7 Red Flags That Signal a Transaction Scam
Trust Your Instincts — But Know What to Look For
Experienced agents often describe the feeling the same way. Something in a transaction feels slightly off. A message arrives at the wrong time. A seller is too eager. An email looks right but reads wrong. The instinct fires before the logic catches up.
That instinct is worth trusting. But instinct alone is not a system. Fraudsters who target real estate transactions are patient, organized, and increasingly sophisticated — and they deliberately design their approaches to look normal enough to survive a quick scan. The red flags they leave behind are often subtle. Some are hiding in plain sight.
Real estate fraud losses climbed to $275.1 million in 2025, driven by 12,368 complaints filed with the FBI's Internet Crime Complaint Center. The FBI's annual report emphasizes how AI is shaping fraud, helping schemers appear more convincing and making attacks harder to detect. National Association of Realtors
This post breaks down seven red flags — drawn from FBI data, title industry research, and documented fraud cases — that should stop any transaction in its tracks and trigger immediate verification before anything moves forward.
Red Flag #1: Last-Minute Changes to Wire Instructions
This is the most universally recognized red flag in real estate fraud — and for good reason. It is the central mechanic of nearly every wire fraud scam targeting buyers and sellers.
New wiring instructions or sudden "revised" bank details sent by email are among the clearest warning signs of a transaction scam, along with messages that demand fast action or contain urgent language. Barnes Walker
The email arrives days before closing — sometimes hours — and carries some variation of the same explanation: a banking system update, a correction to the previous account number, a change due to a recent merger, or a compliance-related switch. The message is polished, references the correct property address, and includes a deadline.
None of it is real.
Legitimate wire instructions are established early in a transaction and communicated through verified channels. They do not change at the last minute. They do not change without a direct phone call from a known contact at a number that was established before the suspicious email arrived. And they are never, under any circumstances, updated by email alone without independent verbal confirmation.
The scam often happens near closing, when everyone is busy, the paperwork is moving quickly, and large payments are expected. A fake email may say that wiring instructions have changed or that the buyer or seller needs to use a different account — and the message may look completely real. CYBERRISKED
The response to this red flag is the same every time: stop, do not wire, and call the title company or attorney using a phone number that was saved at the beginning of the transaction — not a number found anywhere in the suspicious email.
Red Flag #2: Artificial Urgency and Pressure to Act Now
Urgency is the fraudster's most reliable weapon. It works because it bypasses rational evaluation. When someone believes a deadline is real and the consequences of missing it are serious — losing the house, delaying the closing, breaching the contract — they stop verifying and start complying.
If someone threatens "losing the deal" if you don't send money or sign documents immediately, it's a red flag. Scammers often create a false sense of urgency, pushing you to act fast without giving you time to review details or consult with legitimate advisors. Rocket mortgage
Watch for this pressure appearing across multiple channels simultaneously — an email, then a follow-up text, then a call — all driving toward the same wire transfer within a tight window. Scammers thrive on urgency. You may be told that a deal is about to fall through, a buyer has pulled out, or funds must clear before a certain deadline. Redpincompany
Legitimate transactions have scheduled, expected timelines. Title companies and attorneys do not set 90-minute windows to wire six-figure sums without prior discussion. Any communication that creates pressure to act before you have had time to verify — regardless of how legitimate it appears — should be treated as a fraud indicator until proven otherwise.
The rule for agents and buyers alike: urgency in a wire-related communication is a reason to slow down, not speed up.
Red Flag #3: An Email Address That Is Almost — But Not Quite — Correct
The spoofed email address is one of the most technically reliable red flags available to anyone willing to look for it. The problem is that most people never look.
Email addresses with unusual spelling or small variations are a consistent warning sign. A criminal registers an address that is nearly identical to a real one, often changing only one letter or using a different extension. Barnes Walker
The variations fraudsters use are deliberately chosen to escape quick notice:
A lowercase "l" replaced by a capital "I" — visually identical in most fonts
An "m" replaced by "rn" — nearly impossible to spot at normal reading speed
A hyphen added between words in a domain: title-company.com instead of titlecompany.com
A domain extension swap: .net or .biz instead of .com
An extra character added anywhere in the domain
Sometimes the fraud attempt comes from a legitimate email address that has been compromised, and you simply cannot tell. "Even then, identifying that an 'm' has been replaced with 'rn' can be hard to spot if you're not looking for it," notes a fraud strategy director at JPMorgan Chase. The best way to ensure funds are sent to the appropriate account is by directly validating instructions with the known party — never by using a phone number provided in the email itself. J.P. Morgan
The habit to build: on any email containing wire-related information, click on the display name to reveal the actual sending address. Compare it character by character to an address from a confirmed earlier communication. This takes 15 seconds and catches one of the most common fraud techniques in use today.
Red Flag #4: A Seller Who Avoids All In-Person Contact
This red flag sits at the center of the fastest-growing fraud type in real estate: seller impersonation. It is also one of the red flags most likely to be rationalized away by agents under time pressure to close a deal.
Seller impersonation fraud — also known as vacant land fraud, vacant lot fraud, and absentee seller fraud — has become one of the fastest-growing forms of wire fraud in real estate. Nearly 73% of real estate professionals reported seeing increased seller impersonation fraud attempts, and 58% experienced it personally or through their company over a recent six-month period. Certifid
The pattern is consistent. A seller contacts an agent to list a vacant or unoccupied property. All communication is by email or text. The seller claims to be out of state, abroad, dealing with a family emergency, or otherwise unable to meet. The property is priced below market value to generate immediate interest. The seller accepts offers quickly — especially cash offers — and pushes for a fast closing.
The typical seller impersonation scammer refuses to meet in person, preferring to be contacted through email, text, or over the phone, typically refusing video calls. They refuse to attend the signing and claim to be unavailable or out of the state or country. They demand to use their own notary, who then provides falsified documents to the title company or closing attorney. CA
Scammers search public records to find properties that are owned free and clear — meaning there is no mortgage payoff or lender involved — which may mean fewer built-in checkpoints during a fraudulent sale attempt. The FBI has warned about these schemes, including cases where the fraud may go undetected until after money has already been wired and the fraudulent sale has been recorded. CYBERRISKED
No single one of these behaviors is conclusive on its own. A legitimate out-of-state owner can and does sell remotely. But when several occur together — email-only communication, urgency, below-market pricing, cash preference, resistance to in-person verification — the combination demands verification before the transaction advances.
Red Flag #5: The Seller Insists on Arranging Their Own Notary
This red flag is specific to seller impersonation fraud and is one of the clearest process violations in any legitimate transaction. In a normal sale, the notary or closing agent is arranged by the title company or closing attorney — not by the seller.
Scammers who are selling properties they don't own demand to arrange their own notary or remote notary. They never agree to sign in person. This is because the scammer needs to control the identity verification step — the one moment where the fraud is most likely to be exposed. Vcrealtors
At the time of closing, the scammer refuses to sign documents in person and requests a remote notary signing. The scammer then impersonates the notary and returns falsified documents to the title company or closing attorney involved in the transaction. The title company transfers the closing proceeds to the scammer, and the transaction appears complete. Cramer & Anderson
Remote DocuSign closings prevent the settlement attorney from verifying any identification in person. This is specifically what seller impersonation fraudsters exploit to conduct a transaction from start to finish without ever being seen. Virginiarealtors
When a seller insists on choosing their own notary — and particularly when they resist using a notary selected by the title company — that insistence should be treated as a stop-the-transaction signal until the seller's identity is independently verified through multiple channels.
Red Flag #6: Account Names or Numbers That Don't Match Known Records
This red flag applies to both sides of a transaction and is one that a professional coordinator or vigilant title company is particularly positioned to catch. It requires knowing what the correct account information is supposed to look like — and comparing any new instruction against that baseline.
Bank account names that do not match the title company or law firm are a critical warning sign, as are instructions that ask for email-only confirmation with no phone call. Barnes Walker
In a legitimate transaction, the name on the receiving bank account should match the company name of the title company, settlement agent, or law firm handling the closing. If wire instructions direct funds to an account in an individual's name, a vaguely named LLC that doesn't appear in any company record, or an institution that doesn't match the title company's known banking relationship, that mismatch needs to be explained before any funds move.
If a solicitor or title company suddenly provides bank details for an overseas account, or if a beneficiary name doesn't match the known party, these discrepancies should not be ignored. Redpincompany
This verification step requires one phone call: call the title company at a number saved at the beginning of the transaction and confirm the account name, routing number, and account number verbally, digit by digit. That call, made using a verified number rather than one found in the suspicious communication, is the most reliable mechanical protection available against this particular vector of fraud.
Red Flag #7: A Deal That Seems Too Good to Be True — Because It Is
This red flag is broader than the others, but it is consistent across multiple fraud types and has specific application in seller impersonation and vacant land scams.
Offers like zero percent interest, no closing costs, or guaranteed approvals with no checks are significant warning signs of fraud. If something sounds too perfect to be true, take a close look at the deal and its terms. Rocket mortgage
In the context of seller impersonation fraud specifically, the too-good-to-be-true signal shows up as a property listed meaningfully below market value.
The fraudulent seller will usually underprice the property and push for a very quick, all-cash closing that avoids title companies and lenders. They will often also request that no "For Sale" sign be placed on the property — because a sign would alert the actual owner. Virginiarealtors
Scammers deliberately underprice the property to attract buyers and make the transaction seem too good to pass up. The urgency this creates — the fear of losing an unusually good deal — is what pushes buyers and agents to move faster than due diligence would otherwise allow. Vcrealtors
This is a deliberate manipulation. The below-market price is not a motivated seller making a reasonable concession. It is bait, designed to compress the timeline and overwhelm normal verification instincts with excitement and urgency. Any property priced significantly below comparable sales — especially when the seller is pushing for cash and a fast close — warrants a full identity verification of the seller before the transaction proceeds one step further.
What to Do When You See These Red Flags
Recognizing a red flag is only half of the equation. The response matters just as much as the recognition.
Stop the transaction. Do not wire money. Do not sign documents. Do not advance to the next step. A brief delay for verification is manageable. A wire sent to a fraudulent account is almost never recoverable.
Verify through an independent channel. Call the title company, attorney, or lender using a phone number that was established at the start of the transaction and saved in your contacts — not a number found in the suspicious email, text, or call. Confirm every piece of wiring information verbally, including the account name, routing number, and account number.
Verify seller identity independently. For seller impersonation concerns, send a confirmation letter via USPS to the property tax address on file — not to any address the seller has provided. The letter should note that if the recipient did not intend to sell the property, they should immediately contact you by phone or email. This will alert the legitimate owner to the potential fraud. Wisconsin REALTORS
Report it. If fraud is confirmed — or even strongly suspected — report to the FBI's Internet Crime Complaint Center at IC3.gov and contact local law enforcement. If money has already been wired, contact the sending bank's fraud department immediately and request a wire recall. Every hour matters.
Talk to your coordinator and title company. A professional transaction coordinator monitoring the file daily is often the first to notice when something in a communication pattern shifts. The number-one thing real estate agents can do to prevent fraud in the closing process is to communicate not only with their clients from the start, but with the title company they're working with — learning how wire instructions are sent and who will be sending them, and communicating this information to clients so they know exactly what to expect. Chicago Agent Magazine
These Red Flags Require a Process — Not Just Awareness
The seven red flags in this post are not exotic edge cases. They appear in real transactions, on real timelines, in real Northeast markets — Pennsylvania, New Jersey, New York, Maryland, Connecticut, and Delaware — every week. Title and escrow professionals consider wire fraud to be the biggest risk to their business, and over 90% recognize that protecting the security of all parties involved in a real estate transaction reduces the risk for everyone. Qualia Insight
Awareness of these signals is the first layer of protection. The second is process: consistent, documented, repeatable habits that make fraud structurally harder to execute regardless of how convincing the attempt looks in the moment.
That process is what a professional transaction coordinator provides — not just administrative support, but a structured environment where verified contacts are established at file opening, sensitive communications route through a secure portal, and wire-related instructions are confirmed by phone to known numbers at every stage.
The red flags don't disappear. But a well-built process catches them before they cost anyone their closing funds.
Work With a Transaction Coordinator Who Knows What Fraud Looks Like
At Signed to Keys, we build fraud protection into every transaction from the first day of the file. One dedicated coordinator. One secure portal. Verified contacts for every party. A firm policy of phone confirmation for all wire activity.
We serve real estate agents across Pennsylvania, New Jersey, New York, Maryland, Connecticut, and Delaware.
If you want transactions coordinated by someone who knows what these red flags look like — and has a process to catch them — let's talk.
Request Your Free Consultation → signedtokeys.com
No obligation. No long-term commitment. Just 30 minutes to talk about how we can protect your transactions and give you your time back.
Frequently Asked Questions
What is the most common red flag in real estate wire fraud?
Last-minute changes to wire instructions is the single most reliable indicator of a fraud attempt. Legitimate title companies and closing attorneys establish wiring information early in the transaction — it does not change at the 11th hour due to a "banking system update" or "account correction." Any communication claiming wire instructions have changed should be treated as fraudulent until independently verified by phone using a number that was saved before the suspicious message arrived.
How do I verify a sender's email address is legitimate?
Click on the display name in the email to reveal the actual sending address behind it. Most email clients — Gmail, Outlook, and others — show only the display name by default, not the full sending address. Once the address is visible, compare it character by character against an address from a confirmed, earlier communication. Look specifically for swapped letters, added hyphens, different domain extensions, or domains that look almost — but not exactly — right.
What should I do if a seller refuses to meet in person?
Treat it as a significant warning sign, especially if combined with other red flags like below-market pricing, urgency, cash preference, and resistance to the title company's notary. Request a live video call with government-issued identification presented on screen. Send a confirmation letter via USPS to the tax address on file for the property. Contact the title company and discuss implementing additional identity verification before the transaction advances. If the seller cannot satisfy reasonable verification requests, do not proceed.
Why do fraudsters price properties below market value?
Because an unusually attractive price compresses due diligence. A buyer who fears losing a great deal moves faster, asks fewer questions, and applies less scrutiny to the details of the transaction. In seller impersonation fraud specifically, the below-market price is deliberate bait designed to generate immediate interest, accelerate the timeline, and overwhelm normal verification instincts before the fraud can be detected.
Can a fraud attempt use a legitimate email address?
Yes — and this is one of the reasons phone verification is so important. Business Email Compromise specifically involves the actual compromise of a legitimate inbox, meaning fraudulent instructions can arrive from a real, recognized email address with no spoofing involved. The sender's address appears correct because it is correct — the inbox has been hacked. This is why verifying wire instructions by calling a known number, rather than relying solely on email authentication, is the only reliable protection.
What is seller impersonation fraud and how does it work?
Seller impersonation fraud occurs when a fraudster uses publicly available property records to identify a vacant, lien-free property, gathers information about the real owner, creates fraudulent identification in that person's name, and contacts a real estate agent to list and sell the property without the owner's knowledge. The fraudster accepts an offer — typically cash, typically fast — and insists on a remote closing to avoid in-person identity verification. Proceeds are wired to the fraudster and the real owner may not discover the sale for weeks or months.
Is it a red flag if the seller wants a remote closing?
On its own, no — remote closings are routine in many markets. It becomes a significant red flag when the remote closing is combined with other warning signs: email-only communication, refusal of video verification, insistence on arranging their own notary, below-market pricing, and urgency around a cash close. The key specific indicator is when a seller refuses to use the title company's notary and insists on arranging their own — that is a near-universal pattern in documented seller impersonation fraud.
What should I do if I suspect fraud is already in progress?
Stop the transaction immediately and do not allow any funds to move. Contact the title company and closing attorney using verified phone numbers — not contact information from any suspicious communication. Notify your broker. If money has already been wired, call the bank's fraud department within the first hour and request a wire recall. File a report with the FBI at IC3.gov and with local law enforcement, and save every related email and document for investigators. Speed is critical — every hour that passes reduces the odds of fund recovery.
Does having a transaction coordinator help prevent these red flags from being missed?
Significantly. A professional TC who monitors the file daily knows what legitimate communication looks like at every stage of the transaction. They recognize when a message arrives out of pattern, from an unexpected party, or at an unusual time. They maintain verified contact information for every party from file opening. And they operate within a secure portal that removes the most common fraud entry point — open email — from the sensitive parts of the transaction. The coordinator is not just managing tasks. They are watching the file with trained eyes.
Are these scams more common in certain types of properties?
Yes. Vacant land and properties owned free and clear — with no active mortgage — are disproportionately targeted because they have fewer built-in verification checkpoints, no lender involved, and often no one actively monitoring the property. Second homes, inherited properties, and rental properties with out-of-state owners are similarly vulnerable because the real owner may not discover an unauthorized listing until the sale has already closed. In the Northeast, where many buyers and sellers operate across state lines and remote closings are common, vigilance around these property types is particularly important.