A real estate closing brings together a large amount of money, several professionals, firm deadlines, and a steady stream of email. That makes it an attractive target for criminals who imitate a trusted person and redirect funds. The safest response is a verification routine established before closing: know who will send instructions, use contact information obtained independently, and treat every unexpected payment change as a reason to stop—not a reason to hurry.
What closing wire fraud means
The FBI describes business email compromise, or BEC, as a scheme that targets businesses and individuals making legitimate transfers of funds. A criminal may compromise a real email account, imitate one with a look-alike address, or use social engineering to make a false request appear routine.
In a home purchase, the message may seem to come from a title company, closing agent, lender, attorney, or real estate professional and contain false wiring instructions. A seller can also be targeted if a criminal tries to replace the account information used for sale proceeds. The message may include accurate names, dates, property details, or copied signatures because the criminal has monitored an account or gathered public information.
A wire transfer is not suspicious merely because it is a wire. The danger is sending money to an account that was not independently verified, especially after an unexpected change in payment method, bank, account number, recipient name, deadline, or communication channel.
A Southeast Wisconsin example
Imagine a buyer preparing to close on a home in Waukesha County. Two days before closing, an email appears in an existing conversation and says the title company has moved the escrow account. The message includes the property address, the correct closing date, and an urgent request to wire the final amount before noon. The signature and formatting look familiar.
The correct move is to pause. The buyer should not reply, click the message's links, use its phone number, or send a small test transfer. Instead, the buyer should call the closing company using a number saved earlier or found through an independently verified source and confirm the recipient name, bank, routing number, account number, amount, and timing under that company's security procedure.
The same rule applies to a Milwaukee-area seller who receives a request to submit new proceeds instructions. A last-minute account change should be verified through a trusted secondary channel before the closing agent changes where the seller's money will go.
Build the verification plan before closing week
The Consumer Financial Protection Bureau recommends identifying trusted people who can confirm the closing process and payment instructions, recording their contact information in advance, and verifying instructions in person or by calling a previously agreed-upon number. This turns verification into a planned step instead of an improvised reaction to an urgent message.
- Ask the closing or title company how instructions will be delivered and whether it ever changes instructions by email.
- Save the closing company's main number and your specific contact's number from an independently verified source before funds are due.
- Confirm whether the buyer should use a wire, cashier's check, or another approved method; do not assume every closing uses the same process.
- Ask which account details the company will require you to verify and whether it uses a secure portal or another protected method.
- If seller proceeds will be transferred electronically, ask how the closing company verifies the seller's account and any requested change.
- Use a unique password and multifactor authentication on the email account involved in the transaction.
Red flags that should stop the transfer
Fraudulent instructions can look polished, arrive at a believable moment, and appear inside a familiar conversation. Spelling errors are not a reliable screening tool. Look instead for changes in process, destination, or pressure.
- New bank, routing, account, recipient, or payment instructions—especially close to the deadline.
- A request to keep the transfer secret or avoid calling someone already involved in the closing.
- Pressure to act immediately because the closing will supposedly fail, be delayed, or incur a penalty.
- A sender address or website domain with an added letter, missing character, unusual ending, or display name that hides the full address.
- A phone number, QR code, attachment, or sign-in link supplied only in the unexpected message.
- A request to email passwords, security codes, full banking credentials, or other sensitive financial information.
The before-you-send checklist
Use this final pause even when the request appears completely normal. A few deliberate minutes are worth more than the convenience of treating an email as self-authenticating.
- Call a verified contact using a number you obtained before the payment request—not a number in the message you are checking.
- Confirm the full recipient or account name, financial institution, routing number, account number, exact amount, and deadline under the closing company's procedure.
- Ask the contact to explain any difference from earlier instructions; do not accept 'the bank changed' as enough by itself.
- Review the full sender address and destination website on a larger screen when possible.
- Do not forward the suspicious message to the same address and ask whether it is real; a compromised account may answer.
- After sending, confirm receipt through the same independently verified channel and monitor the originating account.
If money may have gone to the wrong account
Act immediately. The FBI says to contact the originating financial institution as soon as fraud is recognized and request a recall or reversal, along with any required Hold Harmless Letter or Letter of Indemnity. Different institutions have different procedures, and a request does not guarantee recovery.
Also notify the legitimate closing or title company and other appropriate transaction professionals using verified contact information. Preserve the email, full sender information, attachments, transfer confirmation, account details, dates, phone numbers, and notes about every conversation. Do not delete the message or rely only on screenshots when original records are available.
File a detailed complaint with the FBI's Internet Crime Complaint Center at IC3.gov. The FBI states that complaints should include the required banking and transaction details. Be cautious of anyone who later claims to be IC3 and offers to recover the money; the FBI has separately warned about scammers impersonating IC3 personnel.
- Call the bank or wire-transfer provider immediately and ask for its fraud and recall procedure.
- Contact the legitimate closing company through a verified number so it can protect the transaction and its systems.
- File an IC3 complaint promptly and include complete transaction information.
- Change compromised passwords, enable multifactor authentication, and follow the bank's and email provider's security instructions.
- Document every report, reference number, contact, and time.
Questions to ask your closing team
- Who is authorized to send or confirm payment instructions?
- What exact method will you use to deliver those instructions?
- Do you ever change wiring instructions by email?
- Which phone number should I use to verify the instructions?
- What information will you ask me to confirm, and what information should I never send by email?
- How will we confirm that buyer funds or seller proceeds were received correctly?
- Whom should I contact first if I see a suspicious message or transfer?