The short answer
Treat every wiring instruction that arrives by email, text or PDF as unverified. Before any money moves, confirm it by calling a phone number you already had, never one from the message, and have the other party read the account details to you. Tell buyers and sellers in writing at the start of every file that your wiring instructions will never change by email.
Why an email can't confirm a wire
Wire fraud in real estate almost always starts with email. A scammer either gets into a real mailbox (yours, an agent's, a lender's or a buyer's) or registers a lookalike domain one letter off from yours. Either way, the message looks normal, arrives at the right moment in the closing, and asks for money to go somewhere new.
The FBI's Internet Crime Complaint Center counted $275 million in U.S. real estate fraud losses in 2025, up 58%, and $3.0 billion in business email compromise losses across 24,768 complaints. (FBI IC3 2025 report)
That's why the only safe check is one that doesn't use email at all: a phone call to a number you got some other way.
The 7-step verification procedure
Use these steps for any wiring instruction you receive (payoff lenders, sellers, other title agents, vendors) and any change to instructions you already have. Stop at any step that fails.
- Stop. Don't reply, click links or open new attachments in the message.
- Check the sender, letter by letter. Compare the address and domain with earlier messages in the file. Look for swaps like
rnformor.cofor.com, and a reply-to address that differs from the sender. A match doesn't prove it's real; a mismatch proves it isn't. - Find the phone number yourself. Use the number in your file from before the request, the signed contract, or the company's official website opened by typing the address. Never use a number, link or signature from the request.
- Call and have them read it to you. Ask the other party to read the bank name, routing number and account number. Compare against the instructions. Never read the numbers out for them to approve.
- Check a second way for changes and new payees. When instructions are new or have changed, also verify the account holder name with the receiving bank, or use a secure verification service if your office has one.
- Get a second approval. A second person in the office reviews the call notes and approves any wire whose instructions are new or changed. One person should never both verify and release.
- Write it down. Record who you spoke to, the number you called and where it came from, the date and time, and who approved. Keep it in the file.
These rules have no exceptions for urgent requests, known contacts or small amounts. Pressure to skip a step is itself a warning sign.
What to tell buyers and sellers
Most buyers have never wired six figures before. Tell them what normal looks like so they can spot what isn't.
- At opening, in writing: "Our wiring instructions will not change during your transaction, and we will never send changes by email. If you receive new instructions that seem to come from us, do not send money. Call us at the number on this letter."
- Before they wire: call the buyer at the number in your file to walk through the instructions and confirm the amount.
- After they wire: call to confirm you received the funds. A buyer who thinks they sent money that didn't arrive is an emergency (see below).
- In every email signature: a short warning such as "We will never change wiring instructions by email. Always call to verify before sending funds."
ALTA has published sample warning language that settlement companies use in emails and on websites. (ALTA sample wire fraud warnings)
Red flags that mean stop and call
- New or "updated" bank details, especially a different bank, a different state, or a personal account
- Urgency: "today", "before close of business", "the seller is leaving the country"
- A request to keep the conversation to email, or a contact who suddenly "can't take calls"
- A sender or reply-to address that is slightly off
- Instructions that arrive in a new email thread, or mid-thread in a conversation that was otherwise normal
- An unexpected attachment, link or QR code for "secure" instructions
- Missing emails, unexplained mailbox rules or sign-in alerts on your own accounts
If a wire goes to the wrong account
Minutes matter. Call the bank before you do anything else.
| When | Action |
|---|---|
| Immediately | Call the sending bank's fraud line or wire desk (not email). Ask for a recall, and for the bank to contact the receiving bank to freeze the funds. Get a case number. |
| Same day | File a complaint at ic3.gov with the amount, date, both banks and account numbers. |
| Same day | Notify your underwriter and your cyber or crime insurance carrier, as your policies require. |
| Same day | Secure email: change passwords, check every mailbox for hidden forwarding rules, and confirm multi-factor sign-in is on. |
| Same day | Call everyone else in open transactions, by phone, to warn them that emails may be fake. |
Fast reporting works. In 2025 the FBI's Recovery Asset Team worked 3,574 incidents involving $833 million in losses and froze $507 million of it, a 61% rate. (FBI IC3 Financial Fraud Kill Chain)
This guide is general information for title and real estate offices, not legal advice. Follow your underwriter's and lender's requirements where they differ.