Scam library · Banking & payment apps · Email & phishing · Small business
Real estate closing wire fraud: changed wire instructions
You're about to close on a home. An email that looks exactly like your title company, lawyer or real estate agent says the wiring instructions have changed. Please wire your down payment to the new account today.
Scammers break into email accounts of agents or title companies and watch real transactions. When the timing is right, they send fake instructions, sometimes from a lookalike address.
What the message looks like
From: Sarah Klein, Escrow Officer <s.klein@titlecompany-closing[.]com>
Subject: RE: Closing Friday, updated wire instructions
Hi, due to an audit our wiring instructions have changed. Please use the account below for your closing funds of $86,400.
Bank: Example National Bank · Routing: 000000000 · Account: 000000000. Please confirm once sent today.
How this scam works
Because the email is part of an ongoing thread with real names and dates, it looks perfectly normal. Once the money is wired to the scammer's account, it's often moved within hours.
This type of attack is part of what the FBI calls business email compromise, which cost $3.05 billion in reported losses in its 2025 Internet Crime Report. Real estate transactions are a frequent target because the amounts are large.
Sellers are targeted too: scammers can pose as the seller and ask the title company to send sale proceeds to a new account. Agree on a verification process with everyone involved before closing week.
Red flags
- Wiring instructions changed by email.
- An email address with a slightly different domain.
- Pressure to wire today, or 'don't call, I'm in meetings'.
- A new bank name or a different location than before.
- Unusual phrasing or a change in the signature.
How to tell it’s fake
- Call your title company or agent using a phone number you got at the start of the transaction, not from the email.
- Ask your title company at the start how it will deliver wiring instructions and whether it ever changes them.
- Verify the instructions verbally before every wire.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you haven't wired yet, stop and call your title company on a known number.
If you paid
- Call your bank immediately and ask them to recall the wire. Report to ic3.gov right away; the FBI may help freeze funds when reported quickly.
If you shared personal info, a password or a code
- If you shared account details, tell your bank and change your email password.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer and reads payment emails you have open in Gmail or Outlook on the web. It flags changed bank details, lookalike sender domains and pressure to wire today, and reminds you to call on a known number. When an email seems legit, that phone call is the step that saves your down payment.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Do title companies change wiring instructions by email?
- Reputable ones rarely do. Always verify by phone using a number you got at the start.
- What should I do right after a fraudulent wire?
- Call your bank to recall the wire and report to ic3.gov immediately.
- Can the FBI freeze my money?
- Sometimes, if it's reported fast. The sooner you act, the better the chance.