Coordinate however you want. Verify like you are under attack.
A wire is usually irreversible. Once it is sent to the wrong account, recovery is unlikely. Wire fraud is not a hacking problem. It is a communication trust problem: someone learns a deal is closing, waits for the right moment, and sends instructions that look exactly like the ones you were expecting. This guide is two layers of protection, and it tells you which layer your transaction needs.
Contents
The fraud happens in the conversation, not the system.
Almost every diverted wire we have seen followed the same shape. Nobody broke into a bank. Somebody read an email thread, learned who was who, and at the right moment sent a message that looked like every other message in the deal. The account number was different. Nothing else was. The buyer did exactly what the buyer was supposed to do, and the money left.
In real estate this risk is most visible during escrow and closing, when large sums have to move on a deadline and several parties are emailing instructions back and forth. But it is the same risk in any high-value transfer: an art purchase, an aircraft, a capital call, a vendor payment, a settlement. If you are wiring money, you are a target. The risk rises with the size of the transaction, how visible you are, and how much time pressure surrounds the transfer.
Three things that are never proof
- Email is not proof. Any inbox in the deal can be spoofed or quietly compromised, including yours.
- Documents are not proof. Letterhead, PDFs, attachments, and signatures are trivially forged. Treat them as untrusted until verified through a channel you already trust.
- Urgency is never proof. Deadlines are real. Pressure to skip verification because of a deadline is the signature of the attack.
Email is for coordination. Phone or video is for verification. Criminals count on you confusing the two.
The two layers below are built on that distinction. Enhanced Security is strong, practical protection that every transaction should use, every time. Maximum Security adds zero-trust controls for the deals where a single error would be catastrophic. Use the first always. Use the second when section 02 says so.
Who this is for, and which layer they need.
The controls are the same for everyone. What changes is how many of them you apply. The trigger for the Maximum layer is any one of the following: the wire is seven figures or more; the client is public-facing or otherwise visible; a family office or staff signatories are involved; or the loss could not be absorbed. One trigger is enough.
| Situation | What the attacker targets | Layer |
|---|---|---|
| Homebuyer | The down payment and closing funds. The most common victim and the most common loss. | Enhanced, every time |
| Home seller | The proceeds. Fraudsters send escrow "updated" payout instructions in the seller's name. | Enhanced, every time |
| Real estate investor | Multiple closings, exchange funds, and lenders create more threads to compromise and more instructions in flight. | Enhanced; Maximum above seven figures |
| Executive or public figure | The transaction is easier to discover and the pretext is easier to write. A visible person is a researched target. | Maximum |
| Family office | Staff who move money on the client's behalf, on the client's instruction, over email. The attacker impersonates the client. | Maximum |
| Any non-real-estate high-value wire | Art, aircraft, vehicles, private placements, settlements, vendor payments. Same fraud, different letterhead. | Enhanced; Maximum by the same triggers |
Every wire, every time.
These controls follow the transaction in order: before it starts, when the instructions arrive, and the day the money moves. None of them requires special equipment. All of them require you to do something slightly awkward at the moment everyone else wants speed.
Before the transaction starts
Lock down the communication
- Ask the title company or escrow officer how they deliver payment instructions. The right answer is a secure, MFA-protected client portal. If they will only email instructions, raise your verification controls or consider a different provider.
- If email is going to carry deal documents, use a dedicated address for the transaction, turn on multi-factor authentication immediately, and do not forward escrow emails to anyone.
- Assume any payment instruction that arrives digitally is untrusted until you have verified it another way.
Establish your trusted contacts, independently, now
- Verify the title company and escrow officer through the state licensing board or the underwriter's official directory, not through the contact details on their letterhead.
- Obtain and save the escrow officer's name, direct phone number, and bank name from a source you already trust: the contract, a known-good website, a verified directory, a number you have used before.
- This number is the one you will call later. A phone number that arrives in a message about the wire is never the one you call.
When the wiring instructions arrive
Treat any change as a stop signal
Legitimate wiring instructions almost never change mid-transaction. A "corrected" account, a new bank, an updated routing number: any change is a reason to stop, call the pre-verified number, and confirm through an independent channel before doing anything else.
Verify out of band, live
- Confirmation by email is not verification. Verify on a phone call to the number you saved earlier, or on video.
- You read the numbers. They confirm them. Never let the other party read the numbers to you; that is how a fraudster feeds you the wrong account.
- Verify all five: account holder name, bank name, routing number, account number, amount.
- If you receive an inbound call about the wire, hang up and call back on your pre-verified number. Caller ID is not proof either.
Slow down
Fraud depends on urgency. A legitimate escrow officer, agent, or lender can absorb a verification pause without blinking. If a pause is treated as a problem, that is information.
The day you send the wire
- Initiate the wire in person when you can. If remote, call your bank's wire department first, on a number from your card or the bank's official site, and confirm the process and authentication steps.
- Double confirmation: verify the instructions with escrow, then verify them again with your bank. Do not rely on screenshots, PDFs, or forwarded messages for either.
- Never confirm wiring details by replying to an email. Never click a link related to the wire or to "wire verification." A verification portal that arrives by email is assumed fake; use only portals you already trust, reached from a bookmark or a URL you typed.
- Require verbal confirmation from your bank before release.
The rule of thumb
Email is for coordination. Phone or video is for verification. Deadlines are real. Pressure to skip verification is the red flag. You are not slowing down the deal. You are preventing a loss.
One is enough to pause. Several mean stop.
In the message
- Pressure to act quickly.
- A request for secrecy or discretion.
- A change in writing style, tone, or sign-off from the person you have been dealing with.
- Sent at an unusual time for that counterparty or that stage of the transaction.
- A slight change in the bank name or the account holder's name.
In the request
- A request to "confirm" details you already provided.
- Any change to instructions after they were verified.
- New instructions arriving after a test wire.
- A "rejected wire," "format change," or "compliance hold" that requires new instructions to fix.
- A phone number, portal link, or contact you did not already have.
The operational pretext deserves special mention. Fraudsters lean on plausible banking language: a payment rejected for format reasons, a compliance review, a new messaging standard. The U.S. wire system's move to the ISO 20022 format in 2025 gave them a fresh vocabulary. Treat any such message as untrusted. Call your bank and your escrow officer on the numbers you saved.
When the stakes are high, remove trust from the equation.
Everything in section 03 still applies. This layer adds controls for the transactions where a single mistake cannot be absorbed: seven figures or more, a public-facing client, a family office, or a loss that would be catastrophic. It is organized the same way, by when in the transaction each control happens.
Before the transaction: harden the target
Reduce your visibility first
Before listing a property or initiating a purchase, have the client's and key family members' home address, personal phone numbers, and personal email removed from data-broker and people-search circulation. Targeted fraud starts with research, and a client who is hard to research is hard to impersonate convincingly. This is a digital executive protection engagement, and it does not replace live verification of the wire. It makes the attack harder to build.
Set the communication rules
- No financial documents over standard email. Instructions and documents live in a secure portal.
- Messaging apps are for coordination only. Account numbers are never transmitted through them, and final payments are never approved through them.
- Email is permitted to say one thing: "You have a message in the portal."
Phishing-resistant authentication for every signatory
- Everyone authorized to approve a wire secures email, banking, portal, and password-manager accounts with hardware security keys or passkeys.
- If SMS codes are the only option available on a given account, keep them on and add verification steps for wires. Never disable MFA without a stronger replacement.
A clean device
For the highest-risk closings, use a dedicated, fresh device, such as a new tablet or Chromebook, for portal access and online banking only. No email configured, no browsing, no public Wi-Fi. Treat it like a financial instrument. This reduces malware and account-takeover risk. It does not replace out-of-band verification.
Before the transaction: vet the partners
- Ask the title company to confirm in writing that it uses a secure client portal for payment instructions and that it carries cyber liability and crime insurance.
- Have counsel review the Closing Protection Letter. Confirm that it protects the buyer, not only the lender, and read the exact language on wire fraud and diversion of funds. Many CPLs exclude it. If the CPL does not cover it, require proof of adequate insurance from the title company.
When the instructions arrive: the handshake
Agreed verbally, in person or on a verified video call, between you and the escrow officer. Never written down. Never sent digitally.
Not by email, not by attachment, not by text.
Or a call to the pre-verified number. Never a number or link that came with the instructions.
"I am looking at the instructions. Confirm the last four digits of the account are 8821." You supply the digits. They confirm. They never read them to you.
They state it. A wrong word, a hesitation, or an excuse is a stop.
Do not send. Do not negotiate. Go to section 07.
The safe word is an additional check, not a substitute for the callback and the read-and-confirm. Video alone is not proof either; voices and faces can be imitated. The strength is in the combination: a channel you chose, numbers you supplied, a secret that was never digital.
Execution
The test wire, understood correctly
If fees and timing allow, send a small test wire, for example $100, and wait for the escrow officer to confirm receipt through the portal or on video before sending the balance. Understand exactly what this proves. A test wire confirms that the account exists and receives funds. It does not prove who controls the account. A fraudster's account receives a test wire perfectly well. Do not relax any other control because the test arrived.
Final release
- Authenticate the outgoing wire with the bank using a hardware token or the bank's strongest available authentication.
- If any change to the instructions appears after the test wire, stop immediately and treat the transaction as compromised. Initiate a full security review before any further funds move.
The backstops, and what they do not cover.
Banks and insurers offer real protections. Every one of them has a gap that fraud is designed to fall through. Know the gap before you rely on the protection.
| Backstop | What it does | What it does not do |
|---|---|---|
| Beneficiary name matching and pre-validation | Some banks can check that the account holder's name matches the beneficiary you entered, or pre-validate the account, on some payment rails. Ask. If offered, enable it. | Not universal. If your bank does not support it, treat name matching as unavailable and rely on manual verification. |
| Bank fraud holds and callbacks | Your bank's wire department can validate the process, place a hold, or call you back before release. Capabilities vary by institution. | The bank executes the instruction you authenticate. Once authorized and sent, recovery depends on speed and luck. |
| Closing Protection Letter | Protects covered parties against certain acts of the title agent. | Frequently excludes wire fraud, spoofing, and diversion of funds, and may protect the lender rather than the buyer. Counsel reads the exact language. |
| Title company insurance | Cyber liability and crime coverage held by the title company may respond to losses caused by their compromise. | Does not respond to your compromised inbox, and limits may be far below your wire. |
| Your own insurance | A personal cyber policy, or a family-office crime policy, with explicit social engineering fraud or fraudulent instruction coverage and a carve-back to the voluntary parting exclusion. | Usually sublimited, often requires a specific endorsement, and the voluntary parting exclusion is exactly the clause that denies a wire you sent yourself. For real estate, excess coverage or a specific endorsement to the transaction value is often needed. |
If something feels off, stop. Then do this.
Do not proceed with the wire. The deal will survive a pause. It will not survive a diverted payment.
Immediately
- Do not reply to the message. Do not click links or open attachments. Do not engage the sender further.
- Do not use any contact detail that came with the suspicious message.
Verify through trusted channels
- Call your bank's wire department on a known number, from your card, the official site, or a branch, and ask them to validate the process before any funds release. Ask what verification tools they can apply: name verification, fraud holds, callbacks.
- Call your escrow officer on the number you saved at the start of the transaction. Not the number in the message.
- If applicable, notify your internal IT or security team, your family office, or your financial advisor. A compromised inbox in the deal is everyone's problem.
If a wire has already gone to the wrong account
- Call your bank's fraud line immediately and request a recall or a SWIFT recall. The first hours matter more than anything else you will do.
- Report to the FBI's Internet Crime Complaint Center. Its Recovery Asset Team works with banks to freeze funds, and it has the best chance when notified fast.
- Notify the title company, your agent, and counsel. Preserve every message, header, and file.
The principle
Most wire fraud succeeds because good people trust normal processes in abnormal situations. This guidance exists to make abnormal behavior the default whenever money is moving.
Eight things people believe while wiring money.
"The instructions came from my escrow officer's email address."
Or from someone reading it. A compromised or spoofed inbox sends from exactly that address, in exactly that voice, at exactly the right moment. The sender line proves nothing.
"It is on letterhead, with a signature."
Letterhead is a PDF. So is a signature. Documents are untrusted until verified on a channel you already trust.
"They called me and confirmed."
Inbound calls are part of the attack. Caller ID is spoofed as easily as email. Hang up and call the number you saved at the start.
"I asked them to read the account number back and it matched."
Backwards. If the instructions were forged, the fraudster reads you the forged number and it matches perfectly. You read, they confirm, always.
"The test wire arrived, so the account is legitimate."
The account exists. That is all a test wire proves. It says nothing about who controls it. Keep every other control in place.
"The Closing Protection Letter covers me."
Read it. Many CPLs protect the lender, not the buyer, and many exclude wire fraud and diversion of funds outright. Counsel confirms the exact language, or you require other proof of coverage.
"My bank will catch it."
Your bank executes what you authenticate. Some banks offer name matching or pre-validation; many do not. Ask, enable what exists, and assume the rest is on you.
"The wire has to go today or the deal falls through."
Deadlines are real; that sentence is still the attack. A legitimate counterparty can handle a verification pause. Only a fraudster needs you to skip it.
Before, when instructions arrive, the day you send.
Before the transaction
- Verify the title company and escrow officer through the licensing board or underwriter directory.
- Save the escrow officer's direct number from a source you already trust.
- Insist on a secure portal. Dedicated email with MFA if email is unavoidable.
- Maximum: reduce the client's visibility, issue hardware keys, set up a clean device, agree a safe word, have counsel read the CPL.
When instructions arrive
- Any change is a stop signal.
- Call the saved number or schedule video. Never a number from the message.
- You read all five details. They confirm.
- Maximum: request the safe word; send a test wire and wait for portal or video confirmation.
- Slow down. A pause is not a problem.
The day you send
- In person if possible. If remote, call the bank's wire department first.
- Verify with escrow, then again with the bank.
- No email replies, no links, no emailed portals.
- Verbal confirmation from the bank before release. Maximum: hardware-token authentication.
- Any post-verification change: stop, treat as compromised.
The standard
Coordinate however you want. Verify and authorize like you are under attack. Email is not proof. Documents are not proof. Urgency is never proof.
What this guide stands on.
Reviewed against current first-party and industry material in September 2026. Bank capabilities, insurance forms, and title-industry practice vary by institution and by state. Confirm coverage language with counsel and your broker, and confirm verification tools with your bank, before relying on either. Nothing here is legal, financial, or insurance advice.
Government and law enforcement
- FBI Internet Crime Complaint Center, annual Internet Crime Reports. Business email compromise remains among the costliest reported crimes, with real estate transactions a recurring target; the Recovery Asset Team's freeze process and its dependence on speed.
- FinCEN advisories on business email compromise in the real estate sector.
- Consumer Financial Protection Bureau and Federal Trade Commission consumer guidance on mortgage closing wire scams.
- Federal Reserve Financial Services, Fedwire Funds Service ISO 20022 migration (2025). The legitimate format change that fraudsters now cite as a pretext.
Industry
- American Land Title Association wire-fraud guidance and its member survey data on attempted diversions.
- Title underwriter guidance on Closing Protection Letters and the diversion-of-funds exclusions common to them.
- Insurance industry treatment of social engineering fraud and fraudulent instruction coverage, including sublimits and the voluntary parting exclusion.
Law
- Uniform Commercial Code Article 4A. Why an authorized wire is, in most cases, your loss: the payment order framework, the security-procedure allocation of risk, and the limits of recall.
ObscureIQ material
- Safe Escrow and Wire Transfer Checklist (2026). The internal checklist this guide is built from; consolidated here into two layers with defined triggers.
- Field Guide 02, Asset Privacy. The transaction structure this guide protects the closing of.
Where this guide opens into the work.
Field Guide 02
Asset Privacy
The deed is public. How to own a property without your name and home becoming searchable, and why that structure needs a protected closing.
Program
Obscurity
Exposure Discovery and Exposure Reduction. The pre-transaction visibility cleanse in the Maximum layer, delivered.
Engagements
Structures
Family offices and the staff who move money for clients: the workflow, the keys, and the training.
Program
Tactical Privacy Training
Social engineering resistance for clients and the people around them, taught rather than told.
If the wire is large enough that you cannot afford to be wrong, do not run this alone.
For seven-figure closings, public-facing clients, and family offices, we set up the Maximum layer as an engagement: visibility reduction before the listing, the communication rules, hardware authentication for signatories, partner vetting, and an analyst on the handshake. A confidential call establishes what your transaction needs.