Anatomy of a closing-wire fraud, and the three places email could have stopped it
The fraud is boring, which is why it works. Here is a composite of cases reported to the FBI’s IC3, whose 2024 Internet Crime Report logged 21,442 business email compromise complaints and $2.77 billion in BEC losses in a single year. Coalition’s 2026 Cyber Claims Report puts BEC and funds-transfer fraud at 58% of all claims, with 52% of funds-transfer-fraud claims starting as BEC.
Day 1: the inbox
An agent’s mailbox is phished. Nothing is stolen; the attacker just reads. Over a week they learn the closing date, the parties, the title company, and how everyone writes.
Day 7: the lookalike
A domain is registered that differs from the title company’s by one letter. A message goes to the buyer, in the closer’s voice, with “updated wire instructions due to an audit at our bank”.
Day 9: the wire
The buyer wires the down payment. By the time the real closer asks where the funds are, the money has been moved twice.
Where email could have broken the chain
- Inbound, at the buyer’s agent or the title company: a nine-day-old lookalike domain and “changed account” language should produce a red banner, not a normal message.
- Outbound, from the title company: wire instructions sent locked with a one-time code, carrying a “we never change instructions by email, call us” notice, make the fake version look wrong.
- The record: when the dispute starts, the archive shows exactly what the title company sent and when it was opened, which matters for the E&O claim and the lawsuit.
What a small firm can do this month
Publish DMARC so your own domain can’t be spoofed. Put the verify-by-phone notice in every wire message. Turn on MFA. Then make the first two automatic; that is what PXCMail for legal and title does on the Microsoft 365 or Google account you already have. If the wire has already gone, the first 60 minutes are the playbook.
Sources
- FBI IC3, 2024 Internet Crime Report — reports 21,442 BEC complaints and $2.77 billion in BEC losses in 2024.
- FBI IC3, public service announcement, September 2024 — puts reported exposed BEC losses at $55.5 billion from October 2013 to December 2023.
- Coalition, 2026 Cyber Claims Report — finds BEC and funds-transfer fraud were 58% of 2025 claims and 52% of funds-transfer-fraud claims began as BEC.
Priya leads security at PacinfraX and handles incident response for customers. She writes about business email compromise, wire fraud and what examiners and carriers actually ask for. About the team →
Reviewed against the regulation text cited above. Not legal advice.