You've saved for years, your loan is clear to close, and an email arrives with wiring instructions for your $47,000 down payment. You send the wire. Three hours later the title company calls: they never received it. The account belonged to a criminal in another state, and your money is gone.
How the scam works
Business-email-compromise fraud targets real-estate closings because the sums are large and the timeline is tight. Hackers monitor email traffic between buyers, agents, lenders, and title companies—often through compromised inboxes or spoofed domains that change a single character. Days before closing they send fraudulent wiring instructions that look identical to legitimate messages: correct logo, plausible signer name, professional tone. The routing and account numbers lead to a mule account that empties within hours. By the time anyone notices, the funds have moved offshore and recovery is nearly impossible.
The five-minute verification habit
One call stops most attacks. When you receive wiring instructions—whether in the initial closing-disclosure package or in a last-minute change—do not trust the phone number in the email. Open your browser, search for the title company's main number (or use the number on your settlement statement from an earlier, known-good document), call that number, and ask the operator to transfer you to your specific escrow officer. Read back the routing number, account number, and dollar amount. If any detail is wrong, the officer will correct it on the spot. If the email was fraudulent, you've just saved your down payment.
Never use a number embedded in an email, even if it matches prior messages. Never use reply-to addresses without independent confirmation. And treat any last-minute change in wiring instructions—especially one sent outside business hours or with urgent language—as guilty until verified by voice.
If a wire goes wrong
Call your bank immediately and request a recall. Speed matters: many mule accounts empty within six hours. File a complaint with the FBI's Internet Crime Complaint Center and notify your title company and lender in writing. Some victims recover partial funds if they act within the first business day; most do not. Homeowners insurance and wire-fraud insurance (if the title company carries it) sometimes cover losses, but coverage is inconsistent and claims take months.
The Alliance take
We tell every client the same thing during the week before closing: when the wiring instructions arrive, pick up the phone. Email is convenient; a five-minute call is safer. Title companies and lenders expect the verification call—it's a sign you're paying attention, not a nuisance. The criminals count on urgency and trust. You counter with one skeptical phone call to a number you found yourself. That habit has saved more down payments than any fraud-monitoring software.
Questions about your closing timeline or next steps? Start an application and we'll walk you through every verification checkpoint before you wire a dollar.