Tim Myers was about to close on a home in Fort Wayne, Indiana, when the email he’d been expecting popped into his inbox. His mortgage loan officer sent wire instructions for his down payment, along with a request to send the money in the next few hours. Myers and his wife went to their Flagstar branch and wired $34,000 to a Bank of America account.

Everything seemed fine — until the next day, when the title company handling the closing sent instructions for wiring the down payment through a secure portal. Myers called the company to say he had already sent the money.

Then came the awful news: He’d been scammed.

Fortunately, Myers was able to close on the property anyway, and eventually recovered the hijacked money. In many cases, victims of real estate escrow fraud never see their cash again.

How escrow wire fraud works

The FBI classifies escrow fraud as “business email compromise.” More than 21,000 such crimes were reported in 2023, with total losses of nearly $3 billion that year.

The amounts stolen can be devastating. In one example, the FBI reports that it helped a victim recover $426,000 wired for a home in Stamford, Connecticut, in 2023.

Scammers know a lot of money moves around in real estate transactions. At the time of closing, the buyer presents a down payment or even the entire purchase amount to the seller, a sum in the tens or hundreds of thousands.

Fraudsters look for a weak cybersecurity link somewhere in the transaction, typically affiliated with the real estate agent, loan officer, title company or closing attorney.

Then the hacking starts. Once scammers gain access to that person or entity’s online activity, they learn who’s about to buy a home. The buyer gets an email, phone call or text from someone purporting to be from the settlement attorney or title company with instructions about where to wire funds.

Signs of real estate wire fraud

• The email doesn’t quite match. Fraudsters often use Gmail addresses rather than addresses affiliated with a company domain. In one twist, the initial email address might look legitimate, but if you hit reply, you’ll see a different address for the recipient.

• The wire transfer instructions are in the body of the email, rather than in a secure portal.

• The email reads urgent or confusing. The scammer might insist that the wire transfer needs to happen immediately, or the instructions might contradict what your closing agent said would happen.

• The email contains odd formatting, grammar or spelling. If the email was from your mortgage loan officer or title company, it would be professionally written, with no strange spaces or wording.

• The scammer won’t take phone calls. Even if the email contains a phone number, the fraudster might claim they’re too busy to answer.

• You’re making a significant down payment. Scammers are more likely to target deals involving large down payments, and less likely to go after loans with zero or little down.

Take this one extra step

“It’s an overwhelming process, especially for first-time buyers,” says Diane Tomb, CEO of the American Land Title Association, who advises buyers to take the quick step of picking up the phone to verify the instructions before executing a wire transfer.

“ It sounds simple, but it’s not simple when you’re in the middle of it,” Tomb says.