You're three days from closing. An email lands from your title company. Subject line: "Updated Wire Instructions." The logo looks right. The tone sounds right. Someone signs it with a name you've been emailing for weeks.

You wire your down payment. It's gone in seconds. And it's not coming back.

That's closing day wire fraud, and it's not a rare horror story. It's a documented, growing category of crime with real numbers behind it, and this article is the full breakdown: how it works, what it actually costs people, and exactly what to do in the minutes after you realize something's wrong.

Run the math

In 2025, the FBI's Internet Crime Complaint Center (IC3) logged 12,368 real estate fraud complaints totaling $275.1 million in losses. According to an analysis of that data by title-fraud prevention company ClosingLock, real estate fraud complaints rose roughly 58% year over year. That's not a plateau. That's a category still accelerating.

Business email compromise (BEC), the broader scam family that closing wire fraud belongs to, is worse. BEC is when a criminal either hacks into a real email account or builds a convincing fake one, then uses it to trick someone into sending money somewhere it shouldn't go. In 2025 alone, BEC drove $3.04 billion in reported losses across all industries, and real estate closings are one of its favorite targets. Why? Because a closing has a big number, a hard deadline, and a pile of unfamiliar paperwork. That combination is exactly what makes people move fast instead of carefully.

Here's the real number that should worry a buyer specifically. CertifID's 2026 State of Wire Fraud Report (as of September 2026, citing 2026 data) found that buyer cash-to-close fraud, someone impersonating the title company to redirect the buyer's own down payment, accounts for 30% of reported cases, the largest single category. The median loss in those cases: $239,850. Mortgage payoff fraud, a related scam that hits sellers, carries an even higher median loss of $389,125. Seller net proceeds fraud sits at $343,497.

And this isn't a fringe risk. The same report found that nearly 1 in 4 homebuyers received a fraudulent or suspicious communication somewhere in their closing process. Run that against how many homes close in a given year, and you're looking at a genuinely common event, not an unlucky one.

Before we go further: figure out what your own cash-to-close number actually is. Buyers often picture only the down payment and forget the rest: prepaid taxes, insurance, lender fees. If you don't know your real total, HomeMath's Closing Costs Calculator will give you the number a fraudster would be trying to steal. Knowing it in advance makes a fake "updated total" much easier to spot.

How the scam actually works

It starts small. A criminal gets into an email inbox somewhere in the transaction chain (yours, your agent's, or someone at the title company's), often through a basic phishing link. Once they're in, they don't act right away. They read. They watch the thread. They learn the names involved, the closing date, the tone everyone uses with each other.

Then, right before closing, they strike. Sometimes they send from the real compromised account. Sometimes they spoof a lookalike domain: a title company's name spelled with one letter swapped, easy to miss on a phone screen. The email says instructions have changed. New account number. New routing number. Please confirm and send today, we're on a deadline.

It works because everything about it matches what you were already expecting. You knew a wire was coming. You knew the amount, roughly. The email arrives on the right day, from what looks like the right person, using details only someone reading your real thread would know. There's no crude "Nigerian prince" tell here. It's patient, quiet, and timed to your actual calendar.

A wire transfer, once it lands, moves differently than a check. There's no bank on the other end that can just bounce it back. The receiving account holder can pull the cash out (sometimes converted to cryptocurrency) within hours, sometimes faster. That's the mechanic that makes this scam so devastating: by the time you'd normally notice a problem, the money has often already left the account it landed in.

This article exists because "one of several closing day risks" isn't enough

HomeMath's Closing Day Playbook covers wire fraud as part of its full checklist — inspection surprises, funding delays, last-minute title issues, and yes, wire fraud, all in one pass. That's the right format for a complete closing-day rundown.

But wire fraud isn't just one item on a list. It's the single most expensive thing that can go wrong on closing day, and it deserves more than a paragraph. This piece is that deep dive. If you want the rest of the closing-day checklist too, that's what the Playbook is for — think of this as the chapter that got too big for the book.

The red flags: what to check before you wire anything

• Never trust a phone number or link in the email itself. Call your title company using a number from their actual website, a prior paper contract, or your agent's business card — not anything pulled from the message you're questioning.
• Treat any last-minute change to wire instructions as a red flag by default. Legitimate title companies rarely change account details days before closing. If they say they did, that's exactly when to verify hardest, not when to move fastest.
• Confirm through a second channel. If the instructions came by email, verify by phone. If they came by phone, verify by a callback to a number you already had on file, not one the caller just gave you.
• Ask your title company directly if they offer wire verification services. Many now use third-party confirmation tools (CertifID is one widely used example) that let you check an account number against a verified database before you send a dollar. See the Closing Day Playbook for the rest of the pre-wire checklist.
• Be suspicious of urgency. "Send today or the closing slips" is a pressure tactic. A real delay is an inconvenience. A rushed wire to the wrong account is a catastrophe.
• Double-check the sender's domain, letter by letter. Fraudulent domains often swap one character — an "m" for "rn," a zero for an "O." It's built to be missed on a phone.

A 2021 ALTA survey of nearly 550 title agents found that criminals attempted to redirect funds in about a third of all real estate and mortgage transactions — and succeeded in only about 8% of those attempts. That gap between "attempted" and "succeeded" is the whole point of this checklist. Verification works. A more recent ALTA-CertifID study found that in 2023, over 40% of title companies received at least one fraudulent wire-change email per month, and in 13% of surveyed firms, a customer actually sent money to a fraudulent account. The attempts are constant. Whether they succeed is mostly up to you.

If it already happened: every minute counts

If you've sent a wire and something feels wrong, stop reading and start calling. Here's what nobody tells you clearly enough: banks can sometimes claw a wire back, but the odds fall off a cliff fast. Matt O'Neill, former head of the U.S. Secret Service's Global Intelligence Operations Center, put it bluntly in comments to CertifID — the recovery success rate after the first 24 hours drops into the low single digits. This is not a next-week problem. It's a next-minutes problem.

• Call your bank's fraud department immediately and request a wire recall (sometimes called a SWIFT recall). Do this before you do anything else.
• Call the receiving bank too, if you can get the information, and ask them to freeze the account the funds landed in.
• File a complaint with the FBI's IC3 at complaint.ic3.gov. This isn't just paperwork — IC3 complaints feed the FBI's recovery process, and a fast filing genuinely improves your odds.
• Notify your title company and real estate agent right away. They may be dealing with the same compromised thread and can alert other buyers in progress.
• Contact local law enforcement and get a police report on record, which banks and insurers will likely ask for.
• Document everything with timestamps — screenshots of the email, the wire confirmation, every call you make and when.

The odds are not hopeless if you move fast. CertifID's Fraud Recovery Services team reported a 69% recovery rate across cases they worked in 2025, recovering more than $118 million for 773 victims. That number exists because those victims called immediately. Waiting a day, even a few hours, is the difference between a recoverable mistake and a permanent one.