Wire Fraud in Home Purchases

International buyers from the Middle East, China and Korea work with Mike Kobeissi’s firm; in any home purchase the down payment usually travels by wire in the days before closing. That transfer is the target of a scheme that follows a recognizable timeline. Some time before closing, a scammer sends phishing emails to the people handling a sale, such as agents and title officers; when one succeeds, the scammer can read the account and the transaction inside it, WPVI in Philadelphia reported.⁴ In the final days, as the buyer waits for instructions, a message arrives that looks exactly like the earlier ones, with the same signature and a friendly note, but carries new wiring details. The buyer sends the money. A day or several days later the real escrow or title office asks where the funds are, and the buyer learns that they went to an account the scammer controls.¹⁴

Figure

How a diversion scheme unfolds

1. 01
   PhishingScammers send phishing emails to brokers and title companies.
2. 02
   AccessA successful phish opens the email account and the transaction details inside it.
3. 03
   Lookalike addressThe scammer creates an address that closely resembles the official one.
4. 04
   Display nameEmail settings show the agent's or title officer's name instead of the real address, sometimes with a copied signature.
5. 05
   New instructionsThe buyer receives wiring instructions that send the money elsewhere.
6. 06
   Funds moveThe recovery window that once ran 48 to 72 hours has shrunk, with money moving within 24 hours or faster.

How the scheme unfolds

The general name for this fraud is business email compromise. ABC News, citing the Federal Housing Finance Agency, describes it as a scheme in which criminals spoof or use compromised email accounts of financial institutions, businesses and other organizations to get victims to send money or share sensitive information.³ In a home purchase the impersonated party is usually someone the buyer has already been writing to: the escrow officer, the title company, the lender or the agent. Kiplinger’s 2025 guide notes that real estate agents are the most commonly impersonated professionals, and that a payment sent to a scammer early may go unnoticed until the parties meet for closing.⁶

The disguises are small. In the case ABC News reported in 2026, a Southern California couple received a message that matched their earlier correspondence except for one keystroke: the sender’s domain replaced a w with two v’s.³ A Denver couple, CBS News reported, found themselves in a real time exchange about closing costs inside an email chain the scammer had copied from a genuine conversation between their lender and their title company, from an address a few letters off the original; they lost more than $30,000.² A federal financial investigator described to WPVI a display name tactic, in which email settings show the name of a realtor or title agent rather than the address actually used, and noted that scammers sometimes paste genuine email signatures into the messages.⁴ The same investigator said the networks behind these schemes operate across many countries, and that such requests often come just before a weekend, when buyers are busy and trying to finish tasks.⁴

Speed decides most outcomes. The WPVI investigator said the window that used to run 48 to 72 hours had shrunk, with funds now moving within 24 hours or faster.⁴ In Southern California, NBC Los Angeles reported on a West Hills couple who wired a $160,000 down payment after an email that appeared to come from their escrow agent; a security expert suggested the escrow company’s own email system had probably been breached, perhaps through an employee’s mistake.¹ According to FBI data cited in the same report, losses to business email compromise, a category that includes down payment wires, reached $3 billion in 2022.¹ CBS News cited FBI figures showing Coloradans lost more than $57 million to such schemes in 2023, with real estate one of the targets.² The industry view is no gentler. The 2025 study Kiplinger summarized estimated that the property trade loses $500 million a year to these schemes, that 52 percent of buyers and sellers were unaware of wire fraud, that a quarter were targeted during closing, and that one in twenty fell victim.⁶

Figure

Wire fraud in figures, 2025 industry study

Lost across real estate each year to business email compromise

$500 million

Buyers and sellers unaware of wire fraud

52 percent

Buyers and sellers targeted by a scammer during closing

25 percent

Buyers and sellers who fell victim

1 in 20

Defenses and what remains unsettled

The standard defense is a telephone call, and it works because the scheme lives inside email. An NBC Bay Area investigation described impostors posing as real estate salespeople, title agents and mortgage brokers, slipping into email chains, mimicking an agent and then moving the money offshore and vanishing.⁵ Report after report gives a version of the same advice: confirm wire instructions by voice with someone the buyer already knows, using a number the buyer already has, never one supplied in the email that carries the instructions.¹⁶ NBC Los Angeles added that when an email says to call for instructions, the number dialed should be one the buyer already knows, and that financial information should never travel by email.¹ A cybersecurity professor told CBS News that closings draw scammers because so much money is involved, and that he trusts almost no email and makes a call before he wires money.² The Denver case shows why the call has to go outside the thread: the couple’s financial adviser did check before sending, but by forwarding the scammer’s own email chain for review, and the transfer was approved.² The National Association of Mortgage Brokers’ president put it as picking up the phone before sending anything, to the broker, the agent or both.³ Kiplinger adds that funds should go only to accounts the buyer can independently confirm with the escrow or title company, and that emailed instructions should never be relied on alone; email addresses and phone numbers both deserve a careful look.⁶ WPVI’s guidance is to verify the payment process itself with the closing agent and the other parties involved, and CBS News pointed to conversations with the agent or title company by phone or in person as one way to stay protected.⁴² The NBC Bay Area series carried the bluntest version of the warning from agents and the FBI: California buyers and sellers should assume they will be targeted.⁵ Caution afterward counts as much as caution before. The investigator quoted by ABC News stressed recognizing the fraud quickly and acting at once.³

Figure

Genuine and fraudulent payment instructions

	What the genuine process looks like	Warning signs of a scheme
Addresses	The same email address and web address throughout	A near match, or a display name hiding a different address
Process	The method of sending money never changes	A late email telling the buyer to send money differently
Confirmation	A call to the title company before any transfer	Reliance on the email alone

Other checks are mechanical. WPVI’s list advises reading every email and web address in a request for money, noting that addresses can display differently on phone and desktop browsers, and treating any change in how money is to be sent before closing as a red flag, since the process should never change.⁴ When a transfer has gone wrong, the same report advises calling the bank at once so that officials can try to recover the funds.⁴ Recovery is possible but rare. The couple in the ABC News case acted quickly, investigators traced the money, and after several months they recovered about 90 percent; the rest had been converted to cryptocurrency and was gone.³ In the Kiplinger study, 27 percent of those defrauded could not recover their money at all.⁶

Several questions remain open. The first is who bears the loss. The West Hills couple closed only by borrowing from a relative, and NBC Los Angeles noted that the professional liability coverage many escrow companies carry does not extend to wire fraud.¹ The Denver couple’s claims were denied by both firms involved.² A second is the industry’s own security. An NBC Bay Area investigation found that most local agents it examined still used personal email accounts of the kind the FBI says are easy to exploit, and asked why the trade had been slow to adopt tighter tools, such as secure systems for holding and confirming funds.⁵ A third is that professionals are targets too. Kiplinger reported that closing agents sometimes receive fraudulent payoff instructions that appear to come from a mortgage lender or bank, and that some skip the extra verification step when it takes too long, sending funds to scammers instead.⁶ A fourth is education. Kiplinger reported that fewer than half of buyers and sellers receive fraud warnings from their agents in initial meetings, and called prevention a shared responsibility of agents, title companies and others in the transaction.⁶ For buyers abroad the stakes rise with distance, because the signing itself often moves online, the subject of the entry on remote closings and notarization; the wider pattern of foreign purchases is traced in international buyers in US housing. Questions about how the money in a particular purchase should be handled belong with the buyer’s escrow holder, bank and own advisors.