Real estate wire fraud: what to do if your closing funds went to a scammer
The email came from the title company, or looked like it did. It arrived a day or two before closing, said the escrow account had changed, and included fresh wiring instructions. Everything about it fit the conversation you had already been having for weeks. You sent the down payment, and then someone at the closing table asked why the funds had not arrived.
Real estate wire fraud is one of the few crimes where the amount at stake is often someone’s entire savings, and where the timeline for doing something about it is measured in hours rather than weeks. If you are reading this today, the most useful thing on this page is the next section. Start there, and come back for the rest.
Call your bank now and ask for a wire recall
Call the bank that sent the wire, not the branch’s general line if you can avoid it, and ask specifically for the wire department or the fraud department. Use the words “fraudulent wire transfer” and “wire recall request.” What you are asking them to do is contact the receiving bank and request that the funds be held. Banks can do this, but they cannot do it retroactively once the money has been pulled out or moved on, which is usually the point of the exercise for the people on the other end.
Ask the bank for the full wire details in writing while you are on the phone: the date and time it was sent, the amount, the receiving bank’s name, the beneficiary name and account number, and any reference or IMAD number. You will need all of it for the next step, and it is much easier to get now than in a week. If the wire went out on a Friday afternoon or before a holiday, call anyway and leave a documented request. The clock does not pause for the weekend, and neither should your paper trail.
File with IC3 the same day, and say it was a real estate wire
File a complaint at IC3.gov as soon as you have the wire details, ideally the same day. This is not the same as a general fraud report that disappears into a database. The FBI runs a Recovery Asset Team that reviews qualifying complaints and contacts the receiving financial institution to request a freeze on the account. The team reports recovering a substantial share of funds when the fraud is reported within roughly 72 hours of the transfer, and the recovery rate drops off sharply after that. There is also a separate process, the Financial Fraud Kill Chain, aimed at larger international wires within a similar window.
You do not need to work out which process applies to you. What matters is that your complaint arrives quickly and contains the transaction detail the team needs to act on: exact amount, date, both banks, the beneficiary account, and a short factual description that says the wire was for a real estate closing and the instructions were fraudulent. Vague complaints and late complaints are the two things that most often close the door.
Then call everyone in the closing chain
Tell the title or escrow company, your real estate agent, your lender, and your attorney, in whatever order you can reach them. Two things come out of this. The first is practical: the closing needs to be paused before anyone assumes the money arrived. The second matters more in the long run. The fraudulent instructions almost always came out of a compromised email account somewhere in the transaction, and it is frequently not the buyer’s. Someone had been reading the thread long enough to know the closing date, the amount, and how the parties write to each other. If that inbox belongs to the title company or the agent, other clients are exposed right now, and only the account holder can shut it down.
It is also worth checking your own side. If your email was the compromised one, the intruder may still be sitting in it with forwarding rules quietly hiding replies, and our guide on what to do if your email account was hacked walks through how to check for that and lock it out. Whoever’s account it was, the general steps for a wire sent to a scammer apply here too.
Save the emails properly, not as screenshots
The single most valuable piece of evidence is the original fraudulent email with its full headers intact, because the headers show the sending path and often the lookalike domain used to imitate the real sender. A screenshot of the message body loses all of that. Most email clients let you save a message as a .eml or .msg file, or show the original headers under an option like “show original.” Do that for the message with the wiring instructions and for the legitimate emails around it, and keep them somewhere outside the affected mailbox. Our guide on preserving evidence in the first 24 hours covers the wider version of this.
Keep the bank paperwork too, including your written recall request and any reference number they give you. If there is a later argument about who was negligent, and in these cases there often is, the timeline of what you did and when will do more for you than anything else.
The offer to get it back for a fee
In the weeks after a large loss, people tend to hear from someone who says they can trace and return the funds for an upfront payment. Real recovery in a wire fraud case comes through the banks, the FBI, and, if it comes to it, litigation between the parties and their insurers. It does not come from a stranger who found you and asks to be paid before doing anything. We wrote about how to tell the difference in is that recovery service legit, or another scam, and the same tests apply whether the loss was crypto or a bank wire.
One last thing worth saying plainly. Falling for this does not mean you were careless. These emails are written by people who have been reading your transaction for weeks and who send them at the exact moment a change in wiring instructions would seem ordinary. The habit that defeats it is simple and worth keeping for the rest of your life: never wire funds on instructions that arrive by email, and call the escrow officer on a number you already had to read the account details back to them before you send anything.
— Gus