The Email Scam That Steals Your Down Payment: What Every Buyer Must Verify Before Wiring Funds

You are about to wire the largest sum of money you have ever moved in a single transaction — and criminals know it.

Real estate wire fraud is not a rare disaster that happens to other people. FBI data shows losses from real estate scams jumped from under $9 million in 2015 to $446 million in 2022^[6]. That is a 50-fold increase in seven years. And according to CertifID's 2024 State of Wire Fraud Report, approximately half of consumers do not report being adequately aware of the risk^[6]. You may be sitting across the closing table right now, and no one has told you what fraud looks like.

This is not a story about cybersecurity for corporations. This is about the email you are about to receive — the one that tells you where to send your down payment — and why you must verify every digit before you touch your keyboard.

---

How the Scam Works — And Why First-Time Buyers Are Targeted

Here is the mechanics, because once you see it, you cannot unsee it.

It starts with phishing — a fraudster collects your private information through a website form, email, or phone call, then uses that information to monitor your email account^[6]. They watch. They wait. When they see you are in the homebuying process — when you start emailing with agents, lenders, or escrow officers about your closing — they act^[3].

"First-time home buyers, who are not as familiar with the nuances of the closing process, are often the most vulnerable to scams because they don't know what to look out for," Diane Tomb, CEO of the American Land Title Association, told NAR^[3]. "Even though many are digitally savvy, cybercriminals have become more sophisticated over the last decade and are willing to wait for weeks or even months to strike."

The fraudster sends false wire transfer instructions disguised to appear as if they came from a trusted real estate professional^[3]. In one case the California Department of Real Estate flagged in a consumer alert, a seller agent's email was hacked, and the criminal used that agent's inbox to send wire instructions to the buyer. The buyer, recognizing the agent's email address from prior communications, wired nearly $200,000 without verifying with escrow^[1]. That money is gone.

---

Who Gets Paid When Your Deal Closes — And Why That Creates a Blind Spot

Every party in your closing — the real estate agents, the title company, the escrow officer, the lender — is compensated only when the deal closes^[1]. That structure creates a real incentive: everyone in the room has a financial reason to keep the transaction moving, even when slowing down would protect you.

No one in that room is paid to slow down and triple-check your wire instructions. The title company may warn you in fine print. The agent may mention fraud risk. But none of them is financially accountable for a successful scam landing in your inbox the day before closing.

The one layer of protection that does exist — the escrow company — is often the one whose instructions get forged. The scam works precisely because it impersonates the trusted party you are supposed to trust.

---

The Case That Shows Exactly Who Pays When It Goes Wrong

In Bain v. Platinum Realty, LLC (D. Kan. 2018), a buyer wired funds to a fraudster after receiving wire instructions via email from the seller agent's compromised account^[1]. The buyer sued the agent and broker for negligence.

The court held the seller agent and their broker liable for 85% of the funds lost^[1]. The buyer was held responsible for the remaining 15% because they "failed to use reasonable care to check with escrow to confirm the propriety of the instructions before wiring the funds"^[1].

Read that again. Even though the agent's email was hacked and the fraudster was the direct cause of loss, the buyer still lost 15% of their down payment — roughly $30,000 on a $200,000 wire — because they did not pick up the phone and call escrow.

The lesson is not that you are on your own. The lesson is that verification is not optional. It is the only thing standing between you and shared liability.

---

What You Can Do: The Verification Steps That Actually Work

Here is what the agencies, the title industry, and the court in Bain all agree on:

1. Call escrow on a number you looked up yourself — never the one in the email

Do not use the phone number in the wire instruction email. That is the number the fraudster controls. Look up the escrow company's number independently — from your closing disclosure, from the company's website, from a directory — and call before you send anything^[1][6].

Ask: "I received wire instructions for my closing. Can you confirm the routing number and account number are correct?"

2. Treat every email wire instruction as potentially compromised

Wire transfer instructions emailed to you are the single most common attack vector in real estate fraud^[3]. About half of title and settlement agents report receiving at least one phishing email with fraudulent wire instructions per month^[3]. If professionals get these emails monthly, you will get them too.

Be on high alert for: slight changes to an email address (one character added or deleted), urgent language ("funds must be received today"), or any request that deviates from what you expected^[6].

3. Confirm in person or by phone with a known number — every single time

The rule is not "call if it seems suspicious." The rule is "call every time, before you wire anything, regardless of how normal the email looks"^[6].

"Always verify with a phone call prior to sending funds via a wire," the California DRE consumer alert states^[1]. This is not paranoia. This is the specific action Bain found was missing.

4. Do not email financial information — not your account number, not your wiring confirmation

Fraudsters use your email thread to learn your timeline, your lender, and your escrow officer. If you must communicate financial information, use a known, direct phone line or a secure portal your escrow company provides^[6].

5. Secure your own email account

Enable multi-factor authentication on your email^[1]. This requires a second form of verification — a text code, an app notification — before anyone can access your inbox. Fraudsters who phish your password cannot log in without it.

---

If It Has Already Happened: The Recovery Window Is Narrow

If you wired funds and something feels wrong, act immediately^[6]. Time is the enemy. The faster you move, the more likely financial institutions and law enforcement can freeze or recover funds before they leave the country.

1. Call your bank or credit union and ask them to contact the institution where the transfer was sent^[6].
2. Contact your local FBI office — they work directly with financial institutions on fund recovery^[6].
3. File a complaint at IC3.gov, the FBI's Internet Crime Complaint Center^[6].

The title industry reports that recovery rates are improving: in 2022, 26% of title companies were able to recover the total amount of incorrectly transferred funds, up from 17% in 2021; two-thirds recovered more than half of stolen funds^[6]. But those odds still leave one-third of victims with less than half their money back. Prevention is always better than recovery.

---

What This Means for You

The wire fraud system works like this: criminals compromise an email account, watch your closing unfold, and send you instructions that look exactly like the real ones from the exact people you trust. Every person in your closing — your agent, your lender, your escrow officer — is paid when the deal closes. None of them is paid to verify your wire instructions. The court in Bain v. Platinum Realty made clear: if you wire without calling escrow, you share liability for whatever disappears.

That is not fair. It is also the rule.

The good news: the fix is one phone call. Not an email. Not a reply to the wire instruction thread. A verified phone number you found yourself, speaking to a human at the escrow company who confirms the numbers. That is the entire mechanism between you and a $200,000 loss.

---

What You Can Do This Week

• Call your escrow officer before you wire anything. Use the phone number on your closing disclosure or the escrow company's website — not any number in a wire instruction email. Ask: "Are these routing and account numbers correct for my closing?"

• Set up multi-factor authentication on your email account now. If you use Gmail, Apple Mail, or Outlook, go to your security settings and enable two-factor verification. This takes 10 minutes and blocks the most common entry point for these scams.

• Do not email financial account numbers, wiring confirmations, or closing details to anyone in the transaction. Use phone calls or a secure portal your escrow company provides.

• If you are a first-time buyer, ask your agent specifically how wire instructions will be delivered. The answer should be: "I will not send them by email. The escrow company will send them directly, and you should call them to confirm." If your agent cannot explain the delivery process clearly, ask for that explanation before the wiring phase begins.

• If you wired funds and something feels wrong, call your bank immediately, then contact the FBI field office in your area, and file a complaint at IC3.gov within the same business day. Time is the critical variable in recovery.