The email really is from them

The story below is a composite, built from federal prosecutions and from cases the FBI publishes in its own annual report. No real person is described, and amounts and timings in the story are illustrative.

The email arrives on a Tuesday, four days before closing.

It's from the closing attorney, on the thread you've both been using since March. Her earlier messages are quoted underneath. The signature is the one you've seen thirty times. She apologizes for the short notice: their escrow account is being audited, so today's wire needs to go to a different account. The new details are attached.

You're careful, so you check. You look at the sender's address and it's hers, character for character. You scroll the history and it's real, because it is real. You call the number in the signature and a woman answers with the firm's name, confirms the change, and thanks you for checking.

You wire $531,000.

None of that was carelessness. In a prosecuted Massachusetts case, criminals first got into the email accounts of an attorney who handled real estate closings, then used what they found there to send a buyer in a live transaction instructions to wire almost exactly that sum, $531,981. The buyer believed it was a legitimate purchase because in every respect except one, it was.

The pattern

This is a compromised trusted contact, and it's the inverse of every other scam on this site.

Everywhere else, the advice is to distrust the thing that arrived unasked. Here nothing arrived unasked. You hired this person. You've been emailing them for weeks. The message lands in a thread you started.

What happened is that somebody got into that mailbox and then waited. They read until the money was due. The FBI puts the timing plainly. The criminal gets inside the transaction, and once funds begin changing hands, steps in and redirects them.

The industry calls it business email compromise. It isn't only realtors. The Treasury Department's financial crimes unit described the legal version ten years ago: a criminal compromises an attorney's email account, reads the client matters, and then sends payment instructions. It named the same pattern for brokers and accountants. Any professional you trust with a scheduled payment is in scope.

The part that breaks the usual advice

Here's where this scam earns its own article. The phone number gets spoofed too.

The standard instruction is to call and check. It's good instruction, and it's the FBI's own. But its 2022 annual report describes a growing tactic: criminals spoofing real business phone numbers to confirm fake banking details. Victims called a title company or realtor on a known number. They learned later that the number had been spoofed.

Oklahoma's real estate commission tells buyers the same thing in blunter words: some criminals supply false numbers for verification, and buyers who called them authorized the transfer anyway.

So "call to verify" needs one more word in it. Not just a call. A call to a number you already had before any of this started.

Not the signature block, which somebody else can edit. Not a number in the attachment. Not the first search result, because those get bought. The number on the engagement letter you signed in March, or the one you saved in your phone the day you hired them.

The FBI used to say exactly this. A 2016 advisory told people to use previously known numbers, not the ones provided in the email request, and repeated it in 2017. It still says a version of it: a May 2025 FBI alert says to verify through "a previously confirmed platform or trusted source." Its business email page says only to use secondary channels, which doesn't tell anybody which number to dial.

The clearest version now in use isn't federal. It's a checklist the title industry gives its closers, with a line they fill in before sending your money: Source of Phone Number, never the number in an email, with boxes for the original contract, a secure portal, or a search. Run the same test on yourself. If you can't say where the number came from, you don't have one yet.

This is step two of this site's own method meeting the hardest case it will ever face.

And do not verify by email

The instinct is to reply and ask: did you send this?

Don't. If somebody is reading that mailbox, your question goes to them. You'll get back a calm yes, in the right voice, on the right thread, and you'll feel better than you did before you asked. The FBI's guidance is to be wary of any exchange that is exclusively email based, and to establish a second means of communication for checking.

A second message isn't a second channel. A second medium is.

Where it was visible

Very little was, which is the point. But three things were.

The account changed. This is close to the whole tell. Title companies and lenders have processes that don't suddenly change, as the Realtors' own guidance puts it. A new account, late, is the event.

It was late and it was urgent. Four days out, with a reason attached. The timing isn't coincidence; it's the product.

The reason was unverifiable by design. An audit, a bank change, a frozen account. Something you can't check and wouldn't expect to.

And the one nobody catches: the reply and the callback both went to the same people. Every check you ran stayed inside the channel they controlled. That isn't a failure of diligence. It's a well-built trap, and diligence inside it produces more confidence rather than less.

One check still worth running, because the other version is commoner. Often it's a lookalike address, one letter off. Britain's solicitors' regulator reviewed its own casework and found most incidents were that rather than actual hacking. So read the address, character by character. Just don't stop there: when it is the real account, that check passes.

What actually stops it

Get the number at the start, and write it down. Oklahoma's advice is to obtain the escrow officer's number at the beginning of the transaction, before there's anything to steal. Then use that one, always.

Treat any change of account details as fraud until proven otherwise. Not suspicious. Fraud, provisionally, every time.

Verify before sending, never after. A wire isn't a card payment.

Ask them at the start to put in writing that they will never send changed wiring instructions by email. North Carolina's bar has held that this is what a careful settlement lawyer does. Any professional worth hiring will agree, and then any email that does it is answered before it arrives.

Agree a code word at the start. The FBI has recommended this since 2018: phrases known only to the two legitimate parties. This site already tells families to do it, and it's close to the only check that survives a spoofed phone number.

The five signs, in this case

The five signs need reading carefully here, because one of them appears not to fit.

It came to you. It did, but from inside a conversation you started. That's why the sign feels wrong, and why the scam works. Apply it to the request rather than the relationship and it holds. You didn't ask for new wiring instructions. They arrived.

It moved you fast. Four days to closing, and a change that had to happen today.

It wants a transfer. A wire, to a new account, which is the least reversible thing a private person can do with money.

It wants it kept quiet? No, and that is worth saying. This scam does not need secrecy, because it is not asking you to do anything unusual. You were always going to send that money.

It keeps you on the line? Also no. It does the opposite and goes quiet, because every minute you spend checking inside the thread makes you more confident, not less.

Two of five absent is not reassurance. It is what makes this the hardest one on the site.

The numbers, and one that's easy to misread

Business email compromise cost people 60 and older $568 million in 2025 across 4,566 complaints, up about 48 percent in a year, per the elder fraud section of the FBI's 2025 annual report. All ages, $3.05 billion.

Now the part where a number is easy to misread. The FBI does publish a Real Estate figure: $275 million in 2025, $124 million of it from people 60 and older. But its own glossary defines that category as investment, rental and timeshare losses. Different thing. Closing wire fraud sits mostly inside the BEC total, not broken out on its own.

This matters because most figures in circulation are that mistake. The Realtors' own wire fraud page cites a total five years old, from the category that means something else. The FBI's own congressional report on business email compromise and real estate wire fraud describes the crime but gives no separate dollar figure for it. So there is no sound national total for real estate wire fraud alone, and a number offered as one deserves a second look.

Tell one person

Send this to anyone in your family who is buying, selling or refinancing, and ask one question: what number would you call to check a change in wiring instructions?

If the answer is "the one in the email," you've found it while it's still cheap.

The sentence worth remembering: any change to payment details is fraud until you have confirmed it on a number you had before the deal began.

When the same request arrives from a stranger rather than your own professional, it's usually the bank impersonation pattern, where the caller ID is the thing that's faked. If money has already gone, expect a recovery scam next.

If this happened to you, or to someone you love

You're not the first and you did nothing stupid. This is the scam that defeats careful people specifically, because every check you can run from inside the conversation returns a reassuring answer.

Do these in this order. The first hour matters more than everything after it.

Call the bank you sent from, not the receiving bank. Ask them to do two things: request a recall of the wire, and issue a Hold Harmless Letter or Letter of Indemnity to the receiving bank. That second one is why banks act. It is an agreement between the two banks, not a document you receive, and the receiving bank generally will not freeze an account without it. The FBI says getting these as quickly as possible may reduce or eliminate the loss. You cannot usefully call the receiving bank yourself. In one case the FBI published, a couple and their attorneys both tried, and got nowhere.
File at ic3.gov the same day, with the full transaction detail: both banks, the account and routing numbers, the amount and the time. This is not paperwork. It is what triggers the FBI's recovery team, and in that same case it was the complaint, not the phone calls, that got $449,000 frozen.
Call your title company or attorney on a number from your signed documents, tell them their mailbox may be compromised, and stop the rest of the transaction.
Change the password on every email account involved, including yours, and turn on two-factor authentication. Assume the thread is still being read.
Call the National Elder Fraud Hotline, 833-372-8311, Monday to Friday, 10 a.m. to 6 p.m. Eastern.

One thing worth knowing rather than discovering: a wire recall is a request, not a right. The receiving bank can refuse, and the consumer protections that cover a debit card don't cover a wire. What actually recovers money is speed plus a law enforcement freeze, while the funds are still sitting there. It does happen. Of real estate cases in a federal review of 2020 and 2021, about a fifth recovered everything and another one in seven recovered part.

Verify first.

Sources last checked: 18 September 2026.