Wire fraud in real estate closings: the lender's side

The short answer

Wire fraud in a real estate closing almost always starts with email. A criminal compromises or imitates the mailbox of someone on the deal, waits for funding, and sends wire instructions that point to an account it controls. Commercial closings are attractive targets because the wires are large, the parties are many, and funding day runs on deadlines.

The controls that work are procedural: wire instructions collected once from a known source, verified by a call to a number the lender already has, never changed by email, released by two people, and confirmed after sending. If money goes to the wrong account, the first hours matter: call the sending bank to request a recall, file a complaint with the FBI's Internet Crime Complaint Center with the full transaction details, and tell every party by phone.

How big is real estate wire fraud?

The FBI's Internet Crime Complaint Center (IC3) publishes the most cited figures. In its 2025 annual report, business email compromise drew 24,768 complaints and $3,046,598,558 in reported losses, up from $2,770,151,146 in 2024. The report's Real Estate category drew 12,368 complaints and $275,110,419 in losses in 2025, against 9,359 complaints and $173,586,820 in 2024.

Read both numbers with care. IC3 defines its Real Estate category as loss of funds from a real estate investment or fraud involving rental or timeshare property, so it is not a count of diverted closing wires. Closing diversions are often filed as business email compromise, and the report does not break those out by industry. Both figures count only what victims reported.

How does email compromise hit a commercial closing?

The pattern is consistent. The criminal gets into a mailbox through phishing or a reused password, or registers a domain one character off from a real one. It reads the deal traffic, learns who sends money to whom and when, and waits. Close to funding it sends new wire instructions, or a revised payoff letter, from the real or imitated account, usually with a reason for the change and a reason for urgency.

On a commercial loan the lender sits on several of those paths. It wires loan proceeds to the settlement agent. It may receive a payoff letter for the existing lender's debt. Its borrower wires equity. After closing it releases reserves and holdbacks to borrowers and contractors. Any of those can be redirected, and the 2025 IC3 report notes that funds increasingly move through second hops to other accounts quickly.

What are the red flags in a closing wire?

None of these proves fraud on its own. Each one is a reason to stop and verify through a channel the sender of the email does not control.

• Changed instructions late in the deal

  A new bank, a new account or a new beneficiary name in the last days before funding.
• A reason and a rush

  An audit, a bank change or a tax issue, paired with pressure to wire today and keep it quiet.
• Beneficiary does not match the payee

  A title agent's escrow account held in an individual's name, or a payoff going to an account not in the lender's name.
• Lookalike addresses

  A domain with a swapped letter, or a reply-to address different from the sender.
• A phone number inside the email

  A call-back number supplied with the new instructions is the criminal's number, not a verification.
• Instructions by email only

  No instructions in the closing instruction letter, no portal upload, no prior record.
• Requests to split a wire

  Part to the usual account, part to a new one.

Which wire fraud controls actually work?

Lenders that avoid losses rarely rely on spotting fraud. They rely on a procedure, written into the closing instruction letter, that does not depend on anyone's judgment at four in the afternoon on funding day.

• 1
  Collect instructions once, from a known source

  Get the settlement agent's and payee's instructions early, in writing, through a channel the lender controls, and record who provided them.
• 2
  Call back to a number you already have

  Verify by phone with a person you know, at a number from the lender's records or an independent source, never from the email carrying the instructions.
• 3
  State that instructions never change by email

  Put it in the closing instructions and tell the borrower at kickoff. Any change restarts verification.
• 4
  Two people to release

  One person sets up the wire, a second approves it against the verified instructions.
• 5
  Verify payoff letters with the payee

  Confirm payoff amounts and accounts directly with the existing lender, not through the borrower's forward.
• 6
  Confirm receipt

  Call the recipient after sending to confirm the funds arrived, so a diversion is found in minutes, not days.
• 7
  Keep instructions out of email

  Share verified instructions on a permissioned document, so the version on file is the one everyone uses.

Does a closing protection letter cover wire fraud?

Generally not the kind most lenders worry about. A closing protection letter is the title underwriter's indemnity for loss caused by its issuing agent or approved attorney: failure to follow the lender's written closing instructions on matters affecting title or the lien, or the agent's own fraud, theft or misappropriation in handling the lender's funds, to the extent it affects title or the lien.

The ALTA single-transaction letter, in the 2021 revision filed in Florida, excludes fraud by anyone other than the insurer, the issuing agent or the approved attorney. It also excludes wire fraud, unauthorized access to email or networks, business email compromise, identity theft, and diversion of funds to a person or account not entitled to them, except to the extent the agent itself committed the fraud. If an outsider spoofs the title agent and the lender wires to the outsider, the letter is unlikely to respond. Lenders review that gap with their risk and insurance teams rather than assuming the CPL covers it.

What should you do in the first hours after a bad wire?

Speed decides recovery. IC3's guidance is direct: if you discover a fraudulent transfer, contact your financial institution immediately and request a recall, and file a complaint at ic3.gov regardless of the amount, with full transaction details.

• 1
  Call your bank's wire room

  Ask for a recall or reversal of the wire, and for the hold harmless letter or letter of indemnity the recipient bank may need, as the IC3 brochure describes.
• 2
  File with IC3

  Submit a complaint at ic3.gov with the sending and receiving bank, account numbers, amount, date and time, and the reference numbers. Complete banking fields are what let IC3 act.
• 3
  Call the parties

  Tell the settlement agent, counsel and the borrower by phone. Assume the email channel is compromised and stop all other wires on the deal.
• 4
  Contact the local FBI field office

  IC3 works with field offices on these cases; a direct call adds a contact who knows the file.
• 5
  Preserve the evidence

  Keep the emails with full headers, the instructions as received, call logs and the wire confirmation. Do not delete the compromised messages.
• 6
  Write the timeline

  Who sent what, when it was verified, who released the wire. Insurers, regulators and counsel will ask for it.

How does the Financial Fraud Kill Chain work?

The Financial Fraud Kill Chain is the process IC3's Recovery Asset Team, set up in 2018, uses to ask banks to freeze fraudulently transferred funds. For domestic transfers, if the case meets the team's criteria, it sends the transaction details to a contact at the recipient bank and requests a freeze, then brings in the FBI field office. If the complaint includes second-hop transfers, the team will chase those too. For international transfers it works with FinCEN's Rapid Response Team and FBI legal attaché offices.

IC3 reports that in 2025 the team initiated 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate. Domestic incidents numbered 3,574 with $507,042,623 frozen; international incidents numbered 326 with $171,970,560 frozen. IC3 also notes that business email compromise used to make up most of these incidents, and that 2025 saw more tech support and account takeover cases. None of it works if the complaint is filed days later.

Who owns wire verification on a closing?

Verification fails when everyone assumes someone else did it. Name the owner of each wire in the closing plan, alongside the other steps in the commercial loan closing process, and leave time on funding day for the calls. The closing timeline estimator helps place funding late enough that verification is not squeezed.

Does a shared closing workspace reduce exposure?

It removes one channel the criminal relies on. When verified instructions sit on a permissioned item in the deal workspace, nobody needs to forward them by email, and an emailed change stands out as unusual. The comparison of email and shared drives versus a shared workspace covers that trade.

In Prodeal, documents carry role-based permissions and watermarking, and the audit trail records who uploaded and viewed each file. That does not replace the call-back. Nothing does. It makes the call-back the only step left to do, and gives the lender a record of who verified what if anything goes wrong. This post is operational guidance, not legal advice; lenders set their own wire policies with counsel and their bank.