Mortgage Wire Fraud Prevention: How to Protect Your Closing Funds

Want to see what you qualify for? I can run your numbers and give you a clear answer quickly.

Mortgage Wire Fraud Prevention: How to Protect Your Closing Funds

Mortgage wire fraud prevention should begin before a homebuyer receives instructions for sending closing funds.

Criminals target real estate transactions because buyers may be preparing to transfer substantial amounts of money while communicating with multiple parties through email.

A fraudulent message may appear to come from:

Title company
Escrow officer
Mortgage lender
Loan officer
Real estate agent
Attorney
Builder
Seller
Bank representative

The message may contain information specific to the transaction, including the property address, closing date, title-company name, or expected amount.

That familiarity can make the request appear legitimate.

The safest rule is simple:

Never send closing funds using instructions that have not been independently verified through a trusted communication method.

What Is Mortgage Wire Fraud?

Mortgage wire fraud occurs when a criminal deceives someone involved in a real estate transaction into transferring funds to a fraudulent account.

The scheme commonly targets:

Down payments
Closing costs
Earnest money
Seller proceeds
Mortgage payoffs
Real estate commissions
Repair payments
Title and escrow funds

The criminal may impersonate a legitimate participant and provide false banking instructions.

Once the transfer occurs, the funds may be moved quickly through multiple accounts, converted into another form, or transferred outside the country.

A wire transfer is not like a credit-card purchase. It may be difficult or impossible to reverse after the receiving bank accepts and releases the money.

What Is Business Email Compromise?

Business email compromise, commonly called BEC, is a sophisticated form of fraud in which a criminal uses email or another communication channel to impersonate a trusted party and request a transfer of funds or sensitive information.

The criminal may:

Compromise a real email account
Create a nearly identical email address
Spoof the sender information
Enter an existing email conversation
Send a fake title-company portal link
Impersonate a bank or lender
Call the victim after sending the fraudulent email
Use stolen transaction details to make the request believable

The FBI identifies business email compromise as one of the most financially damaging forms of online crime and specifically lists fraudulent homebuyer wiring instructions as a common example. The FBI’s Business Email Compromise guide explains how these schemes operate.

How Criminals Learn About the Closing

A criminal does not always send a generic message to thousands of people.

Real estate wire fraud can be highly targeted.

Criminals may obtain transaction information by:

Compromising an email account
Stealing an email password
Using phishing links
Installing malware
Monitoring email conversations
Accessing an insecure device
Exploiting reused passwords
Gathering information from social media
Researching public property and business records
Impersonating a transaction participant

A compromised account may allow the criminal to monitor the transaction silently.

The criminal can wait until the buyer expects wiring instructions and then send a fraudulent message at the most convincing moment.

A Fraudulent Email May Appear Inside a Real Conversation

One of the most dangerous scenarios occurs when a criminal gains access to a legitimate email account.

The fraudulent message may appear:

In an existing email thread
Under a familiar display name
With a realistic signature block
With the correct property address
Near the scheduled closing date
Shortly after a legitimate conversation

The message may even reference an actual change in cash to close.

This is why recognizing the sender’s name or seeing familiar transaction details is not enough.

The banking information must be independently verified.

Email Spoofing and Look-Alike Domains

A criminal may create an email address that differs from the legitimate address by only one character.

For example:

closings@trustedtitle.com
closings@trustedtltle.com

The second address substitutes a lowercase “l” for an “i.”

Other variations may include:

Added hyphen
Missing letter
Different domain ending
Extra word
Transposed characters
Display name hiding the actual address
Free email account impersonating a company

Mobile devices may show only the display name, making the difference harder to notice.

Always expand the sender information and examine the complete address.

Even then, email inspection should supplement—not replace—independent verification.

Why Last-Minute Changes Are a Major Warning Sign

Many fraudulent messages claim that the original wiring instructions changed.

The message may say:

The title company changed banks
The escrow account is under audit
The original account cannot receive the transfer
The closing was assigned to another office
The first wire failed
The funds must be sent to a “holding account”
The closing will be delayed unless payment is immediate

A legitimate change is possible, but every change should be treated as a high-risk event.

Do not reply to the message for confirmation.

Call the title company using a phone number obtained independently and verify the instructions with a known representative.

Text a Question

If you want help walking through your specific situation, I can run the numbers with you.

Get Pre-Approved

Establish a Trusted Contact Before Closing

Do not wait until the day of the wire to determine whom you should call.

Early in the transaction, identify at least two trusted contacts involved in the closing.

These may include:

Escrow officer
Title-company closer
Loan officer
Real estate agent
Attorney

Record their contact information using a source you trust.

Do not rely exclusively on:

An incoming email
Email signature block
Texted phone number
Search-engine advertisement
Unexpected phone call
Link sent in a message

Obtain the title company’s number from sources such as:

In-person meeting
Executed contract
Previously verified title-company website
Known real estate agent
Established transaction portal

The CFPB recommends identifying trusted representatives in advance and confirming payment instructions by phone or in person. Its mortgage closing scam guidance provides additional precautions.

Use a Two-Channel Verification Process

A safe closing protocol uses at least two separate communication channels.

For example:

Receive instructions through the title company’s secure portal
Confirm them by calling a previously verified phone number

Or:

Receive printed instructions in person
Confirm the account details by telephone before initiating the transfer

The two channels should be independent.

Replying to the same email that delivered the instructions is not independent verification. If the email account is compromised, the criminal may also answer the reply.

Calling a number contained only in the suspicious email is also not independent verification.

Verify Every Material Wire Detail

Before initiating the wire, verbally confirm:

Title-company name
Bank name
Account holder’s name
Routing number
Account number
Exact amount
Reference or file number
Expected transfer date
Whether the instructions have changed
Name of the person confirming the information

Read the numbers aloud.

Do not ask only, “Are the wiring instructions correct?”

Confirm the actual digits and account name.

Document:

Date
Time
Phone number called
Person who confirmed the instructions
Details verified

Ask Whether Wiring Instructions Ever Change

Early in the process, ask the title company:

How will instructions be delivered?
Will instructions be sent by email?
Is a secure portal used?
Could instructions ever change?
Whom should I call to verify them?
What should I do if I receive different instructions?
When should the funds be sent?
How will receipt be confirmed?

Knowing the normal process makes it easier to recognize a fraudulent deviation.

Never Trust Instructions Based Only on Email

Email can be useful for transaction coordination, but it should not be the sole authority for transferring money.

Do not wire funds based only on:

Email attachment
PDF instructions
Reply in an existing email thread
Scanned title-company letter
Electronic signature envelope
Link to an unfamiliar portal
Message from a known contact
Last-minute correction

A professional-looking PDF can still contain a criminal’s banking information.

The document’s appearance does not authenticate the account.

Be Cautious With Text Messages

Text messages can also be spoofed or sent from compromised accounts.

A fraudulent text may:

Appear in an existing conversation
Use the real person’s name
Reference the property
Claim that email is not working
Provide replacement instructions
Create urgency

Do not confirm wire instructions solely by text.

Call the trusted contact using a previously verified number.

Be Cautious With Phone Calls

A phone call is not automatically authentic.

Criminals may:

Spoof caller identification
Impersonate a title-company employee
Use transaction details to sound credible
Pressure the buyer to act quickly
Claim the regular closer is unavailable
ask the buyer to “confirm” sensitive information

If someone calls with wiring instructions, end the call and contact the title company through a trusted number.

Voice familiarity may become less reliable as synthetic voice technology improves.

Use Secure Accounts and Strong Authentication

Everyone involved in a real estate transaction should protect their email and financial accounts.

Use:

Unique password for each account
Long password or passphrase
Multifactor authentication
Updated operating system
Updated web browser
Current security software
Device screen lock
Secure home internet connection
Bank transaction alerts

Avoid reusing the same password for:

Email
Bank
Mortgage portal
Title portal
Social media
Cloud storage

If one account is compromised, reused credentials can expose several others.

Avoid Public Wi-Fi When Handling Closing Funds

Do not access sensitive closing documents or initiate a wire through unsecured public Wi-Fi.

Avoid conducting the transaction from:

Coffee shop
Airport
Hotel lobby
Public library network
Shared computer
Untrusted device

Use a secure private connection and a trusted device.

If you must communicate while traveling, consider contacting the title company and bank directly rather than opening sensitive links on an unfamiliar network.

Do Not Email Sensitive Financial Information

Avoid sending the following through ordinary email:

Bank statements
Full account numbers
Social Security numbers
Online banking credentials
Wire confirmation containing sensitive data
Driver’s license images
Tax returns
Verification codes

Use the lender’s or title company’s approved secure portal whenever available.

A legitimate lender, title company, or bank should never ask for your online banking password or multifactor-authentication code.

Examine Links Before Opening Them

A fraudulent message may direct the buyer to a fake portal designed to steal credentials.

Warning signs include:

Misspelled domain
Unfamiliar web address
URL-shortening service
Unexpected login request
Security warning
Poor formatting
Request to download software
Request for email credentials
Request for bank login credentials
Urgent instruction to disable security controls

Instead of using the link, navigate to the known company website independently or contact the company.

Confirm the Amount Separately

Criminals may send instructions for an amount close to the actual cash to close.

Review the final Closing Disclosure Explained and confirm the amount directly with the title company.

Ask whether:

Earnest money is credited
Seller credits are included
Lender credits are included
Property-tax prorations are final
Insurance charges are correct
The amount changed from the previous disclosure

An unexpected cash-to-close change should be explained before funds are sent.

Understand the Difference Between a Wire and an ACH Transfer

A wire transfer and an ACH transfer are different payment methods.

A wire is typically processed individually and may settle quickly.

An ACH transfer generally moves through a different payment network and may have different timing, authorization, and return procedures.

Do not substitute one method for another without title-company approval.

Also do not assume that entering wiring instructions into your bank’s online system guarantees the recipient is legitimate. The bank processes the information you provide; it may not know that a criminal deceived you.

Use the Correct Account to Send Closing Funds

Closing funds should come from an account that has been disclosed to and accepted by the lender.

Using a different account at the last minute can create concerns involving:

Source of funds
Undisclosed gift
Borrowed money
Business funds
Trust funds
Third-party contribution
Cash deposit
Ownership of the account

Confirm both the source and transfer method before moving the money.

Relevant resources include Source of Funds Requirements for a Mortgage and Cash Down Payment Rules.

Confirm Receipt With the Title Company

After initiating the wire:

Contact the title company through a trusted number
Confirm that the wire was received
Confirm the amount
Confirm the funds were credited to the correct file
Record the name of the person who confirmed receipt

Do not rely solely on a bank notification showing that the transfer was completed.

That confirms the bank processed the transfer—not necessarily that the correct title-company account received it.

Mortgage Wire Fraud Red Flags

Stop and verify the request if you encounter:

New wiring instructions
Different account number
Different bank
Different account holder
Urgent deadline
Threat that closing will be cancelled
Request for secrecy
Unfamiliar sender address
Slightly altered domain
Poor grammar or unusual tone
New phone number
Request to avoid calling the title company
Request to send funds in multiple wires
Request for cryptocurrency
Request for gift cards
Request to use a peer-to-peer payment service
Request to send money to an individual
Unexpected international account
Instructions delivered only by text
Password-protected attachment sent unexpectedly
Request for bank login credentials
Request for a security verification code

One red flag is enough to stop the process.

What Should You Do If Instructions Change?

Do not send the wire.

Take these steps:

Stop communicating through the questionable message
Call the known title-company contact
Use a previously verified phone number
Ask whether any change was authorized
Confirm all account details verbally
Notify the lender and real estate agent
Preserve the suspicious message
Do not open additional links or attachments

If the change is legitimate, the title company can confirm it through a trusted process.

A short delay for verification is far safer than sending the buyer’s closing funds to a criminal.

What Should You Do If You Sent Money to the Wrong Account?

Act immediately.

Recovery becomes more difficult as time passes.

Contact Your Bank Immediately

Call the sending bank’s fraud or wire department.

Tell the bank:

The transfer resulted from fraud
The transfer was intended for a real estate closing
The destination account is fraudulent
You need an immediate wire recall
You want the bank to contact the receiving institution
You need the matter escalated to the fraud department

Provide:

Wire amount
Transfer date and time
Confirmation number
Receiving bank
Routing number
Account number
Fraudulent instructions
Legitimate title-company information

Do not wait for the bank’s normal business process if an emergency fraud number is available.

Notify the Receiving Bank When Directed

Your financial institution should attempt to contact the receiving bank.

Law enforcement or your bank may provide additional instructions.

Do not independently communicate with the suspected criminal or warn them that recovery efforts are underway.

Contact the Title Company and Lender

Immediately notify:

Title company
Escrow officer
Mortgage lender
Loan officer
Real estate agents
Attorney, when applicable

They need to know:

Closing funds may be missing
An email account may be compromised
The closing may need to be delayed
Other parties may also be at risk
Legitimate instructions may have been replaced

The transaction should not continue as though the funds are merely delayed.

File a Report With the FBI’s IC3

File a complaint at the FBI Internet Crime Complaint Center as soon as possible.

Include accurate transaction details and financial information.

The FBI advises victims to contact their financial institution immediately and request a recall, then report the matter to IC3. Its public guidance emphasizes that time is critical because IC3 may be able to assist financial institutions and law enforcement with efforts to freeze funds. Review the FBI’s current BEC recovery guidance here.

Contact Local Law Enforcement

File a report with the appropriate local law-enforcement agency.

Obtain:

Report number
Officer or investigator’s name
Agency contact information

Your bank, insurer, attorney, or other parties may request the report.

Preserve All Evidence

Do not delete the messages.

Preserve:

Emails
Complete email headers
Text messages
Voicemails
Call logs
Attachments
Fraudulent wiring instructions
Legitimate wiring instructions
Bank confirmations
Screenshots
Transaction portal activity
Names and phone numbers used
Dates and times
Notes from conversations

If an email account may be compromised, avoid relying on that account to store the only copies.

Secure Compromised Accounts

From a trusted device:

Change the email password
Change reused passwords
Enable multifactor authentication
Sign out of all active sessions
Review forwarding rules
Review account-recovery information
Check for unfamiliar devices
Scan devices for malware
Contact the email provider
Notify affected contacts

Criminals may create hidden forwarding rules so they continue receiving messages after the password changes.

Consider obtaining professional cybersecurity assistance when a business or professional account is involved.

Contact Your Insurance Providers

Depending on the facts and available coverage, notify:

Cyber insurance carrier
Homeowners insurance carrier
Professional liability carrier
Crime or fidelity insurer
Title company’s applicable insurer

Coverage is not guaranteed.

Do not delay bank and law-enforcement notifications while investigating insurance.

Can a Fraudulent Wire Stop the Mortgage Closing?

Yes.

If the buyer’s required funds are missing, the title company generally cannot complete the transaction as planned.

The lender may need to determine:

Whether the borrower still has sufficient verified assets
Whether replacement funds are available
Whether replacement funds are acceptable
Whether the transaction must be delayed
Whether the purchase contract deadline is affected
Whether the rate lock will expire
Whether new funds create gift or borrowing concerns

A fraudulent transfer can become both a financial emergency and a mortgage-qualification problem.

Notify the lender immediately rather than trying to replace the money through an undisclosed loan, credit card, or third-party transfer.

Can Borrowed Money Replace Stolen Closing Funds?

Do not assume that borrowed money can be used.

A replacement source may affect:

Debt-to-income ratio
Asset requirements
Cash-to-close calculation
Reserve requirements
Loan-program eligibility
Disclosure requirements

The lender must review and approve the replacement funds.

See Can Borrowed Funds Be Used for a Down Payment?

Can a Family Member Replace the Funds?

A gift may be possible under some loan programs, but it must satisfy the applicable requirements.

The lender may need:

Gift letter
Donor bank statement
Evidence of transfer
Proof of relationship
Confirmation that repayment is not expected
Updated underwriting approval

Do not ask someone to send money directly to the title company without consulting the lender.

Buyer Mortgage Wire Safety Checklist

Before receiving instructions:

Identify trusted title-company contacts
Record verified phone numbers
Ask how instructions will be delivered
Ask whether instructions ever change
Enable multifactor authentication
Secure your email account
Avoid publicly discussing the closing

Before sending funds:

Review the final Closing Disclosure
Confirm the cash-to-close amount
Call the title company using a trusted number
Verify routing number
Verify account number
Verify account holder
Verify bank name
Confirm whether instructions changed
Confirm acceptable transfer timing
Use a secure device and connection

After sending funds:

Save the wire confirmation
Call the title company
Confirm receipt
Confirm the amount
Confirm the correct file was credited
Notify the lender if any issue occurs

Mortgage Wire Safety for Real Estate Professionals

Real estate and mortgage professionals can reduce risk by establishing a consistent protocol.

Consider:

Warn clients early and repeatedly
Avoid sending full instructions through ordinary email
Use secure portals
Require verbal verification
Publish a no-change policy when applicable
Use multifactor authentication
Protect transaction calendars
Train staff to recognize phishing
Confirm unusual requests through a second channel
Limit access to sensitive information
Maintain an incident-response procedure
Notify all affected parties when compromise is suspected

Clients are more likely to follow a verification process when it is introduced early rather than presented as an unexpected closing-day obstacle.

Common Mortgage Wire Fraud Scenarios

Fake Title-Company Instructions

The buyer receives a professional-looking email with the correct property address and cash-to-close amount.

The account number is fraudulent.

The buyer should call the title company through a known number and read back every account detail before transferring funds.

Instructions Change on Closing Morning

An email claims that the title company’s original account is temporarily unavailable.

The buyer is told that closing will be cancelled unless funds are sent immediately to another bank.

Urgency and changed banking information are major warning signs.

The buyer should stop and independently contact the title company.

Criminal Enters a Real Email Thread

The buyer receives a reply inside a legitimate conversation involving the real estate agent and title company.

Because the criminal compromised one participant’s account, the email history appears authentic.

The buyer must still verify the bank information through a second communication channel.

Fake Bank Representative Calls

After sending fraudulent instructions, the criminal calls while impersonating a bank employee.

The caller asks the buyer to read back a security code or authorize the transfer.

The buyer should hang up and call the bank through the number on its official website, bank card, or statement.

Fraud Is Discovered After the Wire

The title company reports that funds never arrived.

The buyer should immediately contact the sending bank’s fraud department, request a recall, notify the transaction parties, preserve evidence, and report the incident to IC3.

Common Misconceptions

“The Email Included My Property Address, So It Must Be Real”

Criminals may obtain detailed transaction information from a compromised account.

Accurate property information does not authenticate the sender.

“The Message Came From an Existing Email Thread”

A real account may be compromised, or a criminal may imitate the thread.

Verify the banking information independently.

“My Bank Will Automatically Catch a Fraudulent Account”

A bank may not know that the transfer was induced by fraud.

The account and routing numbers may still be technically valid.

“Wire Transfers Can Always Be Reversed”

Recovery is not guaranteed.

Funds may be moved before a recall can be completed.

“Only First-Time Buyers Fall for Wire Fraud”

Sophisticated schemes can deceive experienced buyers, investors, attorneys, lenders, title professionals, and real estate agents.

“I Can Wait Until Tomorrow to Report It”

Time is critical.

Contact the bank and report the incident immediately.

Real Lender Perspective

Mortgage wire fraud succeeds because the fraudulent request often arrives when the buyer is expecting to send money.

The message does not always look suspicious.

It may use the correct names, closing date, property address, amount, and email history. The criminal’s goal is to make independent verification feel unnecessary.

That is why mortgage wire fraud prevention cannot rely solely on spotting bad grammar or an unfamiliar sender.

The protection comes from process:

Establish trusted contacts early
Verify instructions through a second channel
Read the account information aloud
Treat every change as suspicious
Confirm receipt after sending the funds

The strongest protocol assumes that any email account could be compromised.

Verification is not an accusation against the title company, lender, or real estate agent. It is a required safeguard for one of the largest transfers many families will ever make.

Who This Guide Is For

This guide may be especially helpful for:

Texas homebuyers
First-time buyers
Move-up buyers
Refinancing homeowners
Cash buyers
Real estate investors
Home sellers
Real estate agents
Mortgage professionals
Title professionals
Attorneys
Builders
Families providing gift funds

Final Thoughts

Mortgage wire fraud prevention requires a repeatable verification process—not confidence that you can recognize every fraudulent message.

Before sending closing funds:

Use a trusted phone number
Speak with a known representative
Confirm every banking detail
Question every change
Use a secure device
Verify that the title company received the funds

If a fraudulent transfer occurs, contact the bank immediately, request a recall, notify the title company and lender, preserve the evidence, and report the incident to the FBI’s IC3.

A few minutes of independent verification can protect a down payment, a home purchase, and years of accumulated savings.