How to Trace a Real Estate Wire-Transfer Scam

Real estate wire fraud is a form of business email compromise, and it is patient and surgical. Long before you ever see a fraudulent message, a criminal has gained access to an email account somewhere inside your transaction, most often by phishing a real estate agent, a title or escrow officer, a closing attorney, or a lender, or by spoofing a domain so closely that the address looks identical at a glance. From inside that mailbox, the attacker reads quietly for days or weeks. They learn the closing date, the property address, the exact dollar amount due, the names of everyone involved, and the polite, professional tone the real escrow officer uses. They are building a forgery you will have no reason to doubt.

Then comes the strike, timed for the worst possible moment. A day or two before closing, when emotions and deadlines are highest, you receive an email that appears to come from your title company or attorney saying the wiring instructions have changed, or that there is a new account for the deposit, or a last-minute correction to the routing and account number. Sometimes the message even switches the payment method, pushing you from a cashier’s check to a wire. The bank name and account number belong to the criminal. Because the email matches the thread, the names, and the timing of a transaction you are desperate to complete, you wire your down payment, your closing costs, or your entire purchase to a stranger. The same playbook hits the other direction too, as mortgage-payoff and seller-proceeds fraud, where it is the funds leaving escrow that get diverted.

The Federal Bureau of Investigation tracks this as one of the costliest crimes it sees, with real estate fraud losses reaching into the hundreds of millions of dollars a year across thousands of complaints, and losses in real-estate business email compromise climbing sharply over recent years. The dollar figures are large because closing wires are large. That is exactly why the response has to be fast and exactly why identifying the human behind the account matters so much.

A sent wire is not gone the instant it leaves, but it can be within a day or two. If you act fast, your bank may be able to recall it before the criminal drains the mule account, and the FBI’s Recovery Asset Team can run the Financial Fraud Kill Chain to ask the receiving bank to freeze the balance. File the federal complaint at the FBI Internet Crime Complaint Center the moment you suspect fraud, because that filing is what activates the Kill Chain on a domestic closing wire. Do these steps in parallel, not one after another.

The money trail. Your diverted closing wire almost never sits still. It lands first in a money-mule account, often opened by a recruited individual in the United States, and is then pulled out in cash, pushed to other accounts, or converted to cryptocurrency to break the chain. Your bank’s recall and the FBI’s Kill Chain race against exactly that movement, trying to reach the receiving bank while the balance is still there. When the funds can be frozen, the receiving bank can be compelled through law enforcement to identify the account holder. That part is the bank-and-FBI lane, and it is why reporting fast and in detail matters so much. Our role on this side is supportive: organizing the wire identifiers, the receiving account details, and the timeline so the recall and the federal complaint are airtight.

The human trail. This is the lane the title-insurer blogs and the wire-verification vendors do not work, and it is where People Locator Skip Tracing fits. Behind the fraudulent account are real people who leave real footprints. The money-mule account had to be opened by someone with a name, an address, and a history. The spoofed domain was registered somewhere. The phone number used to push the last-minute change traces back to a carrier and, often, an identity. Even when the email display name was a perfect forgery, the underlying sender, the registration data, and the contact details are identifiers that can be researched lawfully through public records and skip-tracing techniques. That is the same work behind our wire-transfer scam investigation service and our guides on finding someone who scammed you and how to identify a scammer by phone number. A named, located person changes the case entirely: it strengthens your IC3 report, gives a prosecutor or your attorney a concrete target, and opens the door to a civil claim that bank records alone cannot support. For the broader method, see our overview of how to investigate fraud.

Closing wire fraud only works when the victim trusts an email over a phone call, so the defense is simple to state and powerful in practice: verify wiring instructions by voice before every transfer, using a phone number you obtained independently, from the signed contract, a prior statement, or the company’s published number, never the number in the email asking you to wire. Confirm the receiving bank, account number, and beneficiary name out loud, and confirm again on the day you wire. Treat any last-minute change to instructions as fraud until a live phone call proves otherwise, and remember that legitimate escrow instructions rarely change at the eleventh hour.

Build in a few more layers. Be deeply skeptical of a sudden switch from a cashier’s check to a wire. Ask your title company in advance how they deliver wiring instructions so a surprise stands out. After you send a wire, call within a few minutes to confirm the funds arrived in the right account, because catching a misdirected wire in the first hour is the difference between a recall and a loss. Use email accounts with strong, unique passwords and multi-factor authentication, since the compromise that starts these frauds often begins with a phished mailbox. None of this is glamorous, but it is exactly the routine that defeats a scheme engineered to exploit one moment of misplaced trust.

Closing wire fraud runs on the same rails as other targeted scams, so the people behind it surface through the same lawful research that powers our full-spectrum skip tracing work. Send us what you have, even if it feels like nothing: the receiving account name and number, the fraudulent email and its headers, a phone number the criminal used, a lookalike domain, or the name that appeared on the instructions. We work strictly for lawful, permissible purposes, we never promise a recovery we cannot control, and we tell you honestly what the records can and cannot show. For a legitimate matter, an initial locate typically comes back within 24 hours.