Business email compromise at a title company: the first 60 minutes

In the first hour after a title company discovers a fraudulent wire or a compromised mailbox, the order is: stop the money, report it, lock the mailbox, preserve the evidence, then tell the people who need to know. Speed decides how much money comes back. Print this and put it next to the wire desk.

The numbers explain the urgency. The FBI’s 2024 Internet Crime Report logged 21,442 business email compromise complaints and $2.77 billion in BEC losses in 2024, out of $16.6 billion in reported losses across 859,532 complaints. Coalition’s 2026 Cyber Claims Report found that BEC and funds-transfer fraud made up 58% of all claims on 2025 policies, that 52% of funds-transfer-fraud claims began as BEC, and that the average claim was about $116,000. Title and escrow sit in the middle of that: large wires, predictable timing, and a chain of parties who all email each other.

The scenario: Harbor Title, Thursday 2:10 pm

Harbor Title is a 14-person title and escrow company on Microsoft 365 with Qualia. Escrow officer Maria is closing a residential purchase. At 2:10 pm the buyer’s agent calls: the buyer wired the cash to close on Tuesday, to the “updated” instructions that arrived from Maria’s address on Monday. Maria never sent them. Her mailbox has been read for at least a week. The hour starts now.

Minute 0 to 10: stop the money

• Maria calls Harbor Title’s bank fraud line and requests a recall of the wire, with the reference number, amount, date and beneficiary account from the buyer’s confirmation.
• A second person calls the receiving bank’s fraud department directly and asks them to freeze the beneficiary account. Make both calls in parallel; do not wait for one bank to call the other.
• Ask the buyer to call their own bank and request the recall from the originating side. The buyer is the originator, so their request carries the most weight.

Minute 10 to 20: report

• File at ic3.gov and call the local FBI field office. Ask whether the wire qualifies for the Financial Fraud Kill Chain, IC3’s process for freezing funds through the banking network; it has thresholds on amount, destination and time since the wire, and the window is measured in days, so file within the hour even if you are unsure. The FBI’s September 2024 public service announcement put reported exposed BEC losses at $55.5 billion between October 2013 and December 2023; the recall process exists because some of that money is recoverable in the first days.
• Notify the E&O and cyber carriers under the policy’s notice terms, by the method the policy names, and write down the time and the claim number. Late notice gives a carrier a reason to contest the claim.
• If Harbor Title’s underwriter requires notice of a security incident, send it now, before the facts are complete. A second notice later is fine; a late first notice is not.

Minute 20 to 40: contain the mailbox

• Reset Maria’s password and re-enrol MFA from a device you trust; revoke every active session and app password; sign out all devices.
• Open the mailbox rules. Attackers add a rule that forwards to an outside address, or moves replies containing “wire” or “closing” to an obscure folder so the victim never sees the real conversation. Export the rule list first, then delete the rules.
• Check mail forwarding at the account level and in the admin console, not only in Outlook, and check for third-party apps granted access to the mailbox.
• Check the DMARC reports for your domain for the last two weeks. If the fake instructions came from a lookalike domain rather than Maria’s real address, record the domain. If they came from the real address, the attacker used Maria’s account and DMARC would not have stopped it. DMARC setup →
• Pull the audit trail: everything sent from the mailbox in the last 30 days, to whom, and whether it was opened. Export the recipient list; every one of them may have received fake instructions.

Minute 40 to 60: preserve and communicate

• Put a legal hold on Maria’s mailbox and on the shared escrow mailboxes, by person and by date range, so nothing ages out or gets deleted during the investigation. Do not delete the phishing email. Export full headers of the fake instruction message and of the genuine one.
• Write what you know on one page: times, amounts, account numbers, who you called, claim numbers. The carrier, the FBI and later the lawyers will all ask for it.
• Call every party to the transaction by phone, at numbers you already had on file, and say: do not act on any email instruction from Harbor Title until further notice; we will confirm all wire instructions by phone. Then call the other open files whose parties appear on the export list.
• Tell the whole office that one mailbox was compromised, that MFA resets are coming, and that all wire-instruction changes are frozen for the day.

Afterwards

The deposit may or may not come back; the bank recall and the kill chain decide that, and both work best in the first day. What Harbor Title can control is the next file. Enable inbound impersonation detection so a nine-day-old lookalike domain and “updated instructions” language produce a warning instead of a normal message. Send outbound wire instructions with locked delivery, a one-time code and a “we never change instructions by email, call us” notice, so the fake version looks wrong. Keep the archive and the per-message record, because the E&O claim and any lawsuit will turn on what Harbor Title actually sent and when it was opened. Then run this drill with staff, with a stopwatch. Legal & title overview → · How PXCMail handles incidents →

Questions

Who calls the bank if the escrow officer is the one whose mailbox was compromised?

Whoever can get through fastest, but the account holder of record must authorize the recall, so have the escrow manager or owner on the call. Keep Maria working the receiving-bank call; she has the file details.

Do we tell the client before we know what happened?

Yes. The client needs to stop acting on email from you today. “We are investigating a compromised mailbox; confirm everything by phone” is enough and is honest.

Does cyber insurance cover the buyer’s lost deposit?

It depends on the policy and on who was tricked. Funds-transfer-fraud coverage, social-engineering sub-limits and E&O all read differently. Coalition’s claims data puts BEC and funds-transfer fraud at 58% of claims, which is why carriers now ask about wire controls at renewal.

How long do we keep the evidence?

Until the carrier, the bank and counsel say the matter is closed, and then under your normal retention. A legal hold in the archive is the simplest way to make sure nothing expires in the meantime.

What if the fake email came from a lookalike domain, not our account?

Then your systems were not breached, but your client still lost money in your transaction. The same first hour applies: recall, IC3, carriers, clients. Afterwards, inbound detection of lookalikes and a standing verify-by-phone notice are the fixes.

---

Was this useful? Tell us at [email protected]. Related: checklists · regulations in plain English.

Sources

• FBI IC3, 2024 Internet Crime Report — reports 859,532 complaints and $16.6 billion in losses in 2024, including 21,442 BEC complaints and $2.77 billion in BEC losses.
• FBI IC3, public service announcement, September 2024 — puts reported exposed BEC losses at $55.5 billion from October 2013 to December 2023.
• Coalition, 2026 Cyber Claims Report — finds BEC and funds-transfer fraud were 58% of 2025 claims, with 52% of funds-transfer-fraud claims beginning as BEC and an average claim of about $116,000.