logged 12,368 real estate fraud victims who lost a combined $275.1 million — up sharply from $173 million in 2024 (HousingWire, as of April 2026 report on 2025 data). That's an average loss of roughly $22,250 per victim, though real closings often lose far more — CertifID's 2026 State of Wire Fraud report puts the median loss for buyer cash-to-close fraud specifically at $239,850 (CertifID, published March 2026). That's not "oops, lost some money." For a lot of buyers, that's the entire down payment, gone in the time it takes a bank to process a domestic wire — which is often same-day.

How the scam actually works

This isn't a Nigerian-prince email. It's a targeted, patient con, and the mechanics matter because understanding them is what makes the verification step below feel non-optional instead of paranoid.

  1. A hacker gets into an inbox somewhere in the transaction — yours, your real estate agent's, or (most commonly) your title/escrow company's. This usually happens through a garden-variety phishing email weeks or months before your closing has anything to do with you specifically.
  2. They sit there and read. Real estate transactions are unusually easy to monitor this way because everyone loops everyone else into long, forwarded email threads — you, your agent, your loan officer, the title company, sometimes a seller's agent too. A patient scammer can watch an entire deal unfold: your closing date, your loan amount, the exact tone and vocabulary your escrow officer uses.
  3. Right before your closing, they strike — either sending an email from the compromised real account, or from a lookalike domain that's one letter off from the real one, with "updated" or "corrected" wiring instructions. It usually comes with urgency baked in: closing is tomorrow, the funds need to move today, don't want to delay your move-in.
  4. You wire the money. It leaves your account, lands in a mule account the scammers control, and gets moved out — often converted to crypto or split across accounts — within hours.
  5. Nobody notices until the real title company calls asking where the money is. By then it's frequently too late.

The FBI's 2025 data also flags a newer wrinkle worth taking seriously: AI-generated phishing. The IC3 report notes over 22,000 complaints referencing AI-assisted fraud in 2025, and CertifID separately reports a 1,760% increase in business-email-compromise attacks since generative AI tools became widely available (CertifID). Translation: the fake emails read more fluently, mimic your escrow officer's actual writing style more convincingly, and are harder to eyeball your way out of than the clumsy scam emails of a few years ago. You can no longer reliably catch this by spotting bad grammar.

This is exactly the kind of thing that's already showing up in real losses, not hypotheticals. In one widely reported case, an Orlando couple, Matthew and Stefanie Brock, had Stefanie's email compromised during their home purchase; scammers impersonating the title company sent convincing wiring instructions over weeks of correspondence, and the couple wired $38,000 — only $5,000 of which was ever recovered, leaving them $33,000 short on their down payment (Yahoo/Money; exact publication date wasn't visible on the page —). Stories like this aren't outliers on Reddit's real estate and homebuying communities either — variations of "we almost wired to the wrong account" or "we lost our down payment to a fake email" surface regularly enough in r/RealEstate and r/FirstTimeHomeBuyer that title companies now build entire onboarding packets around warning people before it happens to them.

The one habit that stops almost all of this

Every serious source on this topic — ALTA (the title insurance industry's trade association), the CFPB, First American, CertifID — converges on the same core protocol. It's not complicated, which is exactly why skipping it under time pressure is so easy and so costly.

Before you wire anything:

  1. Get your title/escrow company's phone number from a source you control — the engagement letter you signed at the start of the transaction, their official website (typed into your browser, not clicked from an email link), or a business card. Never use a phone number that's in the email containing the wiring instructions. If the email is fake, so is the number in it, and "verifying" by calling that number just connects you to the scammer.
  2. Call and read the account and routing numbers back to them out loud. Confirm the receiving bank name and account number match exactly.
  3. Do this every time, not just the first time. ALTA's own outgoing-wire checklist centers on three things: confirm the source of the instructions, verify them independently by phone rather than trusting email or a third party, and confirm delivery afterward (ALTA). If wiring instructions ever appear to change mid-transaction — even slightly, even with a plausible-sounding explanation ("we switched banks," "here's an updated form") — treat that as the single biggest red flag in the entire process and verify by phone before doing anything else. Legitimate wiring instructions essentially never change last-minute; a "change" is the scam.
  4. Be suspicious of urgency, specifically. Scammers manufacture time pressure on purpose because it's the thing most likely to make you skip step 1. "We need this today or you'll miss closing" is a manipulation tactic as much as it is a possible true statement — verify anyway. A legitimate title company will never be upset that you took ten minutes to confirm instructions by phone before moving six figures.

First American, one of the larger title insurers, frames it almost identically: verify by phone using a number you trust, expect that legitimate instructions basically never change, slow down instead of rushing, and trust your gut if something feels off — plus use any secure portal your title company offers instead of relying on plain email at all (First American).

Are there safer alternatives to wiring?

Sort of — and it's worth being honest about the tradeoffs instead of pretending there's a magic workaround.

  • Secure closing portals. Many title companies now use encrypted, authenticated portals (rather than email) to deliver wiring instructions, and some use third-party verification services like CertifID's SafeWire to independently confirm account ownership before funds move. If your title company offers one, use it — it removes email as the attack surface entirely. Ask about this explicitly when you open the transaction.
  • Cashier's checks. These used to be the default before wires took over, and they're still an option for some closings, but they're not actually safer in 2026 — counterfeit cashier's checks are their own well-documented scam, and banks may make funds "available" before a fake check is discovered to have bounced days later. Don't assume "not a wire" automatically means "not a scam."
  • ACH transfers. Slower and often capped at lower dollar amounts than a wire, which is part of why title companies rarely accept them for full closing funds — but the added time can itself be a modest safeguard, since same-day urgency is the scammer's main weapon.

The honest bottom line: the wire itself isn't the vulnerability — the instructions are. A verified wire, confirmed by phone through a channel you control, is genuinely safe. An unverified wire, no matter how official the email looks, is a coin flip with your down payment.

What title companies and lenders are supposed to be doing

You shouldn't be the only line of defense here, and reputable title companies know it. ALTA's Best Practices framework (the industry's own standards, which most reputable title and escrow companies formally adopt) pushes member companies toward encrypted communication instead of plain email, multi-factor authentication on internal systems, staff training specifically on business-email-compromise tactics, and a strict "no unverified changes" policy on wiring instructions (Proof/ALTA Best Practices summary). If a title company you're working with can't clearly explain how they protect wiring instructions in transit, or has no wire-fraud warning language anywhere in your closing paperwork, that's worth asking about directly — and if the answer is vague, it's a legitimate reason to ask your agent about alternatives.

Worth knowing: CertifID's 2026 survey found 22% of homebuyers reported receiving fraudulent or suspicious communications at some point during closing (CertifID) — meaning this isn't a rare edge case you're being paranoid about. Roughly one in five buyers is getting actively targeted. The industry knows this; 60% of title professionals surveyed reported fraud attempts increasing. A good title company should be treating wire verification as standard operating procedure, not a favor.

If you think you've already been defrauded

Speed is genuinely everything here — not in a vague "act fast" marketing sense, but in a real, quantified one. According to CertifID's data, victims who report quickly recover all or most of their funds about 73% of the time overall, but the odds collapse fast with delay: one former U.S. Secret Service official quoted in CertifID's recovery research put it bluntly — recovery success "goes down into the low single digits" after the first 24 hours (CertifID). In the first hour or two, do this, in this order:

  1. Call your bank's fraud department immediately — not email, not a form, a phone call — and explicitly request a wire recall (banks may call it a SWIFT recall for domestic/international wires). Ask them to flag the receiving account for a fraud freeze.
  2. File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov the same day if at all possible. This isn't just paperwork — IC3 complaints feed the FBI's Recovery Asset Team, which works directly with banks to try to freeze and claw back funds before they're moved further.
  3. Call your title/escrow company and real estate agent to let them know, both so they can help verify what happened and so they're not left wondering why your closing funds never arrived.
  4. Document everything — the fraudulent email, headers if you can get them, timestamps, confirmation numbers from your bank call, the IC3 complaint number.
  5. File a local police report. It won't get your money back on its own, but it's often required for insurance claims or later legal action, and it strengthens your case with the bank.

Some buyers do get made whole — CertifID reports its recovery services alone helped recover $118.4 million at a 69% recovery rate for the victims who engaged them (CertifID) — but that's specifically among people who reported quickly and had professional help pursuing it. Waiting a few days to "see if it sorts itself out" is, statistically, how buyers end up in the minority who never get their money back.

The actual takeaway

You will, at some point in this process, receive a legitimate email containing wiring instructions. It will look exactly as official as a fake one — official letterhead, correct-looking language, maybe even the right contact names. The email itself is never proof of anything. The phone call is the whole ballgame. Look up the number yourself, call before you wire, and call again if anything ever changes. It costs you ten minutes. The alternative costs people their down payment.

Sources