Wire fraud usually begins with a compromised email account, followed by fraudulent wire instructions sent shortly before closing. The protection is to call and verify every set of instructions on a number you obtained independently, before sending anything — which defeats essentially every version of this fraud.
It happens in the last two weeks, when everyone is tired and moving quickly. The pattern is consistent enough to be worth knowing, because knowing it is most of the protection.
Wire fraud is the most damaging thing that happens in residential real estate, and it happens in the last two weeks of a transaction, when everyone is tired and moving quickly.
The pattern is consistent enough to be worth knowing in detail, because knowing it is genuinely most of the protection available.
Someone gains access to an email account — yours, your agent's, the escrow company's, the attorney's. Frequently they do nothing at first except read.
They learn the names, the property, the closing date and the tone in which people write to each other. Then, shortly before funds are due, they send an email that appears to come from the escrow officer or attorney, containing wire instructions.
The instructions are wrong. The account belongs to the fraudster. The email looks entirely normal because the sender has been reading the real correspondence for weeks.
Money sent this way is frequently unrecoverable. It moves quickly through several accounts and often overseas, and once it is gone the practical prospects of getting it back are poor.
Wire instructions arriving by email at all should raise your guard, whatever they look like.
Any change to previously provided instructions. This is the classic version. Legitimate parties very rarely change banking details mid-transaction, and when they do they expect to prove it.
Urgency. "We need this today to close on time." Manufactured pressure is the point.
A slightly wrong address. A transposed letter, a different domain suffix, a display name that matches while the underlying address does not.
A request to keep it quiet or to avoid calling because someone is unavailable.
Anything at all unusual. Trust that instinct rather than talking yourself out of it.
Call and verify, every time, on a number you already have.
Not the number in the email. Not a number in the signature block. A number you obtained independently, earlier, from a source that had nothing to do with the message you are checking.
Call before sending anything, read the instructions back digit by digit, and confirm the receiving bank and account name as well as the number.
This single step defeats essentially every version of this fraud, and it takes four minutes.
Establish at the outset of the transaction how wire instructions will be delivered, and agree that they will never change by email. Some firms send them only in person or by encrypted portal for exactly this reason.
Use multi-factor authentication on every email account involved. Compromised email is the entry point in almost every case.
Be careful about what is public. Announcing a transaction, a closing date or a property on social media provides exactly the timing information a fraudster needs.
Send a small test transfer where the amount is very large and the timeline permits. Confirm receipt by telephone before sending the balance.
Speed is the only thing that matters.
Contact your bank immediately and request a recall. Contact the receiving bank. Report it to law enforcement without delay — there are mechanisms that can occasionally freeze funds if they are alerted very quickly, and the window is measured in hours rather than days.
Tell your agent, attorney and escrow officer at once. Do not wait to establish exactly what happened first.
Nothing else in a transaction can cost you the entire purchase price in an afternoon.
The protection is not sophisticated. It is a phone call to a number you already had, made every single time, including the time it feels unnecessary.
Someone gains access to an email account and reads correspondence for weeks, then sends fraudulent wire instructions shortly before funds are due. The email looks normal because the sender knows the names, the property and the tone.
Any change to previously provided wire instructions. Legitimate parties rarely change banking details mid-transaction, and when they do they expect to be asked to prove it. Manufactured urgency is the other classic signal.
Call a number you already had, obtained independently and earlier — never one from the email or its signature. Read the details back digit by digit and confirm the receiving bank and account name as well as the number.
Agree at the outset how instructions will be delivered and that they will never change by email. Use multi-factor authentication on every account involved, and avoid publicizing the transaction or closing date.
Act within hours. Contact your bank and request a recall, contact the receiving bank, and report to law enforcement immediately. Tell your agent and escrow officer at once rather than waiting to understand what happened.
A select network of the nation's most accomplished luxury real estate professionals.