A wire fraud checklist for transaction coordinators

Real estate wire fraud follows a simple script. Someone gets into an email conversation about a transaction, often by compromising an agent's, a coordinator's or a buyer's inbox, and waits. Just before closing, the buyer gets a convincing email: "Our wiring instructions have changed." The money goes to the criminal's account, and it's often gone within hours.

The FBI's Internet Crime Complaint Center has listed real estate among the sectors hit hardest by business email compromise for years. Transaction coordinators sit in the middle of every email thread, which makes you one of the best people to stop it. Here's a checklist you can use on every file.

At the start of every transaction

• Warn the buyer in writing and out loud. Put it in the introduction email, and say it on the first call: "We will never email you wiring instructions or change them by email. Before you send money, call the title company on a number you find yourself."
• Get the title or escrow company's phone number from a trusted source: their website, a previous closing, or the contract. Never from an email signature.
• Keep sensitive details out of email where you can. Account numbers, wiring instructions and scans of IDs belong in the title company's secure portal, not in a reply-all thread.
• Tell sellers too. Seller proceeds are also targeted, usually with a fake "please update your payout details" request.

Before any money moves

1. Wiring instructions come only from the title or escrow company, through their secure method, never forwarded by you or an agent.
2. The buyer verifies them by phone, using the number they already have, before sending. They confirm the account name, the bank, and the last four digits of the account.
3. Treat any change as fraud until proven otherwise. Real title companies almost never change wiring instructions mid-transaction. A last-minute change, urgency, or a new bank in another state are the classic signs.
4. Confirm receipt the same day. The buyer or their agent calls escrow to confirm the funds arrived. The sooner a problem is spotted, the better the chance of getting the money back.

If an email asks for money and changes where it goes, stop and pick up the phone. Every time.

Signs an email isn't what it seems

• The sender's address is a near-miss: an extra letter, a different ending, or a free email domain.
• The reply-to address is different from the sender.
• Pressure to act fast, keep it quiet, or skip the usual call.
• Instructions arrive as a PDF or link from someone who normally doesn't send them.
• A thread you're on suddenly adds a new person, or an existing one starts writing differently.

Protect your own inbox

• Turn on two-factor authentication for your email and every tool that sends email for you.
• Use a separate, strong password for your email account.
• Check your email's forwarding rules and filters from time to time. Attackers often add a hidden rule that copies or hides messages.
• Don't open unexpected attachments or sign-in links, even from people on the file. Call if you're unsure.

If money has already gone to the wrong place

Minutes matter. In this order:

1. The buyer calls their bank immediately and asks it to recall the wire and contact the receiving bank.
2. Call the title or escrow company so they can alert their bank and hold the closing.
3. Report it to the FBI at ic3.gov and contact the local FBI field office. Reporting quickly helps with freezing funds.
4. Secure the compromised inbox: change passwords, remove unknown forwarding rules, and tell everyone on the thread.
5. Write down what happened, with times, while it's fresh, for the bank, the insurer and law enforcement.

The one-page version

• Warn buyers and sellers on day one, in writing and on the phone.
• Wiring instructions come only from title or escrow, through their secure channel.
• Verify by phone on a number you found yourself. Never one from the email.
• Any change to instructions is fraud until a phone call proves otherwise.
• Confirm funds arrived the same day.
• If it goes wrong: bank, title, IC3, in that order, immediately.

Closingbird never sends wiring instructions, and its Acceptable Use Policy forbids using it to send them. Keeping the whole file's communication in one place, with every email on the record, also makes an out-of-place message easier to spot.