Every Texas residential closing has at least one moment where a buyer, seller, or agent moves real money — earnest money to escrow, or final proceeds at closing — based on instructions that arrived by email. Criminals know this. Business email compromise (BEC) — the scam where a fraudster impersonates a title company, lender, or agent to redirect a wire — is not a rare, exotic threat. It's the second-most financially destructive form of internet crime tracked by the FBI, and real estate transactions are one of its most consistently targeted categories.
This guide covers how the scam actually works, the real statistics (and the wrong statistic that keeps circulating), and the specific steps to prevent it — plus exactly what to do in the first hour if a wire already went to the wrong account.
How the scam actually works
The mechanics are almost always the same, whether the target is a buyer, a seller, or the escrow officer at the title company:
- The criminal gets access to a real inbox — or convincingly spoofs one. Often it's the title company's, the lender's, or the real estate agent's email account, compromised through a phishing link or a reused/leaked password. Sometimes it's not a hack at all — just a look-alike domain (
titlecompanytx.comvstitle-companytx.com) that's easy to miss on a phone screen. - The criminal watches and waits. Real estate transactions are unusually public. The property address, the closing date, the agents' names, and sometimes even the sale price are visible in MLS listings, county records, and social media posts. A patient scammer doesn't need to hack anything to know a closing is coming — they just need to be watching.
- The criminal sends new wiring instructions at exactly the right moment. Usually 24-72 hours before closing, an email arrives — appearing to come from the title company or lender — saying wiring instructions have "changed" due to a new escrow account, a merger, or a routine update. It looks identical to prior correspondence because it's often a reply within an existing, real email thread the criminal has been silently monitoring.
- The money moves — and it's gone in minutes. Wire transfers are designed to be fast and largely irreversible. Once funds land in the fraudulent account, they are typically moved out again within minutes or hours, often through several accounts or converted to cryptocurrency, making recovery a race against the clock.
The real statistics — and the one that's wrong
A statistic gets repeated constantly in real estate industry coverage: "the FBI's IC3 reported $275.1 million in real estate fraud losses across 12,368 complaints." That number is real — it comes directly from the FBI's Internet Crime Complaint Center (IC3) 2025 Annual Report. But it is describing the wrong crime.
IC3's own "Real Estate" category is a catch-all for property-related fraud broadly — rental scams, timeshare scams, fraudulent listings, investment-property schemes. It is not the category that captures closing-wire fraud. The category that actually does is Business Email Compromise — and its numbers are far larger:
| IC3 2025 category | Complaints | Reported losses | What it actually measures |
|---|---|---|---|
| "Real Estate" (often miscited) | 12,368 | $275,110,419 | Rental scams, timeshare fraud, fake listings, investment-property fraud |
| Business Email Compromise (the correct category) | 24,768 | $3,046,598,558 | Spoofed emails redirecting wires — including closing/escrow wire fraud |
BEC losses were the second-highest loss category of any crime type IC3 tracked in 2025, behind only investment fraud. And within BEC complaints specifically, IC3's own transaction-type breakdown shows wire transfer or ACH was the payment method in 86% of cases — by far the dominant way BEC victims actually lose money. That 86% figure is the real reason wire fraud and BEC are effectively the same conversation at a closing table.
Where real estate ranks among BEC targets
FinCEN — the U.S. Treasury's financial crimes unit — has separately analyzed which industries BEC criminals target most. Per FinCEN Advisory FIN-2019-A005, the top three targeted sectors are manufacturing and construction (25% of reported BEC cases), commercial services (18%), and real estate (16%) — roughly one in six BEC schemes. FinCEN's analysis specifically calls out real estate transactions as "a particularly lucrative target" because of the large dollar amounts involved and the industry's heavy reliance on email for communicating instructions between buyer, seller, agents, lender, and title company.
Preventing it: the rule that stops almost every version of this scam
Nearly every successful wire fraud case shares one root cause: someone acted on wiring instructions received by email without verifying them by phone, using a number they already had — not a number provided in the suspicious email itself.
- Verbally verify every wiring instruction, every time — no exceptions for "the second time." Even if you spoke to the title company yesterday, call again today if a change shows up. Criminals count on "I already verified this once."
- Use a phone number you already have — never one in the email. Look up the title company's number from their website, a prior invoice, or your own contacts. A fraudulent email will often include a phone number for you to call — that number rings the scammer, not the title company.
- Treat any "updated" or "corrected" wiring instructions as a red flag by default. Legitimate title companies rarely change escrow accounts mid-transaction. A change request close to closing is one of the single strongest fraud indicators.
- Send a small test wire first on large transactions when possible. Confirm the receiving account is correct before moving the full balance.
- Watch for urgency and pressure. "Wire today or the closing will be delayed" is a scammer's favorite sentence — real title companies rarely create that kind of same-day pressure over a routine wire.
- Inspect sender domains closely, especially on a phone. Look-alike domains that swap a letter, add a hyphen, or use a different top-level domain (
.netinstead of.com) are common and easy to miss on a small screen.
Texas's own regulator has been warning about this since 2019. TREC's consumer alert on wire transfers is direct: "Consumers should not rely on instructions sent by email without contacting their broker or sales agent to verify the instructions are correct, since emails may be hijacked by potential scammers." That's the whole guide in one sentence — verify by voice, using a number you already trust.
If money already went to a fraudulent account: the first hour matters most
Wire fraud is time-sensitive in a way few other crimes are — funds are often moved out of the fraudulent account within minutes to hours. Speed of reporting is the single biggest factor in whether any money is recoverable. This sequence, adapted from the American Land Title Association's Rapid Response Plan for Wire Fraud Incidents, is the order to work through immediately:
- Call your bank's fraud department immediately — not email, call. Request a wire recall and ask the bank to initiate the FBI's Financial Fraud Kill Chain, a rapid-freeze process available specifically for time-sensitive wire fraud.
- Call the receiving bank's fraud department too. Tell them a fraudulent wire landed in one of their accounts and ask them to freeze it. Every party who has relevant information should be coordinating with both banks at once.
- Notify everyone else in the transaction by phone, using known numbers. Buyer, seller, both agents, the lender, and the title company all need to know immediately — and all future communication in that transaction should move to verified phone numbers only until the situation is resolved.
- File a complaint with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Have transaction details, account numbers, and — if this was a spoofed email — copies of the email headers ready.
- Report it to local law enforcement and your local FBI field office. Ask the field office to help initiate the Financial Fraud Kill Chain if the bank hasn't already.
- Loop in the title company and your broker immediately if you haven't already. They may have their own fraud-response protocol and insurance carrier to notify.
- Document everything as you go. Who you called, when, what they said. This record matters for recovery efforts and any insurance or legal claims that follow.
What agents can do before a closing ever reaches this point
The prevention habit that matters most is procedural, not technical: build a standing rule with every client that no wiring instructions get acted on without a phone call to a number you already have. Say it explicitly, early, in writing — most title companies now include a wire fraud warning notice in their closing packet for exactly this reason. Reinforce it verbally too. The few extra minutes a verification call takes are nothing compared to the alternative.