Wire fraud: the checklist to send clients before closing

The contract is signed. In a day or two your buyer wires the earnest money, and a few weeks later the rest of her cash to close, to a title company she has probably never called. Both sets of instructions will reach her the way everything else on this deal does: by email, with a logo, from a name she recognizes.

So will the fake ones.

What a diverted wire looks like in the numbers

$3.05B

reported lost to business email compromise in 2025, across 24,768 complaints to the FBI

$239,850

median loss when a buyer's cash to close was stolen, in one fraud-recovery firm's 2026 case data

58%

of $1.16 billion in attempted thefts the FBI's recovery team acted on in 2025, the share it froze

FBI Internet Crime Complaint Center 2025 annual report, released April 2026, and CertifID's 2026 State of Wire Fraud report, published Mar 9, 2026. The median is one vendor's cases, not a national figure.

The pattern is old and well documented. Someone gets into one email account on the deal (yours, the title company's, or the lender's), reads the thread, and waits. The National Association of Realtors (NAR) describes criminals who build a profile of every party, monitor the traffic, and then send "false wire instructions that divert deposits, closing costs and even mortgage payoff funds." The Consumer Financial Protection Bureau (CFPB) warned that scammers go after agents' own email accounts so they can watch the conversation with the client.

That last part is why the checklist below never tells your client to check the sender's address. If your account is the one compromised, the fake comes from you.

The number you'll see quoted is the wrong one

When the FBI's Internet Crime Complaint Center (IC3) published its 2025 report, the American Land Title Association (ALTA) led with real estate fraud: $275.1 million lost in 2025, up from about $173 million in 2024, on 12,368 complaints. Those figures are real. They are mostly not about your closing.

The report itself defines real estate fraud as "loss of funds from a real estate investment or fraud involving rental or timeshare property." Its own example of a buyer robbed on the way to the closing table is filed as "BEC/Real Estate," under business email compromise (BEC), a category that lost $3.05 billion in 2025 and that the report does not break out by industry. BEC was the second-costliest crime type the FBI tracked, behind investment fraud.

So when a client asks how common this is, the honest answer is that the FBI's report has no closing-day number, and the category it hides in is enormous.

When to send it

Twice. Once isn't enough.

At contract, with your "we're under contract" message. Earnest money is typically due one to three business days after acceptance, usually by wire, so the first transfer happens before most clients have met anyone at the title company.
The day closing figures arrive. For a buyer, that's when the title company sends the cash to close. For a seller, it's when they ask where the proceeds should go.

The second send matters more than the first. A few weeks is long enough to forget a warning, and the closing wire is the big one. Sellers are not a footnote here either: in CertifID's 2026 case data, seller proceeds fraud was 12% of cases with a median loss of $343,497, and buyer cash to close was 30%. That is a vendor that sells wire protection, reporting on its own recovery cases, so read it as a sample.

If your brokerage requires its own wire fraud disclosure, and NAR notes that many brokers now do, send that as well. Nothing here is legal advice.

The checklist (send this part)

Copy from here to the line below. It's written from you to your client. Where an attorney holds the money in your state, change "title company" to "closing attorney."

Before you send any money

Wiring instructions come from the title company, never from me. I will not email, text, or forward you bank details at any point. If a message that looks like mine contains an account number, it isn't from me, even if it came from my real email address.
Get the title company's phone number now, before any instructions arrive. Use the number on the company's own website, or the one I give you on a call. Write it here: ____________
Before every wire, call that number and read the account and routing numbers back to them. Never use a phone number or a link from the email that carried the instructions.
The instructions won't change. If a message says the account changed, or the money needs to go somewhere new today, treat it as fraud until the title company tells you otherwise on a call you placed. Hurry is the tell.
Don't reply to ask whether it's real. The person who answers may be the person who sent it.
Ask your bank to confirm the name on the receiving account before it sends. If it isn't the title company's name, stop.
After you send, call the title company again, same number, same day, and confirm the money arrived.
Pick a code phrase with me if you like, something only the two of us know, for any call where you're unsure it's really me.

If you're selling

Give your bank details for your proceeds to the title company only, the way they tell you on a call you placed. Tell them at the start that you will never change your payout account by email, so any email asking them to is not from you.

If money went to the wrong account

Minutes count. In this order:

Call your bank. Say "fraudulent wire" and ask them to recall it.
File a report at ic3.gov, whatever the amount, with every detail of the transfer.
Call me and the title company, on the numbers you wrote down.
Call your local FBI field office and the police.

Most of that list comes straight from primary guidance. The call-a-known-number rule and the "no links from the email" rule are on ALTA's consumer card, which also says flatly that a title company "will NEVER change their bank account or wiring instructions during your transaction," and tells buyers to have their bank confirm the account name and to call title after sending. The code phrase comes from the CFPB's closing guidance, now marked archived. The recovery steps follow the IC3 report: contact your bank "immediately" to request a recall, and file at ic3.gov "regardless of the amount lost." NAR puts the window plainly: filing within 24 hours, and no more than 72, gives the best chance of recovery.

The IC3 report carries a case that shows why the order matters. In August 2025, buyers closing on a home got an email impersonating their attorneys and wired more than $449,000. They reported it to their bank, and their attorneys tried the receiving bank themselves, with nothing to show for it. When the complaint reached IC3, its Recovery Asset Team asked the receiving bank for a freeze through the Financial Fraud Kill Chain. The full amount was still there, and it was put on hold. Across all such requests in 2025, the team froze $679,013,183 of $1,163,919,846 in attempted thefts.

Two things you never do

Never send wiring instructions yourself

Not even the title company's genuine PDF, forwarded as a courtesy. NAR's advice to members is blunt: "Never send wire instructions" by email. The reason goes past the security of one email. Item 1 on your client's list only works if it is true on every deal. The first time she gets real instructions from you, a fake from you becomes believable.

That applies to everyone who sends email on your files. If a transaction coordinator (TC) or an assistant handles your closing correspondence, the rule is theirs too.

Never confirm a change by replying to the email that announced it

When a "title company" email says the instructions changed, the reply button goes to whoever wrote it. Call the number you saved at contract, from the company's website or a number you have used before, never the one in the signature block.

The same goes in the other direction. If a client emails "just confirming the new account you sent," don't answer by email. Call her.

NAR publishes a signature-line notice you can add to every email, and it's worth using. NAR itself says it "should not serve as a substitute for educating your clients." A line in a signature is easy to scroll past. The call is what works.

If you send clients a status page

Item 2 raises the obvious question: where does a trustworthy phone number come from, if not from an email? In KeyFlow, it comes from you. The client portal shows a "Your transaction team" card with the title company's name, a phone number she can tap to call, and an email address, all pulled from your own business partner record for that company. Nothing in an email thread can change it. Save the number once, from the title company's website, link the company to the deal, and it is on her page every time she opens it.

To get in, the page asks her for a last name and nothing else. It has no payment form and no place for bank details, so you can tell her, truthfully, that the page you sent will never ask for money. Paste the checklist above into a client checklist template, where each pasted line becomes its own item, and attach it to the deal's Closing section. She ticks items off from her phone, and each tick shows on your side with who made it and when.

One rule it puts on you. Every file attached to a deal shows in her Files list, and there is no switch to hide a single file. So never attach wiring instructions to the deal, even genuine ones from title. That would make your page the thing that carries bank details, which is exactly what item 1 promises never happens.

None of this catches a fake email. It gives her a number to call that didn't come from one. And the portal is on the paid plans, not the free one.

Before your next contract goes out

Look up the title company's main number on its own website and save it to the file. Paste the checklist into the message you send at contract. Then put a reminder on the day the closing figures are due, and send it again that morning.

Sources: Federal Bureau of Investigation, Internet Crime Complaint Center: 2025 IC3 Annual Report · American Land Title Association: latest FBI cybercrime report shows real estate fraud losses rising (Apr 10, 2026) · American Land Title Association: protect your money from closing scams when buying a home (consumer card) · National Association of Realtors: wire fraud · National Association of Realtors: wire fraud email notice template · Consumer Financial Protection Bureau: mortgage closing scams (archived; page last modified Jun 25, 2026) · CertifID: 2026 State of Wire Fraud Report, key findings (Mar 9, 2026) · Redfin: when is earnest money due