Before you wire a single dollar
It arrives a few days before closing. It uses your name, your address, your closing date, and the right people in the thread. It asks you to wire your funds. And the account it sends you to belongs to a criminal.
This walkthrough shows you exactly how that email works, the habit that stops it every time, and what to do in the first hours if the money is already gone.
About a 5 minute read.
The scale of it
Real estate fraud, 2025
$275.1M
Reported lost across 12,368 complaints
Business email compromise
$3.05B
24,768 complaints - the category this scam belongs to
All cybercrime reported
$20.9B
Up 26% over the prior year
These are only the losses people reported to the FBI. Many victims never file, so the real totals run higher.
Source: FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report.
Step 1 - How it begins
A real estate deal generates weeks of email among a lot of people - buyer, seller, two agents, a lender, a title company, sometimes an attorney. If a criminal gets into any one of those inboxes, they don't act right away. They read.
They learn your closing date, your lender, your agent's writing style, the file number, and roughly what you'll be bringing to the table. Then they wait for the moment when a message about money is exactly what you're expecting.
Step 2 - The message
Fictitious address, shown for illustration. First Source Title only ever emails from @firstsourcetitle.com.
From: Closing Dept <closing@firstsourcetitle-secure.com>
Subject: RE: 4821 Maple Ridge Dr - Wiring Instructions (File #24-0881)
Hi Jordan - we're all set for Thursday's closing.
Please note our escrow account was recently updated. Use the instructions attached for your cash to close of $48,200. Wire must be received by 2pm tomorrow to avoid a delay in funding.
If you have questions call me directly at (216) 555-0147.
Thank you, Closing Department
Correct property. Correct file number. Correct closing day. Plausible amount. A signature block that matches the ones you've already seen.
Step 3 - The tells
The domain is not ours. Every email from us comes from @firstsourcetitle.com. That message came from @firstsourcetitle-secure.com - a look-alike domain registered to sit quietly beside ours. Display names are trivial to fake; read the part after the @, every time.
Instructions recently updated. Escrow account details do not change mid-transaction. A change notice is the single most common shape this fraud takes.
A deadline that creates panic. Urgency exists to stop you from picking up the phone. A real closing delay is an inconvenience; a wrong wire is often unrecoverable.
A phone number supplied in the message. If you call the number the email gives you, you reach the person who sent it. They will confirm everything warmly and professionally.
Step 4 - The rule
You do not have to become a security expert or learn to spot a forged header. You have to do one thing, without exception, every time:
01
No wire goes out the same hour the instructions arrive. Ever.
02
Use a number you already had - from your signed documents, or the one you've been calling all along.
03
Read the bank name, routing and account numbers back to a person who knows your file.
Step 5 - Verify like this
Find the number yourself - your purchase contract, your engagement letter, an earlier piece of mail, or by typing our website address into your browser by hand.
Ask for the closer handling your file by name, and give them your property address and file number.
Say: I'm about to wire. Please read me the bank name, routing number, and account number. Let them say it first - don't read yours out for a yes or no.
Compare every digit against what you're about to enter. If anything differs, stop and do not send.
Step 6 - Set your expectations
Step 7 - The day of
That second call is the one people skip, and it is the one that buys back time. The difference between finding out in four hours and finding out in four days is very often the difference between recovering the money and not.
The verification call. Confirm the receiving bank, routing number and account number aloud with your closer.
Call again the same day and confirm the funds actually arrived. Do not wait for someone to tell you they didn't.
Step 8 - If it already happened
Stolen funds get moved and split quickly. The FBI's recovery process works best when a fraudulent wire is reported inside about 72 hours - and in 2025 its Recovery Asset Team managed to freeze roughly 58% of the money in the cases it was able to act on.
$679 million frozen of $1.16 billion, across 3,900 actions. Acting fast doesn't guarantee recovery - but waiting nearly guarantees the opposite.
Step 9 - Do these in order
Call your bank's fraud department immediately. Say the words: I need to recall a wire - it was fraud. Give them the date, amount, and receiving account.
Ask your bank to initiate the FBI's Financial Fraud Kill Chain. Ask for it by name. It generally applies to larger and international wires reported quickly.
Call the receiving bank's fraud department and ask them to freeze the account.
Call us and your agent and lender. We will move on our side and warn everyone else on the file.
File a report at ic3.gov with the wire details, the receiving account, and the original email including its full headers.
Contact your local FBI field office and file a report with local police.
Secure the inbox. Change the password, turn on two-factor authentication, and check for forwarding rules you didn't create.
Call - don't email. Every minute spent composing a message is a minute the money is moving.
The short version
Wiring instructions that change are fraud until proven otherwise.
Read the domain after the @ - not the display name.
Verify by voice on a number you already had, before every wire.
Call again after sending to confirm the funds landed.
If something went wrong, call the bank first and keep calling. Speed beats certainty.
If you already sent it
Call your bank's fraud department immediately and ask for a wire recall.
Contact your title company through a verified number so they can help document the fraud.
Report the incident to the FBI Internet Crime Complaint Center at ic3.gov.
When in doubt, call us
First Source Title Agency, Inc.
(855) 716-90002745 E Atlantic Blvd, Pompano Beach, FL 33062
Ohio office: 7717 Victory Lane Suite B, North Ridgeville, OH 44039
Email from us always ends in @firstsourcetitle.com
Better still: save that number in your phone at the start of your transaction, before any suspect message can arrive. Then you will always have a trusted number that didn't come out of an email.
Call First Source Title before you send funds. We will help you verify the instructions through a trusted channel.
General guidance on avoiding real estate wire fraud - not legal or financial advice, and not a guarantee against loss. Statistics from the FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Report fraudulent wires at ic3.gov.
