Real estate closing wire fraud

What it is

A home purchase moves in slow motion for months, an offer, an inspection, a loan approval, right up until the very end, when a genuinely large sum of money has to move in a single wire, on a specific day, to a specific account. That one moment, the closing, is the entire target.

A criminal who has compromised or spoofed the email of a buyer, a seller, a real estate agent, an attorney or a title company watches that transaction approach its closing date, then sends new wiring instructions just before the deadline. The email looks right because, in the worst cases, it genuinely is the real account, taken over outright rather than merely imitated. The buyer wires a down payment, closing costs or the full purchase price, sometimes their entire life savings, straight to an account the criminal controls.

The FBI treats this as its own named category: real estate wire fraud (REWF), a sub-category of the broader business email compromise threat, specific enough that Congress required the Bureau to report on it separately. In 2025 alone, IC3 logged 12,368 real estate fraud complaints and over $275 million in reported losses, up from about $173 million the year before.

How it actually works

1. Finding the deal

   Phishing emails target real estate businesses, title companies, law firms, agents, sometimes a buyer directly, aiming to steal the login credentials to a real email account rather than just guess at one.

2. Reading the mailbox

   Once inside, the criminal does nothing visible. They read ordinary email traffic for as long as it takes to find a transaction with a closing date and a dollar figure worth the risk.

3. New instructions, right on schedule

   A message arrives with updated wiring details, timed to land exactly when a legitimate wire instruction was already expected, from an address that is either a near-perfect lookalike or, in the most damaging cases, the real compromised account itself.

   Where it could have stopped

   A single phone call to a number obtained before this email arrived, not one supplied inside it, would have caught the fraud before any money moved. Every government and industry source on this page gives the same single piece of advice, because it is the one step the scheme cannot survive.

4. The wire leaves

   A down payment, closing costs, or the full purchase price, often a buyer’s entire life savings, is sent by wire transfer, a payment method with no chargeback and no multi-day hold once it clears.

5. Mule accounts, then gone

   The funds land in a domestic account opened specifically to receive a deposit like this one, then are withdrawn as cash or moved on to a second account, often overseas, within hours.

6. Discovery, usually too late

   The fraud is typically discovered only when the real title company or seller confirms the wire never arrived, often days after the money was already gone.

7. Enforcement, if it comes

   In the small number of cases that reach a US courtroom, sentences have run into decades. Most of the wider network behind any one case, frequently based overseas, is never identified or caught.

Why it works

The deadline is real and the urgency is genuine. A closing has an actual date, and a request to wire money at exactly that moment is not, on its face, an unusual thing to be asked. The scam borrows a legitimate deadline rather than inventing a fake one.

A wire has no undo button. Unlike a card payment, a wire transfer clears quickly and carries no chargeback right. By the time anyone notices something is wrong, the receiving bank may have already released the funds.

Most buyers do this exactly once. A homebuyer has no prior experience of what a real closing instruction looks like, no pattern to compare the fraudulent one against, and often no one beside them who does either.

The compromise can be the real account. This is not always a convincing fake; sometimes it is the actual mailbox of the actual title company, taken over outright, so there is no domain, signature or past-conversation thread to catch the fraud by.

And the money moves faster than the realisation does. The FBI’s own account of how these funds travel describes rapid withdrawal or onward transfer within hours, specifically to outrun the window in which a bank could still act.

Where it comes from

A named FBI threat category, not a fringe variant, with both an international criminal network behind most cases and, occasionally, someone already inside the transaction.

The FBI calls real estate wire fraud a sub-category of business email compromise, and tracks it closely enough that a 2022 congressional reporting requirement produced a dedicated report. The Bureau’s own account traces aggregated BEC losses back to 2016, when IC3’s annual report first logged $360 million in a single year; by 2021 that figure had grown to $2.4 billion across all BEC schemes.

Enforcement has run large, multi-country takedowns. Operation Wire Wire (2018) and Operation reWired (2019) led to over 280 arrests across the United States, Nigeria, Turkey, Ghana, France, Italy, Japan, Kenya and the UK, and recovered roughly $118 million in fraudulent wires; Operation Eagle Sweep (2021 to 2022) added 65 more arrests across the US, Nigeria, South Africa, Canada and Cambodia.

Most documented criminal cases involve an outside network, not an inside job. Kolade Ojelade and Babatunde Ayeni, the two largest cases on this page, both operated from the UK with co-conspirators in Nigeria, targeting US title companies and real estate businesses from thousands of miles away.

But the same tactic, a fake lienholder email changing payoff instructions, has also been run by someone already inside the transaction. Mayela Cantu, an escrow officer at a Texas title company, directed others to set up a fraudulent lienholder email address and used it to redirect over $350,000 the title company itself was due to pay out, an insider variant of the identical core deception.

Real cases

Red flags

• Any change to wiring instructions received by email, no matter how official it looks or how closely it matches a conversation already underway.
• A request arriving at exactly the moment a wire was already expected, which is the scheme’s deliberate design, not a coincidence that makes it less suspicious.
• A sender address that is almost, but not quite, right, a single swapped letter, a different domain ending, or an extra word.
• Urgency or pressure to wire immediately, often citing a deadline that cannot wait for a phone call.
• A phone number supplied inside the same email or text asking you to “confirm” the new instructions, rather than one you already had.
• Being asked to wire to an account under a different name than the title company, escrow agent or law firm you have been dealing with.

If it’s happening to you

Call your bank immediately if you have already sent a wire, and ask them to request a recall. Speed is the only thing that works here.

1. Do not call any number provided in the suspicious email or text. Use a number you already had before this transaction began, from a business card, a signed contract, or your own prior records.
2. Call your title company, escrow officer, agent or attorney directly to confirm whether the new instructions genuinely came from them.
3. File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov as fast as possible. The Bureau’s own Recovery Asset Team has had its best results when a complaint arrives within 24 to 72 hours of the wire; after that, the money is usually gone.
4. Report it to the FTC at ReportFraud.ftc.gov as well. See where to report for other countries.
5. Keep every email, including headers, and every confirmation your bank has sent you. You will need these for both the bank’s investigation and any law enforcement follow-up.
6. Tell everyone else still in the transaction, your agent, attorney, lender and the seller, since the same compromised mailbox may already be targeting more than one closing.

Where the money goes

Fast, deliberately, and usually through at least one domestic account before anything crosses a border.

The FBI’s own description of how business email compromise proceeds move is specific: funds are typically directed first to a fraudulent domestic account, then rapidly depleted through cash or check withdrawals, or transferred again to a second domestic or international account, precisely to outrun the short window in which a wire recall can still work. Money mules, some knowing and some not, carry out the physical movement; the FBI distinguishes unwitting mules, often victims of an unrelated scam themselves, from the much smaller number of people who do this knowingly for a fee.

The scale of the network behind any single stolen wire is visible in the enforcement statistics, not the case itself: Operation reWired alone led to arrests in six countries beyond the United States. A homebuyer who loses a down payment this way is rarely looking at a single thief, but at one node in an operation built specifically to move stolen wires out of reach before anyone can act.

By the numbers

No published dataset breaks this scheme out as its own category yet, so there is no chart to show. The data page explains which agency categories exist and why some schemes are invisible in official statistics.