How to Spot a Wire Fraud Email in Real Estate (With Real Examples)
The Email Looks Perfect. That's the Problem.
It arrives three days before closing. The subject line reads: "URGENT: Updated Wire Instructions for Your Closing." The sender's name is your title company. The email uses your client's name, references the correct property address, and even mentions the exact closing date. The logo looks right. The signature looks right.
Your buyer wires $87,000.
And then it's gone.
This isn't a hypothetical. A couple closing on a house received an email impersonating their attorneys and mistakenly sent a wire transfer of over $449,000 to a scammer. The FBI got involved, and they were among the lucky ones — the funds were still in the account and frozen in time. Most victims aren't that fortunate. National Association of Realtors
Wire fraud is the single most financially devastating scam targeting real estate transactions today — and it almost always starts with one email.
This guide will show you exactly what those emails look like, what red flags to watch for, and how to build the habits that protect your clients before the damage is done.
Why Real Estate Is Ground Zero for Wire Fraud
Real estate transactions are uniquely attractive to fraudsters. Think about what happens in a typical closing: large sums of money move between multiple parties, there are strict deadlines creating natural urgency, most communication happens over email, and many of the people involved — buyers especially — are navigating the process for the first or second time in their lives.
That combination is a perfect target.
The FBI's Internet Crime Complaint Center received over a million complaints of cyber-enabled crime in 2025, with reported losses surpassing $20.8 billion. Real estate fraud alone accounted for 12,368 complaints and $275.1 million in losses. HousingWire
To put that in perspective: real estate fraud losses jumped from $173 million in 2024 to $275.1 million in 2025 — a 59% increase in a single year. Scotsman Guide
Real estate wire fraud accounting for an estimated $500 million in total cybercrime losses in 2024, and as cybercrime tactics evolve into more sophisticated schemes using AI, deepfakes, and voice spoofing, the industry faces increasing odds. Certifid
And the losses per victim are staggering. Victims of real estate wire fraud suffered a median financial loss exceeding $70,000 — making it one of the most financially devastating forms of fraud. For many buyers, that's their entire down payment. Their life savings. Gone in a single wire transfer. Eftsure
Among consumers who bought or sold property, nearly 1 in 4 were targeted with suspicious communications during their closing — and approximately 60% of consumers received minimal or no education about wire fraud from their real estate professionals. Certifid
That last statistic is one agents need to sit with. The threat is enormous, and the industry's track record on warning clients about it is poor.
How the Scam Actually Works
Before you can spot a fraudulent email, you need to understand how fraudsters set the trap in the first place. This isn't random spam. It's a coordinated, patient operation.
Step 1: Reconnaissance
Scammers monitor public real estate listings and, in many cases, hack into the email accounts of real estate agents, title companies, or attorneys to gather detailed information about upcoming transactions — including closing dates, amounts, and the identities of all parties involved. DomiDocs
This is called Business Email Compromise (BEC). A criminal gains access to a known party's email, referred to as an email takeover. The criminal monitors communications and waits until money is about to be moved. J.P. Morgan
They're not in a hurry. They'll sit in a compromised inbox for weeks, reading every email, learning the names of everyone involved, understanding the transaction timeline. By the time they strike, they know more about your deal than some of the parties involved.
Step 2: Impersonation
Using stolen information, criminals create spoofed email addresses and lookalike domains that appear nearly identical to the legitimate ones. A common tactic is to add a single character or swap a letter — for example, "titlecompany-llc.com" instead of "titlecompany.com." DomiDocs
The criminal uses a compromised, authentic account or spoofed email address to impersonate the known party, then provides new instructions directing the buyer to send funds to an account they control. J.P. Morgan
Step 3: The Strike
A common scenario involves a buyer who is ready to send their down payment or closing funds. Suddenly, they get what looks like a legitimate email from their agent or title company with updated instructions. But the message is fake, and once the wire is sent, recovery is rare. Certifid
The timing is deliberate. Emails that demand urgent action, particularly those sent at the end of the month or the beginning of bank holidays, are a common tactic. Fraudsters know that people make worse decisions under pressure, and they engineer that pressure intentionally. J.P. Morgan
What a Wire Fraud Email Actually Looks Like
This is the most important section of this post. Most people assume they'll recognize a fraudulent email on sight. They won't. These emails are built to pass every surface-level inspection.
Here's how to read them the way a fraudster hopes you won't.
Red Flag #1: A Spoofed or Near-Identical Email Address
This is the most common technical tell — and the one most people miss because they never actually look.
The originating email address may be almost identical to the legitimate address — but not 100% the same. The difference is subtle and easy to miss. Costanzagz
Real-world examples of how fraudsters alter email addresses:
closing@titlecompany.com becomes closing@title-company.com
sarah@realtyfirm.com becomes sarah@reaItyfirm.com (capital "I" instead of lowercase "l")
escrow@settlementco.com becomes escrow@settlementco-llc.com
info@titleco.com becomes info@titleco.net
Often, email clients like Outlook or Gmail don't show the sender email address by default — they typically only show the person's name — so this one might be difficult for many to catch. Lonestartitle
What to do: Train yourself and your clients to click on the sender's display name and reveal the actual email address behind it. Every single time.
Red Flag #2: Last-Minute Changes to Wire Instructions
This is the most reliable behavioral signal in all of wire fraud. Legitimate parties don't change wire instructions at the last minute.
If a lender or title company sends new wire instructions right before closing, be cautious. Legitimate lenders and title companies don't make last-minute changes. Always confirm using a verified contact number. Certifid
New wiring instructions or sudden "revised" bank details sent by email are among the clearest warning signs, along with messages that demand fast action or contain urgent language. Barnes Walker
A real-world example of how this is framed in a fraudulent email:
"Due to a recent update in our banking system, please disregard the wire instructions previously provided. Please use the following account information for today's transfer. This must be completed before 3:00 PM to avoid a delay to your closing."
The combination of a "system update" explanation + new account numbers + a hard deadline is a classic wire fraud script. Scammers may tell you there's been a last-minute change in their banking procedures. There hasn't been. There never is. Rocket Mortgage
Red Flag #3: Urgency and Pressure Language
At the heart of most impersonation scams are three key tactics: urgency ("You need to act now or the deal falls through"), authority (impersonating someone trusted), and secrecy. Certifid
Watch for subject lines and language like:
"URGENT: Wire Must Be Sent Today"
"Action Required Before 5 PM — Closing at Risk"
"Please send AS SOON AS POSSIBLE"
"Do not delay — your closing date depends on this"
The mention of "AS SOON AS POSSIBLE" in all caps is a huge red flag. For a first-time homebuyer, that phrase alone might cause them to take immediate, unverified action. Lonestartitle
Urgency is the fraudster's most powerful tool. When people feel rushed, they stop verifying.
Red Flag #4: Email-Only Communication With No Phone Confirmation
Wire details sent without prior notice or phone confirmation, and instructions that ask for email-only confirmation with no phone call, are major warning signs. Certifid
Legitimate title companies and attorneys establish wire instructions early in the transaction and confirm them through multiple channels. If an email arrives directing funds somewhere and there's been zero phone communication to back it up, that's a problem.
Outreach through multiple mediums — texts, phone calls, emails — all regarding the same wire transfer is also a red flag, because fraudsters sometimes try to create an illusion of legitimacy by touching you through several channels simultaneously. J.P. Morgan
Red Flag #5: Requests to Keep the Change Confidential
This one should stop you cold.
Confidentiality pressure — requests to keep wire changes secret — is a clear warning sign. Certifid
Any email that says something like "Please handle this directly and do not discuss with other parties until the transfer is confirmed" is almost certainly fraudulent. There is no legitimate reason for a title company, attorney, or lender to ask you to keep wire instructions private.
Red Flag #6: Account Names That Don't Match
Bank account names that do not match the title company or law firm are a critical red flag, as are email addresses with unusual spelling or small variations. Barnes Walker
When you call to verify wire instructions (which you always should), confirm not just the routing and account number, but the name on the account. If your title company is "Premier Settlement Services LLC" and the account name comes back as "PSS Holdings" or an individual's name — stop everything.
Red Flag #7: Grammatical Errors or Off-Brand Presentation
Grammatical errors or spelling mistakes within communications are a warning sign, even subtle ones. J.P. Morgan
This is becoming less reliable as a standalone signal because AI tools have made fraudulent emails more grammatically polished than ever. The FBI noted that criminals are rapidly adopting AI to enhance the credibility of their schemes, with chat generators quickly creating official-sounding emails mimicking a company's CEO or other officials. HousingWire
However, look for:
Slight formatting differences from previous emails
Logos that look slightly pixelated or off-color
Signature blocks that are missing details usually included
Unusual font choices or inconsistent spacing
A Real-World Near-Miss: The $500,000 That Almost Vanished
A real estate agent received an email that appeared to be from the escrow company, asking for a re-verification of client contact information. One detail raised concern: there was no legitimate reason to re-verify client information in a way that went beyond what the standard real estate contract already established. Rather than responding quickly to keep the transaction moving, the agent slowed down and examined the email more carefully. That's when they noticed the originating email address was almost identical to escrow's real address — but not 100% the same. The difference was subtle and easy to miss. After contacting escrow through a separate, verified communication channel, escrow confirmed they had not sent the email. It had been spoofed. The scammer's objective was to obtain the clients' email addresses so they could later send fraudulent wire instructions. If successful, the clients' down payment — nearly half a million dollars — could have been irretrievably lost. Costanzagz
The agent's instinct wasn't a technical tool or fraud detection software. It was a single question: Does this request make sense given where we are in this transaction?
That question saved $500,000.
Who Is Most at Risk
First-time homebuyers are three times more likely to fall victim to wire fraud than experienced buyers, largely because they are unfamiliar with the closing process and may not know what legitimate wiring instructions look like or how they are typically communicated. DomiDocs
But it's not just buyers. In 2020, the real estate and rental sector reported 13,638 wire fraud victims — a 17% increase from 2019 — and one in four consumers reported being targeted by fraud attempts during the real estate closing process. Eftsure
Requests for bulk sensitive data — lists of buyers, contacts, deposits, and loan details — can be used to impersonate parties, redirect funds, or launch targeted scams. Agents who receive phishing emails asking for their pending transaction lists are often the first entry point into a larger fraud operation targeting their clients. Gaar
What to Do If You Suspect a Fraudulent Email
Step 1: Stop. Do not wire anything.
Once a wire transfer leaves your bank, recovery is extremely difficult. Never act on any change to wiring instructions received via email without a verbal confirmation call. DomiDocs
Step 2: Call using a number you already have — not one in the email.
Before wiring any amount, call your title company or real estate attorney using a phone number you obtained independently — not from the email containing the instructions. Confirm every digit of the routing and account numbers verbally. DomiDocs
Step 3: Examine the actual sender email address.
Click on the display name and reveal the full email address. Compare it character by character to a previous verified email from that party.
Step 4: Alert your agent and the title company.
If the email is fraudulent, your agent and title company need to know immediately so they can warn other clients and secure their systems.
Step 5: If money was already sent, act within hours.
Call your bank immediately and request a wire recall. Ask for the fraud department. Call the title company using a verified number and notify them at once. Report the event to the FBI Internet Crime Complaint Center at IC3.gov. File a police report and save all email communications for investigators. Recovery success depends on timing — acting within the first few hours is critical. Barnes Walker
How Transaction Coordinators Are a Line of Defense
One of the most underappreciated fraud-prevention tools in real estate isn't software — it's process.
Nearly all wire fraud is inherently a type of cybercrime since funds are wired digitally, and bad actors have plenty of reasons to target real estate transactions, which usually involve the movement of large sums of money among multiple parties exchanging sensitive information via email. Qualia Insight
A professional transaction coordinator adds a layer of verified, consistent communication that makes fraud significantly harder to execute. When there's one dedicated point of contact — someone who knows every party in the transaction, who established relationships at the opening of the file, and who uses a secure portal instead of open email — fraudsters have far fewer entry points.
The most effective fraud prevention strategies combine technology, team training, and clear communication at every step of the transaction. Certifid
Specifically, professional TCs:
Establish all parties and their verified contact information at the start of every file
Send introduction emails so everyone knows who to expect communication from
Never send or accept wire instruction changes via email alone
Use secure client portals that provide an encrypted alternative to email for sensitive information
Maintain one vetted phone number for every party — so verification calls go to the right place
This is part of why wire fraud protection isn't a bolt-on feature at Signed to Keys. It's built into the coordination process from day one.
How to Educate Your Clients Before Closing
The warning needs to happen at the beginning of the transaction — not the night before closing.
Approximately 60% of consumers received minimal or no education about wire fraud during the closing process from their real estate professionals. That gap is where fraud lives. Certifid
Here's what to tell every buyer and seller at the start of a transaction:
"We will never email you new wire instructions." Establish this as a firm rule at the outset. If they receive an email with updated wire instructions, they should call you before doing anything.
"Always call to verify before wiring." Give them a phone number for the title company that they save in their contacts from day one — not pulled from an email later.
"Urgency in an email is a red flag, not a reason to move faster." Scammers manufacture deadlines. Legitimate closings have scheduled, expected timelines.
"If something feels off, it probably is." Pressure tactics demanding immediate action to bypass verification safeguards are a defining feature of wire fraud attempts. Teach clients to trust that instinct. Megan Micco
The Bottom Line
Wire fraud is not a fringe threat. A report found that 51.8% of real estate transactions in the last quarter of 2023 contained risk indicators for wire or title fraud — an all-time high showing growing vulnerability in the sector. Eftsure
Business email compromises — a scheme frequently targeting home closings and wire transfers — ranked second in total losses among all cybercrime categories at $3.04 billion across nearly 25,000 complaints in 2025. HousingWire
The emails are convincing. The timing is strategic. The losses are catastrophic and almost always unrecoverable.
But fraud succeeds because of speed and assumptions — the assumption that the email is real, that the number in the signature is legitimate, that there's no time to verify. Slow down. Verify. Establish a process at the start of every transaction, not the end.
And work with professionals who treat fraud protection as part of the job description — not an afterthought.
Work With a Transaction Coordinator Who Has Fraud Protection Built In
At Signed to Keys, every transaction runs through a secure client portal with one vetted, dedicated point of contact. We never accept wire instruction changes via email, we verify every party at the start of every file, and we keep your clients informed — and protected — from contract to close.
We serve real estate agents across Pennsylvania, New Jersey, New York, Maryland, Connecticut, and Delaware.
If you're tired of managing 30+ administrative tasks per file while also worrying about whether your clients are getting scammed, let's talk.
Request Your Free Consultation → signedtokeys.com
No obligation. No long-term commitment. Just a 30-minute conversation about how we can protect your transactions and give you your time back.
Sources: FBI Internet Crime Complaint Center (IC3) 2025 Annual Report; CertifID State of Wire Fraud 2025; NAR REALTOR® Magazine; HousingWire; JPMorgan Chase Commercial Banking; Qualia 2025 Wire Fraud Special Report; Rocket Mortgage; DomiDocs; CertifID.
Frequently Asked Questions
What is wire fraud in real estate?
Wire fraud in real estate occurs when a scammer intercepts or impersonates a trusted party in a transaction — your title company, agent, attorney, or lender — and tricks a buyer or seller into wiring closing funds to a fraudulent bank account. It almost always begins with a spoofed or compromised email and is timed to strike right before closing when large sums of money are moving.
How common is wire fraud in real estate transactions?
Extremely common and growing. The FBI reported $275.1 million in real estate fraud losses in 2025 alone — up from $173 million the year prior. Nearly one in four consumers reported being targeted by suspicious communications during the closing process. Over half of all real estate transactions in late 2023 contained risk indicators for wire or title fraud.
What does a wire fraud email look like?
It typically looks nearly identical to a legitimate email from your title company, lender, or agent. It will use the correct property address, the right names, and professional formatting. The tell-tale signs are subtle: a slightly altered email address, last-minute changes to wire instructions, urgent language demanding immediate action, and a request to confirm only by email rather than by phone.
How do scammers get my transaction details?
Most often through a compromised email account — either your agent's, the title company's, or an attorney's inbox. Scammers hack in and quietly monitor email threads for weeks, learning closing dates, dollar amounts, and the names of every party involved. They also pull publicly available data from MLS listings and property records to identify active transactions.
What should I do before wiring any money?
Always call the title company or closing attorney using a phone number you saved at the beginning of the transaction — never one found in the email containing the wire instructions. Confirm the routing number, account number, and the name on the account verbally. This one step prevents the vast majority of wire fraud losses.
What should I do if I already sent money to a fraudster?
Act immediately. Call your bank's fraud department and request a wire recall within the first few hours — recovery odds drop sharply with time. Then report the incident to the FBI's Internet Crime Complaint Center at IC3.gov, file a police report, and contact your title company using a verified number. Save every email communication for investigators.
Are buyers or sellers more at risk?
Both are targets, but buyers face the greatest exposure since they're typically wiring the largest amounts — down payments and closing costs. First-time buyers are three times more likely to fall victim than experienced buyers because they're less familiar with what legitimate wire instructions look like and how they're typically communicated.
Can wire fraud happen even if I'm working with a reputable agent or title company?
Yes. The fraud doesn't target the agent's reputation — it exploits the communication channels around the transaction. Even a highly experienced agent working with a well-established title company can have their email compromised. That's why the protection has to be process-based: secure portals, verified phone numbers established early, and a firm rule that wire instructions are never changed via email alone.
How can a transaction coordinator help prevent wire fraud?
A professional TC establishes one verified point of contact and communicates every party's information at the start of the file — so everyone knows who to expect emails from and where to call for verification. TCs who use secure client portals eliminate the reliance on open email for sensitive information entirely, removing the most common entry point for fraud.
What's the single most important thing I can tell my clients about wire fraud?
Tell them this at the very first meeting, not the day before closing: "We will never email you new wire instructions. If you receive an email with updated wiring information from anyone — including me — do not act on it. Call me directly using the number you have in your phone." That one conversation, delivered early and clearly, is the most powerful fraud prevention tool available.